INCRANSOM Ransomware Gang: 11 New Victims in 5 Days — Manufacturing & Healthcare Surge, Detection Rules Inside

Classification: TLP:AMBER — Enterprise Defensive Intelligence Date: 2026-09-04 Source: Dark web leak site monitoring via ransomware.live, CISA KEV correlation Confidence: High (primary-source leak site data)

Executive Summary

INCRANSOM has published 11 new victims to its dark web leak site in the last five days (2026-08-31 through 2026-09-03), spanning 8 countries and 7 sectors. The cluster of simultaneous postings on 2026-09-01 (seven victims in a single day) indicates a batch-detonation or batch-publication pattern consistent with affiliates staging intrusions over weeks and releasing victim names in waves when negotiations stall. Manufacturing (4 victims) and the broader industrial/construction sector dominate this wave, with notable single strikes against healthcare (Italy), a financial services firm (Malaysia), a US public school district, and a UK technology firm. Organizations operating VPN gateways, remote access tooling (ScreenConnect), and Microsoft Exchange should treat this briefing as an immediate patch-and-hunt trigger: three of the five correlated CISA KEV entries map directly to those exposure classes.

1. Threat Actor Profile — INCRANSOM

Analyst note: The RaaS structure means TTP variance between intrusions is real — affiliate skill levels differ. However, the leak site cadence and the consistent pre-encryption exfiltration pattern are operator-controlled constants and are the highest-value detection anchors.

2. Current Campaign Analysis

2.1 Sector Targeting (last 11 postings)

Manufacturing remains the highest-value vertical for INCRANSOM — a deliberate choice: industrial firms carry extreme operational-downtime sensitivity, frequently run legacy OT-adjacent IT estates, and historically pay to restore production lines. The Policlinico Triestino hit follows the gang's established willingness to target European healthcare, and the school district posting continues the pattern of striking under-defended US public-sector networks at the start of the academic year.

2.2 Geographic Concentration

Malaysia (2), United States (3), and a distributed European/Latin American footprint (IT, ES, GB, PA, MX, CA). This is an opportunistic global campaign, not regionally focused — consistent with IAB-purchased access where victim geography is whatever the broker sold. The two Malaysian postings in three days (myglobal.com, cimbsecurities.com) warrant elevated monitoring for ASEAN-region organizations; a shared regional access broker is plausible.

2.3 Victim Profile

The victim list skews SMB-to-mid-market: regional manufacturers, a private clinic, a school district, a securities brokerage subsidiary. Estimated revenue range $10M–$500M. These are organizations large enough to pay, small enough to lack 24/7 SOC coverage — the classic INCRANSOM sweet spot. Enterprise-scale targets with mature MDR are underrepresented, which tells us the affiliates are triaging toward softer perimeters.

2.4 Posting Frequency / Escalation Pattern

• 2026-08-31: 3 victims
• 2026-09-01: 7 victims (single-day spike)
• 2026-09-03: 1 victim

The Sept 1 batch is characteristic of a negotiation-deadline dump: victims were likely compromised weeks apart but published simultaneously when ransom talks expired. Expect a second wave within 7–10 days as the next negotiation cohort matures. Tempo is elevated versus the group's typical baseline.

2.5 CVE Correlation — Probable Initial Access Vectors

Action: If you run Check Point gateways, ScreenConnect, or on-prem Exchange, assume the corresponding CVE is being actively scanned and exploited by INC affiliates now. Patch or mitigate before the weekend change freeze.

3. Detection Engineering

The rules below target INC's observed kill chain: perimeter/RMM initial access → lateral movement via PsExec/WMI → pre-encryption staging (archive creation, shadow copy deletion, exfil tooling).

---
title: INCRANSOM - PsExec Service Installation for Lateral Movement
id: 4a7c2e10-8f3b-4e1d-9a2c-1b5d6e7f8a01
status: production
description: Detects PsExec-style remote service installation used by INC Ransom affiliates for lateral movement and mass encryptor deployment
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/04
logsource:
  category: service_installation
  product: windows
detection:
  selection_service:
    ServiceName:
      - PSEXESVC
      - '*psexec*'
      - PAExec*
  selection_path:
    ImagePath|contains:
      - '\PSEXESVC'
      - '\\ADMIN$\\'
  condition: selection_service or selection_path
falsepositives:
  - Legitimate admin tooling - baseline authorized PsExec use per host
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
---
title: INCRANSOM - Volume Shadow Copy Deletion Prior to Encryption
id: 5b8d3f21-9a4c-5f2e-8b3d-2c6e7f8a9b02
status: production
description: Detects shadow copy deletion via vssadmin, wmic, bcdedit or PowerShell - universal pre-encryption behavior in INC Ransom intrusions
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - 'Get-CimInstance Win32_ShadowCopy'
  condition: 1 of selection_*
falsepositives:
  - Backup software maintenance windows - correlate with change tickets
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: INCRANSOM - Rclone or Archive Tool Data Staging for Exfiltration
id: 6c9e4a32-1b5d-6a3f-9c4e-3d7f8a9b0c03
status: production
description: Detects Rclone execution and mass-archive creation (rar/7z) on servers - INC affiliates stage stolen data before leak-site publication
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    - Image|endswith: '\rclone.exe'
    - CommandLine|contains:
        - 'rclone'
        - ' copy '
        - ' sync '
        - 'mega'
        - ':dropbox'
        - 'sftp'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
      - '-m'
  filter_users:
    CommandLine|contains: '\\BackupExec\\'
  condition: (selection_rclone or selection_archive) and not filter_users
falsepositives:
  - Legitimate backup/archive jobs - whitelist known backup service accounts
level: high
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.collection
  - attack.t1560

// INCRANSOM Hunt: Lateral movement + pre-encryption staging chain (Microsoft Sentinel)
// Looks for: remote service creation -> archive tooling -> shadow copy deletion within 6h window on same host
let window = 6h;
let RemoteService = SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec") or ServiceFileName has_any ("ADMIN$", "PSEXESVC")
    | summarize ServiceInstallTime = min(TimeGenerated) by Computer, Account;
let Staging = SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 4688
    | where Process has_any ("rar.exe", "7z.exe", "7za.exe", "rclone.exe", "winscp.exe", "filezilla.exe")
       or (Process has "vssadmin.exe" and CommandLine has "delete shadows")
       or (Process has "wmic.exe" and CommandLine has "shadowcopy delete")
    | summarize StagingTime = min(TimeGenerated), Tools = make_set(Process), Cmds = make_set(CommandLine, 5) by Computer, Account;
RemoteService
| join kind=inner Staging on Computer
| where StagingTime between (ServiceInstallTime .. ServiceInstallTime + window)
| extend HoursBetween = datetime_diff("hour", StagingTime, ServiceInstallTime)
| project Computer, Account, ServiceInstallTime, StagingTime, HoursBetween, Tools, Cmds
| order by ServiceInstallTime desc;

# INCRANSOM Rapid-Response Triage Script - run on suspect hosts or domain-wide via GPO/SCCM
# Checks: shadow copy tampering, new scheduled tasks (7d), suspicious persistence services, exposed RDP
# Usage: .	riage.ps1 | Tee-Object -FilePath "C:\IR\triage_$(hostname)_$(Get-Date -f yyyyMMdd_HHmm).txt"

Write-Host "=== [1] Volume Shadow Copies ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "[ALERT] NO shadow copies present - possible vssadmin deletion (T1490)" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host "`n=== [2] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    try { $taskXml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop
          $xml = [xml]$taskXml
          $created = [datetime]$xml.Task.RegistrationInfo.Date
          if ($created -gt $cutoff) {
              Write-Host "[ALERT] New task: $($_.TaskPath)$($_.TaskName) created $created" -ForegroundColor Red
              $xml.Task.Actions.Exec | ForEach-Object { Write-Host "        Exec: $($_.Command) $($_.Arguments)" }
          }
    } catch {}
}

Write-Host "`n=== [3] Suspicious Services (PsExec/RMM/Random Names) ===" -ForegroundColor Cyan
$susPatterns = 'PSEXESVC|PAExec|rclone|AnyDesk|ScreenConnect|TeamViewer|^[a-z0-9]{8}$'
Get-CimInstance Win32_Service | Where-Object { $_.Name -match $susPatterns -or $_.PathName -match 'ADMIN\$|AppData\\Local\\Temp' } |
    Select-Object Name, DisplayName, State, StartMode, PathName | Format-List

Write-Host "`n=== [4] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
Write-Host "RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - verify firewall restrictions'}else{'No'})"
Write-Host "NLA Enabled: $(if($nla.UserAuthentication -eq 1){'Yes'}else{'[ALERT] NO - enable NLA immediately'})"

Write-Host "`n=== [5] Recent 4688-style Process Artifacts (rclone/rar/vssadmin in event log) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'rclone|rar\.exe|7z\.exe|vssadmin.*delete|wmic.*shadowcopy|bcdedit.*recoveryenabled' } |
    Select-Object -First 25 TimeCreated, @{N='Detail';E={($_.Message -split "`n")[10..12] -join ' '}} | Format-List

Write-Host "`n=== Triage complete. Escalate any [ALERT] findings to IR immediately. ===" -ForegroundColor Cyan

4. Incident Response Priorities — INCRANSOM Playbook

4.1 T-Minus Detection Checklist (before encryption fires)

You typically have 24–72 hours between exfiltration start and detonation. Hunt these in order:

