inc ransom
ransomware group · aka Inc Ransom, IncRansom · unknown (no authoritative public attribution; no confirmed country of operation) · active since 2023-07
Inc Ransom is a ransomware and data-extortion group first observed in July 2023, known for double extortion using a Tor-hosted leak site. Vendor research links its initial access to exploitation of internet-facing Citrix NetScaler appliances (CVE-2023-3519, CVE-2023-4966). It drew broad attention in March 2024 for the NHS Dumfries and Galloway breach in Scotland and in 2024 for a claimed theft of data from Citrix. Researchers have documented Windows and Linux/ESXi encryptor variants for the group's tooling. Its organizational structure (single crew versus affiliates) and aggregate earnings are not publicly established, and it remains active with intermittent victim postings.
- Initial access via exploitation of unpatched internet-facing Citrix NetScaler ADC/GateWay appliances (CVE-2023-3519; CVE-2023-4966), per vendor reporting
- Data exfiltration before encryption, followed by double extortion on a Tor leak site
- Separate encryptor builds for Windows and for Linux/ESXi environments documented by researchers
- Ransom notes dropped on compromised systems; negotiation via leak-site chat, email, or Tox
- Targets organizations holding sensitive records; healthcare and public-sector victims emphasized in public coverage
- Emphasis on large data volumes in extortion messaging, including claimed terabyte-scale thefts in 2024 reporting
- Organizational model unclear; affiliate involvement not confirmed, so per-incident attribution should be treated cautiously
NHS Dumfries and Galloway (Scotland) — March 2024, widely reported; group published stolen data, Citrix — June 2024 claimed breach; the group alleged roughly 1 TB of stolen data, per BleepingComputer (2024), Yamaha Motor Philippines subsidiary — 2023 listing reported in security press, Mediengruppe Thiel (mediengruppethiel.de) — listed on the group leak site, September 2026, per this dashboard, Wellness Partners network — listed on the group leak site, September 2026, per this dashboard
No public figure.
Leak-site victims922 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| kellylegal.com.au | · Nov 14, 2025 | — |
| wafergrind.com | · Nov 14, 2025 | — |
| duboiswood.com | · Nov 14, 2025 | — |
| facadeinnovations.com.au | · Nov 14, 2025 | — |
| www.northcroftme.com | · Nov 14, 2025 | — |
| avrind.com | · Nov 13, 2025 | — |
| KohaFoods Hawaii | · Nov 12, 2025 | — |
| Grupo Via Argentina | · Nov 12, 2025 | — |
| bridge-housing-corp | · Nov 12, 2025 | — |
| latamlex (gyg.local) | · Nov 12, 2025 | — |
| Znojma Czechia | · Nov 12, 2025 | — |
| galileo.it | · Nov 12, 2025 | — |
| forensicmed.com | · Nov 12, 2025 | — |
| Wiraswasta Gemilang | · Nov 12, 2025 | — |
| Sarulla Operation | · Nov 11, 2025 | — |
| www.modcomedia.com | · Nov 11, 2025 | — |
| Easterseals Arc of Northeast Indiana | · Nov 11, 2025 | — |
| Community Unit School District 201 | · Nov 11, 2025 | — |
| Weintraub Traub Tracy & Virk Cra's LLP | · Nov 10, 2025 | — |
| pmsp.at | · Nov 6, 2025 | — |
| elektroanlagen | · Nov 6, 2025 | — |
| Ketat Grundstücksverwertungs GmbH | · Nov 6, 2025 | — |
| prutsch-ra.at | · Nov 6, 2025 | — |
| MusikComputer GmbH | · Nov 6, 2025 | — |
| zebra.or.at | · Nov 6, 2025 | — |
| The Union League of Philadelphia | · Nov 6, 2025 | — |
| sensationalteeth.com | · Nov 5, 2025 | — |
| thevisapro.com (Yibirin Law Group) | · Nov 4, 2025 | — |
| REPECHAGE | · Nov 3, 2025 | — |
| afton.loc | · Nov 3, 2025 | — |
| Vitalmex | · Nov 3, 2025 | — |
| TMF Logistics | · Nov 1, 2025 | — |
| aa-llp.com (aa.law) | · Oct 31, 2025 | — |
| VZW Avalon | · Oct 31, 2025 | — |
| Evolve Mortgage Services | · Oct 30, 2025 | — |
| DILOSA FOOD COMPANIES | · Oct 30, 2025 | — |
| Alios Finance Group | · Oct 28, 2025 | — |
| dwgra.com | · Oct 27, 2025 | — |
| partitio.com | · Oct 27, 2025 | — |
| auge.com | · Oct 26, 2025 | — |
| Kumwell | · Oct 22, 2025 | — |
| summitgolfbrands.com | · Oct 19, 2025 | — |
| Shadrix & Parmer, P.C. | · Oct 17, 2025 | — |
| baronespecialtysteel.com | · Oct 14, 2025 | — |
| NextGen Mold Technologies | · Oct 10, 2025 | — |
| Benedict Industries | · Oct 10, 2025 | — |
| georgetown-brewing-co | · Oct 10, 2025 | — |
| https://www.tongapower.to/ | · Oct 10, 2025 | — |
| Chapter 13 Texas | · Oct 8, 2025 | — |
| WELLSLANDSCAPING.COM | · Oct 6, 2025 | — |
In the newsAll →
No articles mention this group yet.