ZeroHour

inc ransom

ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07

Victims · 7d
7▲4 vs prev. week
Victims · 30d
39active targets
Victims · 90d
109
All-time (tracked)
922since 2023-08-09
Last post
09-16 17:44UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.

Tactics & tooling
  • Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
  • Data exfiltration before encryption, followed by double extortion on a Tor leak site
  • Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
  • Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
  • Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
  • Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
  • Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
Targeted sectors
HealthcareGovernment/Public SectorTechnologyManufacturing
Notable public victims

NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard

CVEs linked to their intrusions
Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
mcfirm.com · Mar 2, 2026
https://www.precisioncoating.com/ · Mar 2, 2026
Martin, Cukjati & Tom, LLP · Mar 2, 2026
http://ramet-trom.co.il/ · Mar 1, 2026
denmark.k12.wi.us · Mar 1, 2026
abramssales.com · Mar 1, 2026
lke-group.com · Mar 1, 2026
Lymphedema Therapy Specialists · Feb 27, 2026
Law Offices Taenzer & Ettenson, P.C. (tesalaw.com) · Feb 27, 2026
Empresa de Transportes Via Pajuçara Ltda. · Feb 27, 2026
Tract Consulting · Feb 27, 2026
https://daricon.com/ (military US/CA/NATO) · Feb 26, 2026
https://daricon.com/ · Feb 26, 2026
WE Fitness · Feb 26, 2026
APRO Asian Protection Pte Ltd · Feb 26, 2026
JA AKITA KITA LIFE SERVICE, K.K · Feb 26, 2026
acwapower.com \ https://www.larsentoubro.com/ · Feb 24, 2026
primepak.com · Feb 23, 2026
The City of Cocoa · Feb 23, 2026
Rainier Clinical Research Center · Feb 23, 2026
polymedicure.com · Feb 20, 2026
aircotedivoire.com · Feb 19, 2026
Valgo SA · Feb 19, 2026
Hiwassee Builder Supply · Feb 17, 2026
farbank.com (flywatertravel) · Feb 17, 2026
ACS Accountancy · Feb 16, 2026
Ondine Biomedical · Feb 16, 2026
Nang Kuang Pharmaceutical Co., Ltd. · Feb 15, 2026
Bitgo · Feb 14, 2026
rswater.ae · Feb 12, 2026
Midwestern Oil & Gas · Feb 12, 2026
lohmann-tapes.com · Feb 12, 2026
auxhomeservices.com · Feb 12, 2026
atchadwick.net · Feb 12, 2026
excavationtourigny.ca · Feb 12, 2026
www.hfplanners.com · Feb 11, 2026
moultriesheriff.com · Feb 10, 2026
Core Supply · Feb 10, 2026
tuftco · Feb 9, 2026
AOT Japan · Feb 5, 2026
Western New York Energy · Feb 3, 2026
Blystone & Bailey · Feb 3, 2026
H-Behbehani Brothers WLL · Feb 3, 2026
ChokChey Finance · Feb 2, 2026
www.pucobre.cl · Feb 2, 2026
Best Attorneys · Feb 2, 2026
Foamtec International · Feb 1, 2026
Hawk Law Group · Feb 1, 2026
Beacon Mutual Insurance · Jan 31, 2026
PK PINHÃO & KOIFFMAN ATTORNEYS AT LAW · Jan 30, 2026

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .