INC Ransomware Thrives by Mastering the Basics

INC is an emerging RaaS ransomware group (active since 2023) that has claimed over 800 victims by focusing on high-pressure sectors (healthcare, manufacturing, legal, etc.). The group uses common intrusion methods—spear-phishing, stolen credentials via initial access brokers, and exploitation of known CVEs—followed by credential theft, living-off-the-land lateral movement, EDR disabling, and data exfiltration for double extortion; its malware exists for Windows and Linux/ESXi and was recently rewritten in Rust. Acronis published YARA rules and IOCs and recommends robust backup strategies, patching, identity/access controls, and network segmentation to mitigate risk.