inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims917 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| horizoneye.com | · Jun 24, 2026 | — |
| belpointeasset.com \ belpointe.com | · Jun 23, 2026 | — |
| jktornel | · Jun 21, 2026 | — |
| Newspaper Media Group | · Jun 20, 2026 | — |
| Horizon Family Medical Group | · Jun 18, 2026 | — |
| neuwoges.de | · Jun 18, 2026 | — |
| jasperplastics.info | · Jun 16, 2026 | — |
| framesiprofessional.com | · Jun 16, 2026 | — |
| 3 | · Jun 15, 2026 | — |
| Signazon_USA | · Jun 11, 2026 | — |
| Kewaunee Scientific | · Jun 11, 2026 | — |
| DISCOLABINDU | · Jun 11, 2026 | — |
| fineconsulting | · Jun 11, 2026 | — |
| FIZA | · Jun 10, 2026 | — |
| kelmreuter.com | · Jun 6, 2026 | — |
| obrieneng.com | · Jun 5, 2026 | — |
| Stuga Machinery | · Jun 4, 2026 | — |
| pdcbodynits | · Jun 4, 2026 | — |
| CUSTOMSIGN | · Jun 4, 2026 | — |
| Colina Financial Advisors | · Jun 3, 2026 | — |
| Oztugotomotiv | · Jun 3, 2026 | — |
| trrac.net | · Jun 2, 2026 | — |
| Bradley law firm | · Jun 1, 2026 | — |
| Champaign-Urbana Public Health District | · Jun 1, 2026 | — |
| www.labexpress.com | · May 30, 2026 | — |
| belimed.com | · May 29, 2026 | — |
| lawants | · May 28, 2026 | — |
| Distrigaz Vest S.A. | · May 27, 2026 | — |
| PILLER AIMMCO | · May 26, 2026 | — |
| Open Door Health Center | · May 25, 2026 | — |
| Meirc training and consulting | · May 25, 2026 | — |
| Mecanizados y Montajes Aeronáuticos (mymgroup.es) | · May 23, 2026 | — |
| threadinnovations | · May 22, 2026 | — |
| Nothing | · May 19, 2026 | — |
| bergen1.net | · May 18, 2026 | — |
| metaval.com.au | · May 17, 2026 | — |
| defenseisready.com | · May 15, 2026 | — |
| United Quality Cooperative / www.uqcoop.com | · May 15, 2026 | — |
| Silergy Corp | · May 13, 2026 | — |
| Bideawee | · May 12, 2026 | — |
| rbh aerospace inc | · May 12, 2026 | — |
| lalsgroup.com | · May 12, 2026 | — |
| lopezlawfl.com | · May 10, 2026 | — |
| https://sibillacapital.com/ | · May 10, 2026 | — |
| Calsoft Inc | · May 9, 2026 | — |
| earthsystems.com.au earthsystemseurope.com | · May 8, 2026 | — |
| egnyte.com | · May 8, 2026 | — |
| autorisk.org | · May 7, 2026 | — |
| cmswpc.com | · May 7, 2026 | — |
| lafj.org | · May 7, 2026 | — |
In the newsAll →
No articles mention this group yet.