MITRE ATT&CKgroup

G1032 INC Ransom

Published 2024-06-06 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
GOLD IONIC
Version
1.0
Created
2024-06-06

Description

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

Related

Uses · MITRE ATT&CK (33)

  • T1685 Disable or Modify Tools technique
  • S1139 INC Ransomware software (malware)
  • T1657 Financial Theft technique
  • S1040 Rclone software (tool)
  • S0552 AdFind software (tool)
  • T1588.002 Tool sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1569.002 Service Execution sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566 Phishing technique
  • T1069.002 Domain Groups sub-technique
  • T1087.002 Domain Account sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • S0404 esentutl software (tool)
  • T1537 Transfer Data to Cloud Account technique
  • T1486 Data Encrypted for Impact technique
  • S0359 Nltest software (tool)
  • T1190 Exploit Public-Facing Application technique
  • T1219 Remote Access Tools technique
  • S0183 Tor software (tool)
  • T1135 Network Share Discovery technique
  • S0029 PsExec software (tool)
  • S0039 Net software (tool)
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
  • T1071 Application Layer Protocol technique
Show all 33 ›

References