INC RANSOMWARE : THREAT INTELLIGENCE

**INC Ransomware intelligence snapshot:** This report documents discovery of INC's negotiation/chat panel (including the Onion address and a revealed real IP), analysis of the bundled JavaScript and tech stack (React/Redux/Socket.io, JWT auth), unusual operational choices (use of port 1002), hosting and CDN/IP overlap patterns (heavy Russian hosting, mixed cloud usage, Cloudflare fronting), sample timelines and sizes (108 samples, clustering around April 2024 and larger stable builds in 2025), and operational scale (≈872 victims with active disclosures), concluding that INC is an active, evolving ransomware actor with reusable infrastructure and multiple spin-offs.