Inc Ransom Attack Analysis

ReliaQuest investigated an April 2024 intrusion by the 'Inc Ransom' double-extortion ransomware group that gained likely initial access to an internet-facing Fortinet EMS server (CVE-2023-48788), deployed RMM tools (AnyDesk, SimpleHelp), harvested credentials (SAM export, secretsdump.py), used pass-the-hash for lateral movement to obtain domain admin access, and exfiltrated file-share data with the backup tool Restic; no file encryption was observed but the activity aligns with typical double-extortion tactics and includes recommendations for patching, network segmentation, EDR, and application control.