1. Rclone/MEGA/SFTP egress — large sustained outbound transfers from file servers or domain controllers to consumer cloud or unknown IPs, especially outside business hours
2. Archive bombs — multi-GB .rar/.7z files appearing in staging directories (C:\ProgramData, user profiles, \\ADMIN$ shares)
3. RMM tool drift — ScreenConnect, AnyDesk, or TeamViewer binaries on hosts that never had them; new unattended-access sessions
4. PsExec sweeps — PSEXESVC service appearing on multiple hosts within minutes (mass-encryptor deployment rehearsal)
5. VSS deletion on a test host — affiliates often validate vssadmin delete shadows on one machine before the fleet-wide push
6. Backup service stoppage — Veeam/Commvault/Windows Backup services disabled or their consoles accessed from unusual accounts
7. New privileged accounts / GPO changes — accounts added to Domain Admins outside change control; GPOs referencing scripts in SYSVOL

4.2 Assets This Gang Prioritizes for Exfiltration

• File servers and NAS — engineering drawings, contracts, HR records (manufacturing victims: expect IP/theft-of-design leverage)
• Email stores — Exchange on-prem mailboxes (see CVE-2023-21529), executive mailboxes specifically
• Finance/ERP exports — payroll, banking details, M&A documents (drives ransom sizing)
• Healthcare/PII databases — patient records (Policlinico Triestino pattern), student records (school district pattern)
• Backup catalogs — to destroy recovery options and prove data access in negotiation

4.3 Containment Actions — Ordered by Urgency

1. Isolate, don't power off suspected staging hosts (memory holds Cobalt Strike configs and exfil creds); use network quarantine via EDR/NAC
2. Kill outbound exfil — block Rclone/MEGA/unknown SFTP at the proxy/firewall immediately; this is the single highest-leverage action while leak publication is still pending
3. Disable compromised RMM — revoke ScreenConnect/AnyDesk unattended sessions, rotate RMM API keys and agent passwords
4. Reset all privileged credentials tier-wide (assume Kerberos theft — krbtgt twice if domain compromise confirmed); revoke VPN concentrator sessions
5. Snapshot critical servers and verify offline backups before any remediation that could trigger scorched-earth detonation
6. Block PsExec fleet-wide (AppLocker/WDAC or firewall rule on admin shares) to break the mass-deployment mechanism
7. Preserve leak-site evidence — capture the INC leak posting, timestamps and sample files for legal/insurance; engage external IR if negotiation capability is needed

5. Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate CVE-2026-50751 (Check Point Gateway IKEv1) — this is the most probable perimeter vector in the current wave; if patching isn't possible today, disable IKEv1-aggressive-mode VPNs and restrict gateway management interfaces
• Patch/upgrade ConnectWise ScreenConnect (CVE-2024-1708) and audit for rogue unattended clients; better: enforce conditional access so RMM only runs from managed devices
• Patch Exchange (CVE-2023-21529) or move internet-facing Exchange behind a WAF with deserialization inspection
• Block Rclone, MEGA, and non-business SFTP at egress; alert on any rar.exe/7z.exe execution on servers (deploy the Sigma rules above)
• Enable NLA on all RDP, restrict RDP to VPN-only, and alert on brute-force patterns (>10 failed 4625s per source per 5 min)
• Verify Volume Shadow Copies exist on critical servers and enable Tamper Protection on EDR agents
• Enforce phishing-resistant MFA on all remote access — INC affiliates routinely replay phished creds against VPNs without MFA

Short-Term (2 Weeks)

• Segment OT/production networks from IT — the manufacturing victims were almost certainly flat networks where one phished workstation reached the line controllers; implement Purdue-model segmentation with deny-by-default inter-zone rules
• Deploy application allowlisting (WDAC/AppLocker) on servers to kill PsExec-class lateral movement and unauthorized archive/exfil tooling by policy
• Implement Tier-0 admin model — separate DA workstations/accounts, no DA logon to member servers; INC's mass-encryption phase depends on stolen tier-0 creds
• Deploy decoy canary files and honey credentials on file servers — exfiltration touching canaries gives you a pre-encryption tripwire
• Immutable/offline backups with tested restore runbooks — assume VSS and online backups will be targeted; quarterly restore drills, not annual
• EGress data-loss monitoring — baseline normal outbound volume per server; alert at 3σ deviations (exfil is noisy, catching it early is your cheapest win)
• Tabletop an INC-specific scenario: leak-site publication with patient/student/financial data — legal, comms and negotiation decisions made before the crisis are 10x better than ones made during it

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

This briefing is based on live monitoring of ransomware leak sites and CISA KEV data as of 2026-09-04. Victim postings reflect criminal claims and may include unverified or disputed incidents. Security Arsenal customers receive real-time alerting on new INCRANSOM postings via AlertMonitor.