Ransomware Intelligence / Groups / inc ransom

Ransomware group

inc ransom

INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

  • 9claims, 7 days
  • 38claims, 30 days
  • 118claims, 90 days
  • 2026-07-17first seen
  • 2026-10-16last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-04-20: 0Week of 2026-04-27: 0Week of 2026-05-04: 0Week of 2026-05-11: 0Week of 2026-05-18: 0Week of 2026-05-25: 0Week of 2026-06-01: 0Week of 2026-06-08: 0Week of 2026-06-15: 0Week of 2026-06-22: 0Week of 2026-06-29: 0Week of 2026-07-06: 0Week of 2026-07-13: 8Week of 2026-07-20: 4Week of 2026-07-27: 12Week of 2026-08-03: 11Week of 2026-08-10: 7Week of 2026-08-17: 13Week of 2026-08-24: 6Week of 2026-08-31: 14Week of 2026-09-07: 4Week of 2026-09-14: 11Week of 2026-09-21: 8Week of 2026-09-28: 10Week of 2026-10-05: 10Week of 2026-10-12: 8
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Sectors claimed, last 90 days

  1. Unclassified 27
  2. Manufacturing 18
  3. Professional services 15
  4. Healthcare 13
  5. Nonprofit 7
  6. Financial services 6
  7. Critical infrastructure 5
  8. Government 5
  9. K-12 education 4
  10. Retail 4
  11. Technology 4
  12. Construction 3
  13. Media and entertainment 3
  14. Higher education 2
  15. Hospitality 1
  16. Other 1

Countries claimed, last 90 days

  1. United States 58
  2. Unknown 5
  3. Canada 5
  4. Germany 4
  5. United Arab Emirates 3
  6. Brazil 3
  7. Switzerland 3
  8. United Kingdom 3
  9. Mexico 3
  10. Malaysia 3
  11. Argentina 2
  12. Australia 2
  13. Spain 2
  14. India 2
  15. Taiwan 2

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog does not attribute entries to a specific group; this is the current patch list for any ransomware operator.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Data sources

  • Source: CISA KEV
    updated 2 hours ago
  • Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.
    updated 2 hours ago
  • Source: RansomLook
    updated 2 hours ago
  • updated 2 hours ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.
    updated 2 hours ago

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.