INCRANSOM Ransomware Gang: 10 Victims in 5 Days — Cross-Sector Campaign Hits Healthcare, Energy & Quantum Tech

---
title: INCRANSOM - Volume Shadow Copy Deletion Pre-Ransomware
id: 9f2c1a4e-7b3d-4e5a-9c1f-incransom001
status: experimental
description: Detects shadow copy deletion and boot recovery tampering consistent with INCRANSOM pre-encryption staging
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.t1562.001
  - actor.incransom
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate backup maintenance (rare on servers with VSS-based backup)
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
      - '\wbadmin.exe'
  selection_vssadmin:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    CommandLine|contains|all:
      - 'recoveryenabled'
      - 'no'
  selection_bcdedit_ignore:
    CommandLine|contains: 'ignoreallfailures'
  selection_diskshadow:
    CommandLine|contains: 'delete shadows'
  selection_wbadmin:
    CommandLine|contains|all:
      - 'delete'
      - 'catalog'
  condition: selection_img and 1 of selection_*
date: 2026/08/05
---
title: INCRANSOM - Rclone or MEGA Data Exfiltration Staging
id: 3a8d5b2c-1e4f-4a6b-8d2e-incransom002
status: experimental
description: Detects execution of Rclone or MEGAcmd, tools INCRANSOM affiliates use for bulk data exfiltration prior to encryption
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1048
  - actor.incransom
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - Hashes
falsepositives:
  - Sanctioned cloud backup workflows using rclone (baseline and allowlist by hash/path)
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAcmd.exe'
      - '\mega-cmd.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  selection_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--config'
      - 'mega.nz'
      - ':s3'
      - ':drive'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ApprovedBackup\'
  condition: selection_img and selection_cmd and not filter_approved_paths
date: 2026/08/05
---
title: INCRANSOM - Lateral Movement via PsExec or Remote Service Creation
id: 7c4e9f1a-2b5d-4c7a-9e3f-incransom003
status: experimental
description: Detects PsExec-style remote execution and suspicious service creation used by INCRANSOM affiliates for domain-wide ransomware deployment
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1021.002
  - attack.t1543.003
  - actor.incransom
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - Computer
falsepositives:
  - Legitimate admin tooling and software deployment (SCCM, PDQ) — allowlist known deployment accounts and source hosts
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\csexec.exe'
      - '\remcom.exe'
  selection_suspicious_svc:
    ParentImage|endswith: '\services.exe'
    CommandLine|contains:
      - '\\ADMIN$\'
      - '\\IPC$\'
      - 'cmd.exe /c'
      - 'powershell.exe -enc'
      - 'powershell.exe -e '
  selection_random_svc_name:
    Image|re: '(?i)C:\\Windows\\[A-Za-z0-9]{8,12}\.exe'
  condition: selection_psexec or selection_suspicious_svc or selection_random_svc_name
date: 2026/08/05

// INCRANSOM Pre-Detonation Hunt: Exfil staging + lateral movement burst (last 7 days)
let Lookback = 7d;
let SuspiciousProcs = dynamic(["rclone.exe","psexec.exe","psexesvc.exe","wmic.exe","vssadmin.exe","bcdedit.exe","nltest.exe","net.exe","csvde.exe","anydesk.exe","screenconnect.exe"]);
let StagingHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousProcs)
    | summarize
        ToolCount = dcount(FileName),
        Tools = make_set(FileName),
        FirstSeen = min(TimeGenerated),
        LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessAccountName
    | where ToolCount >= 3;
let LateralBurst =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (445, 135, 3389, 5985, 5986)
    | where DeviceName in (StagingHosts | project DeviceName)
    | summarize
        UniqueTargets = dcount(RemoteIP),
        TargetIPs = make_set(RemoteIP, 25),
        Ports = make_set(RemotePort)
        by DeviceName, InitiatingProcessFileName
    | where UniqueTargets >= 5;
StagingHosts
| join kind=inner LateralBurst on DeviceName
| project
    DeviceName,
    InitiatingProcessAccountName,
    ToolCount,
    Tools,
    UniqueTargets,
    Ports,
    FirstSeen,
    LastSeen,
    LateralTool = InitiatingProcessFileName
| sort by UniqueTargets desc;

# INCRANSOM Rapid Triage Script — run on suspected staging hosts or via remote sweep
# Security Arsenal Threat Intel | 2026-08-05
$Report = @()

Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$RDP = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$RDPEnabled = ($RDP.fDenyTSConnections -eq 0)
$Report += [PSCustomObject]@{Check='RDP Enabled'; Result=$RDPEnabled; Detail='If true and internet-exposed, disable or restrict via firewall immediately'}
$RDPLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{n='Source';e={$_.Properties[18].Value}} | Sort-Object TimeCreated -Descending | Select-Object -First 5
if ($RDPLogons) { $RDPLogons | Format-Table -AutoSize }

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$Cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -gt $Cutoff -and $_.TaskPath -notlike '\Microsoft*' } |
    Select-Object TaskName, TaskPath, Date, @{n='Action';e={($_.Actions | Select-Object -First 1).Execute}} | Format-Table -AutoSize

Write-Host "=== [3] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $Shadows) {
    $Report += [PSCustomObject]@{Check='Shadow Copies'; Result='NONE FOUND'; Detail='Possible vssadmin deletion — investigate immediately'}
} else {
    $Shadows | Select-Object InstallDate, DeviceObject | Format-Table -AutoSize
}

Write-Host "=== [4] Recently Created Suspicious Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'ADMIN\$|Temp|AppData|cmd.exe /c|powershell.*-[eE][nN]' -or
    ($_.Name -match '^[A-Za-z0-9]{8,12}$' -and $_.PathName -like 'C:\Windows\*')
} | Select-Object Name, State, StartName, PathName | Format-List

Write-Host "=== [5] Known INCRANSOM Tooling Artifacts ===" -ForegroundColor Cyan
$ToolPaths = @('C:\Windows\Temp\rclone.exe','C:\ProgramData\rclone','C:\Users\Public\rclone.exe','C:\Users\Public\psexec.exe','$env:TEMP\ScreenConnect*')
foreach ($p in $ToolPaths) { if (Test-Path $p) { Write-Warning "FOUND: $p"; $Report += [PSCustomObject]@{Check='Tool Artifact'; Result='FOUND'; Detail=$p} } }

Write-Host "=== [6] Network Connections to Exfil-Suspicious Ports ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in @(21,22,443,4444,8443) -and $_.OwningProcess -notin @(Get-Process svchost -ErrorAction SilentlyContinue).Id } |
    Select-Object LocalAddress, RemoteAddress, RemotePort, @{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
    Sort-Object RemoteAddress -Unique | Format-Table -AutoSize

$Report | Format-Table -AutoSize
Write-Host "Triage complete. Escalate to IR if shadow copies are missing, unexpected services exist, or rclone/psexec artifacts are found." -ForegroundColor Yellow