INC Ransom Affiliate Model Enabling Targeting of Critical Networks

INC Ransom (aka Tarnished Scorpion / GOLD IONIC) is a Ransomware-as-a-Service group active since mid-2023 that and its affiliates have targeted organisations—notably health care providers—in Australia, New Zealand and Pacific island states using compromised credentials and exploited public-facing systems to exfiltrate sensitive data and perform double-extortion via a dark web data leak site; the advisory details observed incidents (including the Tonga Ministry of Health), mapped MITRE ATT&CK techniques, IOCs (e.g., ransom notes, file named win.exe), and recommended mitigations.