Threat video1:00
Incransom, The Gentlemen & Audit Team: Detection & IOCs
Incransom, The Gentlemen and Audit Team posted victims in early September 2026; hunt with 9 detection rules, 23 IOCs and a free Splunk SPL rule.
Read the full threat intel for Incransom, The Gentlemen & Audit Team: Detection & IOCs →
Chapters
- 0:00The hookAbout top 10 groups hold 71.1%.
- 0:04The storyINCRANSOM posted 11 victims.
- 0:11Attack pathLikely entry: perimeter flaws, phishing or valid logins.
- 0:28AttributionAttributed to Incransom.
- 0:32Indicators of compromise13 indicators to hunt: 4 SHA-1 hashes, 8 file names and 1 path.
- 0:39MITRE ATT&CK techniques19 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Patch and restrict internet exposure of VPN gateways, firewalls.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About top 10 groups hold 71.1%.
0:05INCRANSOM posted 11 victims.
0:07TheGentlemen posted 5, Audit Team 4.
0:11Likely entry: perimeter flaws, phishing or valid logins.
0:15Then remote tools stay, and PsExec spreads.
0:19Data leaves first, 24-72 hours before encryption.
0:23Files lock, then the leak-site post.
0:28Attributed to Incransom. Confidence: low.
0:3213 indicators to hunt: 4 SHA-1 hashes, 8 file names and 1 path.
0:3919 ATT&CK techniques, from initial access to impact.
0:444 steps now: Patch and restrict internet exposure of VPN gateways, firewalls.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.