INC Ransomware Gang Targets the Legal Sector

The INC Ransomware-as-a-Service (RaaS) operation has grown into a major ransomware campaign in 2026, claiming hundreds of victims across multiple sectors and recently prioritizing legal services due to the sensitive nature of client documents; researchers report initial access via spear phishing, purchased credentials from initial access brokers, and exploitation of public-facing application vulnerabilities and recommend a defense-in-depth posture including immutable 3-2-1 backups, EDR/ransomware protection, MFA and strong passwords, network segmentation, robust patching, and regular security awareness training.