Active ransomware operator
← All groupsIncransom
aka inc ransom · 805 victims indexed · first seen 3 years ago · last activity 1 day ago
At a glance
- Status
- active
- Aliases
- inc ransom
- First seen
- 3 years ago
- Last activity
- 1 day ago
- Onion sites
- 12 known endpoints
- Primary sector
- Not Found · 177 hits
About
References
1 linkExternal sources curated by the MISP threat-intel community.
Timeline
24 monthsTop countries
Top sectors
MITRE ATT&CK
25 techniques · 13 tacticsTactics
Techniques
- T1021.001Remote Desktop Protocol
- T1036.005Match Legitimate Resource Name or Location
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1059.003Windows Command Shell
- T1069.002Domain Groups
- T1070.004File Deletion
- T1071Application Layer Protocol
- T1074Data Staged
- T1078Valid Accounts
- T1087.002Domain Account
- T1105Ingress Tool Transfer
- T1135Network Share Discovery
- T1190Exploit Public-Facing Application
- T1219Remote Access Tools
- T1486Data Encrypted for Impact
- T1537Transfer Data to Cloud Account
- T1560.001Archive via Utility
- T1566Phishing
- T1569.002Service Execution
- T1570Lateral Tool Transfer
- T1588.002Tool
- T1657Financial Theft
- T1685Disable or Modify Tools
Recent victims
Loading…
Onion infrastructure
12 known- http://incapt.blog
- http://incapt.su
- http://incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion
- http://incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion/api/v1/blog/get/announcements?page=1&perPage=15
- http://incbackend.top
- http://incbackfgm7qa7sioq7r4tdunoaqsvzjg5i7w46bhqlfonwjgiemr7qd.onion
- http://incbackfgm7qa7sioq7r4tdunoaqsvzjg5i7w46bhqlfonwjgiemr7qd.onion/api/v1/blog/get/announcements?page=1&perPage=15
- http://incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion
- http://incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion/api/blog/get-leaks
- http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion
- http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures
- http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion
Source
Updated 1 day agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
