{"id":1367,"date":"2026-06-18T17:33:04","date_gmt":"2026-06-18T17:33:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1367"},"modified":"2026-06-18T17:33:04","modified_gmt":"2026-06-18T17:33:04","slug":"inc-ransomware-emerges-as-major-raas-threat-in-2026-with-830-victims-since-2023","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1367","title":{"rendered":"INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 18, 2026<\/span><\/span>Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have charted the evolution of INC from an nascent ransomware-as-a-service (RaaS) operation to one of the most prolific cybercrime groups in 2026, claiming no less than 830 victims<\/a> since August 2023.<\/p>\n

\u00abThe disruption of LockBit and the shutdown of BlackCat created opportunities for INC to expand as affiliates migrated to alternative ransomware operations,\u00bb Acronis researcher Darrel Virtusio said<\/a>. \u00abUnited States organizations account for more than 65% of listed victims, with legal services, manufacturing, construction, technology and health care among the most targeted sectors.\u00bb<\/p>\n

INC’s Windows and Linux\/ESXi encryptors have also been rewritten in Rust to facilitate easier cross-platform development and better resist reverse engineering efforts. Attacks deploying the ransomware are characterized by the use of an updated credential dumper capable of targeting newer Veeam backup deployments that use the salted DPAPI credential encryption.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

What’s more, the sale of INC’s Windows and Linux variants on the cybercrime underground in May 2024 has led to the emergence of related ransomware families such as Lynx and Sinobi with \u00absignificant code overlap,\u00bb even as the brand has continued to evolve.<\/p>\n

<\/p>\n

\u00abINC ransomware affiliates utilize a diverse range of tools and techniques in targeting victims,\u00bb Acronis said. \u00abIn their latest campaigns, they continue to target unpatched edge devices for initial access, dump credentials from Veeam backup servers, and use a mix of LOLBins and commercial RMM tools to move through victim networks.\u00bb<\/p>\n

\"\"<\/a><\/div>\n

The overall attack chain adopted by the double extortion crew is as follows –<\/p>\n