inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Evercover | · Dec 21, 2025 | — |
| Talarico | · Dec 21, 2025 | — |
| glasserstv.com | · Dec 20, 2025 | — |
| eagrealtyinternational.com | · Dec 20, 2025 | — |
| Pacific Rim Mechanical | · Dec 18, 2025 | — |
| deerfield.com (singulargenomics.com) | · Dec 18, 2025 | — |
| CVK Hotels & Resorts_Turkey | · Dec 18, 2025 | — |
| https://avenira.com/ | · Dec 17, 2025 | — |
| Precise Benefits Group LLC | · Dec 16, 2025 | — |
| cityofsignalhill.org | · Dec 15, 2025 | — |
| steelworksinc.ca | · Dec 15, 2025 | — |
| beycelik | · Dec 13, 2025 | — |
| www.lincecomercial.com | · Dec 10, 2025 | — |
| rainbowtel.net | · Dec 10, 2025 | — |
| www.labiennale.org | · Dec 9, 2025 | — |
| sandiegowarroom.com | · Dec 8, 2025 | — |
| Foxconn Interconnect Technology Limited (FIT) | · Dec 8, 2025 | — |
| hohmartin.org | · Dec 8, 2025 | — |
| YAZAKI Corp | · Dec 7, 2025 | — |
| www.mylawcompany.com | · Dec 6, 2025 | — |
| instyle.com.au | · Dec 3, 2025 | — |
| bisonfamilymedical.com | · Dec 3, 2025 | — |
| American Pools & Spas | · Dec 2, 2025 | — |
| www.precipiodx.com | · Dec 2, 2025 | — |
| oxfordshop.com.au | · Dec 2, 2025 | — |
| millerwoodtradepub.com | · Dec 1, 2025 | — |
| www.enea.com | · Dec 1, 2025 | — |
| vviewisd.net | · Nov 29, 2025 | — |
| PFMI | · Nov 27, 2025 | — |
| FIT | · Nov 26, 2025 | — |
| ITL Systemhaus | · Nov 26, 2025 | — |
| cryopur.com | · Nov 25, 2025 | — |
| Schmidt's | · Nov 25, 2025 | — |
| Southern Lion Sdn Bhd | · Nov 24, 2025 | — |
| omegatoolcorp.com | · Nov 24, 2025 | — |
| onsolve.com | · Nov 22, 2025 | — |
| Woom GmbH | · Nov 22, 2025 | — |
| TBTEAM | · Nov 22, 2025 | — |
| naffco.com | · Nov 20, 2025 | — |
| reidhurstnagy.com | · Nov 19, 2025 | — |
| baisyaakov.ca | · Nov 18, 2025 | — |
| datenlotsen.de | · Nov 18, 2025 | — |
| zadroinc.com | · Nov 18, 2025 | — |
| ripleyacademy.org | · Nov 18, 2025 | — |
| grandeprairie.org | · Nov 18, 2025 | — |
| continuumindia.com | · Nov 18, 2025 | — |
| www.entecheng.com | · Nov 17, 2025 | — |
| eakas.com | · Nov 14, 2025 | — |
| Kaan Cronenberg & Partners Law | · Nov 14, 2025 | — |
| rosemontexpo.com | · Nov 14, 2025 | — |
In the newsAll →
No articles mention this group yet.