From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware

INC is a highly active ransomware-as-a-service operation (over 800 victims since 2023) that has rewritten its Windows and Linux/ESXi encryptors in Rust, expanded via affiliate migration, and improved tooling (including a Veeam credential dumper supporting salted DPAPI). The report covers its attack chain (initial access via phishing, exploited CVEs, credential theft, lateral movement and defense impairment), TTPs, technical analysis, IOCs, and mitigation recommendations to reduce risk from this persistent double-extortion threat.