Incransom

Active
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
939 Victims
Aug 6, 2023 First Discovered
Sep 17, 2026 Last Discovered
0 Days Inactive
0% Infostealer
2/7 Sites Online
Known Locations (7)
INC Ransom
incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion
Error Response Page
incapt.su
INC Ransom
incapt.blog
Error Response Page
incbackend.top
incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion
incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion
Disclosures
incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
Tools Used
CredentialTheft
Mimikatz
DiscoveryEnum
AdFind, Advanced IP Scanner, SoftPerfect NetScan
Exfiltration
7-Zip, BackBlaze, MEGA, RClone, Restic, WinRAR, s5cmd
LOLBAS
Finger, PsExec
Networking
Bitvise SSH Client
RMM-Tools
AnyDesk
Victims (939)

Detailed victim list temporarily unavailable

This group has 939 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.