INC Ransom

Techniques (MITRE ATT&CK)25

SourceMITRE ATT&CK

Also known as:GOLD IONIC

About the group

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity60

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 25

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool

Initial access

Exploit Public-Facing Application Phishing

Execution

Windows Management Instrumentation Windows Command Shell Service Execution

Discovery

Network Service Discovery System Network Connections Discovery Domain Groups Domain Account Network Share Discovery

Lateral movement

Remote Desktop Protocol Lateral Tool Transfer

Collection

Data Staged Archive via Utility

Command and control

Application Layer Protocol Ingress Tool Transfer Remote Access Tools

Exfiltration

Transfer Data to Cloud Account

Impact

Data Encrypted for Impact Financial Theft

defense-impairment

Disable or Modify Tools

stealth

Match Legitimate Resource Name or Location File Deletion Valid Accounts

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2023-3519CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

INC Ransom uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →