INCRANSOM Ransomware Gang: 4 New Listings on Dark Web Leak Site — Sector Targeting Analysis & Detection Engineering

Classification: TLP:CLEAR | Publication Date: 2026-11-14 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-11-10 and 2026-11-13, the INCRANSOM ransomware group listed four organizations on its dark web leak site, spanning Professional Services, Retail & E-Commerce, Manufacturing, and Transportation sectors across the United States and India. All four listings currently appear on a single monitoring source only — no second independent crawler has corroborated that these postings exist on the gang's infrastructure.

INCRANSOM claims to have compromised the following organizations:

These are unverified claims by a criminal threat actor. Inclusion on a leak site does not confirm a breach occurred. However, the sector spread and geographic distribution of these claimed listings are consistent with INCRANSOM's historical targeting patterns, and security teams in these verticals should treat this as an actionable signal to review exposure, validate detection coverage, and verify that the controls outlined in this briefing are in place.

Sourcing & Verification

This briefing is based on automated monitoring of ransomware gang leak sites via ransomware.live.

Corroboration status: 0 of 4 listings were independently observed by a second leak-site crawler. All 4 listings appear on a single source only. This means we have lower confidence that these postings currently exist on INCRANSOM's infrastructure as described.

What inclusion means: Every organization named in this briefing appears because INCRANSOM — a criminal threat actor — has listed them on its leak site. This reflects the threat actor's claim and is not confirmation that a breach occurred. No tier in our monitoring data confirms a breach. Only the named organization or its regulator can confirm whether an incident took place.

Disputes and denials: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction, and not every incident is reportable. Neither silence nor denial settles the question.

Corrections: Security Arsenal will publish corrections to this briefing if new information becomes available. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — INCRANSOM

Overview

INCRANSOM (also tracked as INC Ransom) is a ransomware operation that emerged in mid-2023 and has maintained consistent activity through 2026. The group operates a dedicated leak site on the Tor network where it names organizations it claims to have compromised and threatens to publish stolen data unless ransom demands are met.

Aliases

• INC Ransom
• INCRANSOM

Operational Model

INCRANSOM operates as a Ransomware-as-a-Service (RaaS) platform. The core group develops and maintains the ransomware payload, negotiation infrastructure, and leak site, while affiliates conduct initial access, lateral movement, data exfiltration, and payload deployment. This model allows the operation to scale across multiple simultaneous intrusions with varying affiliate skill levels.

Ransom Demands

Observed ransom demands attributed to INCRANSOM have historically ranged from $100,000 to over $1 million USD, scaled to the perceived revenue and cyber-insurance posture of the targeted organization. The group negotiates via a Tor-based chat portal and has been observed issuing deadlines of 5–10 days before publishing claimed exfiltrated data.

Initial Access Methods

INCRANSOM affiliates have been observed gaining initial access through multiple vectors:

• Spear-phishing with malicious attachments (Office documents containing macros or embedded links to payload delivery infrastructure)
• Exploitation of internet-facing services, particularly unpatched VPN concentrators, remote desktop gateways, and virtual infrastructure management interfaces
• Compromised credentials purchased from initial access brokers (IABs) or obtained via credential-stuffing against exposed RDP and VPN endpoints
• Supply chain / managed service provider (MSP) compromise to gain downstream access to multiple victim environments

Double Extortion

INCRANSOM employs a double extortion model: affiliates exfiltrate sensitive data before deploying the ransomware payload. If the victim refuses to pay, the group publishes the stolen data on its leak site in staged releases to increase pressure. Some victims have reported threats of a third extortion layer — direct contact with clients, partners, or regulators.

Dwell Time

Based on incident response engagements and open-source reporting, INCRANSOM affiliates exhibit an average dwell time of 5–14 days between initial access and ransomware detonation. During this window, operators conduct reconnaissance, escalate privileges, move laterally, stage exfiltration tooling, and harvest data from file servers, databases, and email systems.

Current Campaign Analysis

Sector Targeting

The four claimed listings span four distinct sectors:

• Professional Services (Advantage Archives): Firms in this sector typically hold large volumes of client data — documents, records, intellectual property — making them high-value extortion targets. INCRANSOM has historically favored professional services organizations because the reputational damage from data exposure creates strong payment pressure.
• Retail & E-Commerce (sportsmansguide.com): Retail organizations process payment card data and maintain large customer databases. INCRANSOM has previously targeted e-commerce platforms where operational disruption during peak shopping periods increases leverage.
• Manufacturing (axiscades.com): Manufacturing entities are attractive because of their low tolerance for operational downtime. Production-line disruption translates directly to revenue loss, and many manufacturing firms run legacy systems with limited security monitoring.
• Transportation (CIMSA LOGISTICS): Logistics and transportation companies operate time-sensitive supply chains. Disruption cascades to downstream clients, creating multi-party pressure on the victim to resolve quickly.

This multi-sector spread is consistent with INCRANSOM's opportunistic affiliate model — the group does not appear to run tightly scoped vertical campaigns but rather monetizes access wherever affiliates can obtain it.

Geographic Concentration

Three of the four claimed listings are US-based organizations, with one in India. This aligns with INCRANSOM's historical geographic distribution, which has skewed heavily toward North America and, to a lesser extent, South and Southeast Asia. The group has largely avoided listing organizations in CIS countries, consistent with the operational norms of many Russian-speaking ransomware ecosystems.

Victim Profile

Based on the sectors represented, the claimed victim pool likely ranges from small-to-midsize businesses (SMBs) to mid-market enterprises with estimated annual revenues between $10 million and $500 million. This is INCRANSOM's typical sweet spot — organizations large enough to pay meaningful ransoms but often lacking dedicated security operations centers or mature incident response capabilities.

Posting Frequency and Escalation

Four listings over a four-day window (2026-11-10 through 2026-11-13) represents a moderate but not unusual posting cadence for INCRANSOM. The group has historically posted in bursts, often listing multiple victims within a short period after completing negotiations (or after negotiation deadlines expire). Security teams should monitor for additional listings in the coming days, as INCRANSOM frequently batches publications.

Potential Initial Access Vectors — Sector-Level CVE Exposure

The following CVEs are currently listed in the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use. We have no evidence linking any specific CVE to any specific named listing in this briefing. However, these vulnerabilities represent exposure categories that INCRANSOM affiliates are known to target for initial access, and organizations in the affected sectors should verify patching status immediately:

• CVE-2026-59310 — Broadcom VMware vCenter Path Traversal. vCenter is a high-value target because compromise provides visibility and access to the entire virtualized infrastructure. INCRANSOM affiliates have historically targeted hypervisor management planes to deploy ransomware at scale.
• CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data. TeamCity servers are build automation infrastructure; compromise can provide access to source code repositories, build artifacts, and deployment pipelines — effectively a supply chain foothold.
• CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-coded Password. FMC manages firewall policy across an organization; hard-coded credentials provide a direct path to network device management.
• CVE-2026-50751 — Check Point Security Gateway Improper Authentication. Exploitation of VPN gateway authentication bypasses provides direct network-level initial access — a vector consistent with INCRANSOM's known exploitation of remote access infrastructure.
• CVE-2026-48027 — Nx Console Embedded Malicious Code. A supply chain compromise through a malicious package version — developers with the compromised extension installed would have provided an initial foothold into build and development environments.

Analyst note: The presence of multiple VPN/remote-access and infrastructure-management CVEs in the current KEV catalog is particularly relevant given INCRANSOM's documented preference for exploiting perimeter services as an initial access vector. Organizations running any of the affected products should treat these as priority patching targets regardless of whether they appear in INCRANSOM's claimed victim list.

Detection Engineering

The following detection content targets TTPs consistent with INCRANSOM's known operational playbook: perimeter exploitation, credential-based lateral movement, data staging, and pre-encryption preparation.

---
title: INCRANSOM - VPN/RDP Brute Force Followed by Successful Authentication
id: 8a3f2c1e-4b5d-4e7a-9c1d-2f3a4b5c6d7e
status: experimental
description: Detects a burst of failed authentication attempts against VPN or RDP services followed by a successful login from the same source IP — consistent with INCRANSOM affiliate credential-based initial access via perimeter services.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/14
logsource:
  category: authentication
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed | count() by SourceIp > 10
  timeframe: 15m
  correlation:
    - selection_failed
    - selection_success
fields:
  - SourceIp
  - TargetUserName
  - WorkstationName
  - LogonType
falsepositives:
  - Legitimate password spray from misconfigured service accounts
  - Vulnerability scanners performing authentication testing
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
  - attack.t1078
---
title: INCRANSOM - PsExec or WMI Remote Execution for Lateral Movement
id: 9b4e3d2f-5c6e-4f8b-0d2e-3f4a5b6c7d8e
status: experimental
description: Detects execution of PsExec-like service installation or WMI-based remote process creation, consistent with INCRANSOM affiliate lateral movement techniques using legitimate administration tools.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/14
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PsExec.exe'
      - '\PsExec64.exe'
      - '\psexesvc.exe'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  selection_suspicious_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\'
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  condition: selection_psexec or selection_wmi_remote or selection_suspicious_service
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
  - ComputerName
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ Deploy)
  - IT support using PsExec for remote management
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: INCRANSOM - Data Staging and Shadow Copy Deletion Pre-Encryption
id: 0c5f4e3a-6d7f-4a9c-1e3f-4a5b6c7d8e9f
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic combined with mass file compression or staging to anomalous directories — consistent with INCRANSOM pre-encryption preparation and data exfiltration staging.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/14
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss_delete:
    - CommandLine|contains|all:
        - 'vssadmin'
        - 'delete'
        - 'shadows'
    - CommandLine|contains|all:
        - 'wmic'
        - 'shadowcopy'
        - 'delete'
    - CommandLine|contains|all:
        - 'bcdedit'
        - 'recoveryenabled'
        - 'no'
  selection_compression_staging:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.7z'
      - '.rar'
      - '.zip'
  selection_cloud_sync:
    Image|endswith:
      - '\rclone.exe'
      - '\rclonex64.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--config'
      - 'mega'
      - 'dropbox'
      - 'gdrive'
      - 's3'
  condition: selection_vss_delete or selection_compression_staging or selection_cloud_sync
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - ComputerName
falsepositives:
  - Legitimate backup maintenance scripts
  - IT administrators archiving project files
  - Legitimate cloud sync tooling
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1567.002

The following KQL query for Microsoft Sentinel hunts for lateral movement indicators and pre-ransomware staging activity consistent with INCRANSOM's known toolset — specifically targeting WMI/PsExec execution chains, shadow copy manipulation, and anomalous data compression activity across endpoints.

// INCRANSOM Lateral Movement & Pre-Encryption Staging Hunt
// Looks for: WMI/PsExec remote execution, shadow copy deletion, 
// mass compression utilities, and anomalous outbound data transfer patterns
// Recommended lookback: 7 days

let Lookback = 7d;

// Part 1: PsExec / WMI remote execution chains
let LateralMovement =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (
        // PsExec-style service binary
        (FileName =~ "PSEXESVC.exe" or FileName =~ "PsExec.exe" or FileName =~ "PsExec64.exe")
        or
        // WMI spawning suspicious child processes (remote execution pattern)
        (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "wscript.exe", "cscript.exe"))
    )
    | project LateralTime = Timestamp, DeviceName, LateralAccount = AccountName, 
              LateralProcess = FileName, LateralCmdLine = ProcessCommandLine,
              LateralParent = InitiatingProcessFileName, LateralParentCmd = InitiatingProcessCommandLine;

// Part 2: Shadow copy deletion / backup tampering
let ShadowCopyTampering =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (
        (ProcessCommandLine has_all ("vssadmin", "delete", "shadows"))
        or (ProcessCommandLine has_all ("wmic", "shadowcopy", "delete"))
        or (ProcessCommandLine has_all ("bcdedit", "recoveryenabled", "no"))
        or (ProcessCommandLine has_all ("wbadmin", "delete", "catalog"))
    )
    | project ShadowTime = Timestamp, DeviceName, ShadowAccount = AccountName,
              ShadowProcess = FileName, ShadowCmdLine = ProcessCommandLine;

// Part 3: Mass compression / archive staging
let CompressionStaging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" a ", " -p", ".7z", ".rar", ".zip")
    | project CompressTime = Timestamp, DeviceName, CompressAccount = AccountName,
              CompressProcess = FileName, CompressCmdLine = ProcessCommandLine;

// Part 4: Rclone / cloud exfil tooling
let CloudExfil =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName has_any ("rclone", "rclonex64")
       or (ProcessCommandLine has_any ("rclone", "mega://", "--transfers"))
    | project ExfilTime = Timestamp, DeviceName, ExfilAccount = AccountName,
              ExfilProcess = FileName, ExfilCmdLine = ProcessCommandLine;

// Correlate: find devices with 2+ indicator categories
let AllIndicators =
    union
        (LateralMovement | project DeviceName, IndicatorType = "LateralMovement", IndicatorTime = LateralTime, Detail = LateralCmdLine),
        (ShadowCopyTampering | project DeviceName, IndicatorType = "ShadowCopyDeletion", IndicatorTime = ShadowTime, Detail = ShadowCmdLine),
        (CompressionStaging | project DeviceName, IndicatorType = "CompressionStaging", IndicatorTime = CompressTime, Detail = CompressCmdLine),
        (CloudExfil | project DeviceName, IndicatorType = "CloudExfil", IndicatorTime = ExfilTime, Detail = ExfilCmdLine);

AllIndicators
| summarize IndicatorCount = dcount(IndicatorType), 
            Indicators = make_set(IndicatorType), 
            FirstSeen = min(IndicatorTime), 
            LastSeen = max(IndicatorTime),
            Details = make_list(Detail)
    by DeviceName
| where IndicatorCount >= 2
| sort by IndicatorCount desc, LastSeen desc

The following PowerShell script performs a rapid triage sweep on a Windows endpoint or server to identify indicators consistent with INCRANSOM pre-encryption activity — recently created scheduled tasks, shadow copy status, exposed RDP configuration, and recently modified files in common staging directories.

<#
.SYNOPSIS
    INCRANSOM Rapid Triage Script — Security Arsenal Threat Intelligence
.DESCRIPTION
    Performs a rapid endpoint sweep for indicators associated with INCRANSOM
    pre-ransomware staging: recently created scheduled tasks, Volume Shadow Copy
    status, RDP exposure, suspicious processes, and files in common staging paths.
.NOTES
    Run as Administrator for full coverage.
    Classification: TLP:CLEAR
    Date: 2026-11-14
#>

$ReportPath = "$env:TEMP\INCRANSOM_Triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$Output = @()

function Write-Section($Title) {
    $Output += "`n=========================================="
    $Output += " $Title"
    $Output += "=========================================="
}

Write-Section "INCRANSOM RAPID TRIAGE — $(Get-Date)"
$Output += "Hostname: $env:COMPUTERNAME"
$Output += "User: $env:USERNAME"

# 1. Scheduled Tasks created in the last 7 days
Write-Section "SCHEDULED TASKS CREATED IN LAST 7 DAYS"
try {
    $RecentTasks = Get-ScheduledTask | Where-Object {
        $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)
    } | Select-Object TaskName, TaskPath, Date, State, @{N='Actions';E={($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '}}
    if ($RecentTasks) {
        $Output += "[ALERT] Found $($RecentTasks.Count) scheduled task(s) created in the last 7 days:"
        $RecentTasks | Format-List | Out-String | ForEach-Object { $Output += $_ }
    } else {
        $Output += "[OK] No scheduled tasks created in the last 7 days."
    }
} catch {
    $Output += "[ERROR] Could not enumerate scheduled tasks: $_"
}

# 2. Volume Shadow Copy status
Write-Section "VOLUME SHADOW COPY STATUS"
try {
    $Shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
    if ($Shadows) {
        $Output += "[INFO] $($Shadows.Count) shadow copy/copies exist."
        $Shadows | ForEach-Object {
            $Output += "  - ID: $($_.ID) | Volume: $($_.VolumeName) | Created: $($_.InstallDate)"
        }
    } else {
        $Output += "[ALERT] NO Volume Shadow Copies found. This may indicate deletion by ransomware operators."
        $Output += "  Verify with: vssadmin list shadows"
    }
} catch {
    $Output += "[WARN] Could not enumerate shadow copies: $_"
}

# 3. RDP Configuration
Write-Section "RDP EXPOSURE CHECK"
try {
    $RDPReg = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
    if ($RDPReg.fDenyTSConnections -eq 0) {
        $Output += "[ALERT] RDP is ENABLED on this system."
        # Check if RDP is listening on non-standard port
        $RDPPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
        $Output += "  RDP Port: $RDPPort"
        if ($RDPPort -eq 3389) {
            $Output += "  [WARN] RDP is on default port 3389 — high brute-force exposure."
        }
        # Check NLA
        $NLA = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
        if ($NLA -eq 0) {
            $Output += "  [CRITICAL] Network Level Authentication (NLA) is DISABLED."
        } else {
            $Output += "  [OK] NLA is enabled."
        }
    } else {
        $Output += "[OK] RDP is disabled."
    }
} catch {
    $Output += "[ERROR] Could not check RDP configuration: $_"
}

# 4. Suspicious running processes
Write-Section "SUSPICIOUS RUNNING PROCESSES"
$SuspiciousProcs = @('rclone','7z','7za','rar','winrar','psexec','psexesvc','nc','ncat','netcat','megasync','filezilla','winscp')
$RunningSuspicious = Get-Process | Where-Object { $SuspiciousProcs -contains $_.ProcessName.ToLower() }
if ($RunningSuspicious) {
    $Output += "[ALERT] Suspicious processes detected:"
    $RunningSuspicious | ForEach-Object {
        $Output += "  - $($_.ProcessName) (PID: $($_.Id)) | Path: $($_.Path)"
    }
} else {
    $Output += "[OK] No known staging/exfiltration processes running."
}

# 5. Recently modified files in common staging locations
Write-Section "RECENTLY MODIFIED FILES IN COMMON STAGING PATHS (Last 72h)"
$StagingPaths = @("$env:TEMP", "$env:PUBLIC", "C:\ProgramData", "$env:APPDATA")
foreach ($Path in $StagingPaths) {
    if (Test-Path $Path) {
        $RecentFiles = Get-ChildItem -Path $Path -Recurse -Depth 2 -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-72) -and $_.Length -gt 100MB } |
            Sort-Object LastWriteTime -Descending |
            Select-Object -First 10
        if ($RecentFiles) {
            $Output += "[ALERT] Large files modified in last 72h under $Path`:"
            $RecentFiles | ForEach-Object {
                $Output += "  - $($_.FullName) | Size: $([math]::Round($_.Length/1MB,2)) MB | Modified: $($_.LastWriteTime)"
            }
        }
    }
}

# 6. Recent successful remote logons (Type 3 or 10) from non-local subnets
Write-Section "RECENT REMOTE LOGONS (Last 72h — Network/RemoteInteractive)"
try {
    $RemoteLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-72)} -MaxEvents 500 -ErrorAction SilentlyContinue |
        Where-Object {
            $xml = [xml]$_.ToXml()
            $lt = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'LogonType'}).'#text'
            $ip = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
            ($lt -in @('3','10')) -and ($ip -ne '-') -and ($ip -ne '127.0.0.1') -and ($ip -ne '::1')
        } | Select-Object -First 20
    if ($RemoteLogons) {
        $Output += "[INFO] $($RemoteLogons.Count) remote logon event(s) in last 72h. Review for anomalous source IPs."
        $RemoteLogons | ForEach-Object {
            $xml = [xml]$_.ToXml()
            $user = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
            $ip = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'}).'#text'
            $Output += "  - $($_.TimeCreated) | User: $user | Source: $ip"
        }
    } else {
        $Output += "[OK] No remote logons detected in last 72h."
    }
} catch {
    $Output += "[WARN] Could not query logon events: $_"
}

# Write report
$Output | Out-File -FilePath $ReportPath -Encoding UTF8
Write-Host "`nTriage complete. Report saved to: $ReportPath" -ForegroundColor Cyan
$Output | ForEach-Object { Write-Host $_ }

Incident Response Priorities

INCRANSOM follows a recognizable pre-detonation playbook. The following priorities are ordered to maximize the probability of detecting and disrupting an intrusion before encryption fires.

T-Minus Detection Checklist — What to Look for BEFORE Encryption

Critical Assets INCRANSOM Prioritizes for Exfiltration

Based on observed leak site publications and incident response reporting, INCRANSOM affiliates prioritize the following data categories:

1. Client/customer databases — PII, financial records, contact lists
2. Financial documents — tax filings, banking records, invoices, payroll data
3. Legal documents — contracts, NDAs, litigation files, IP-related documents
4. Email archives — executive communications, negotiation-sensitive correspondence
5. Engineering/technical documents — schematics, source code, product designs (particularly relevant to the Manufacturing sector listing)
6. HR records — employee PII, background checks, medical information

Containment Actions — Ordered by Urgency

1. Isolate affected network segments immediately. Do NOT power off systems — volatile memory may contain forensic evidence. Use EDR network isolation or switch-level VLAN quarantine.
2. Disable all compromised or suspicious accounts — especially any accounts showing anomalous remote logon patterns or newly created admin accounts.
3. Block egress traffic to known cloud storage and file-sharing services not in your approved software catalog (Mega, Dropbox, personal Google Drive, anonymous S3 buckets).
4. Preserve forensic evidence — capture memory images and disk snapshots from affected systems before any remediation.
5. Reset credentials for all accounts that have authenticated to affected systems — assume Kerberos tickets and cached credentials are compromised.
6. Verify backup integrity — confirm that backup infrastructure is isolated and that recent backup jobs completed successfully before the suspected intrusion window.
7. Engage incident response — internal IR team or external retainer. If you suspect active INCRANSOM presence, time-to-containment directly determines whether encryption fires.

Hardening Recommendations

Immediate (24 Hours)

These controls address the most commonly exploited initial access vectors and pre-encryption behaviors observed in INCRANSOM campaigns:

1. Patch internet-facing infrastructure — verify that VPN concentrators, firewall management interfaces, and remote access gateways are patched against the CVEs listed above (CVE-2026-50751 for Check Point gateways, CVE-2026-20316 for Cisco FMC, CVE-2026-59310 for VMware vCenter if it is network-accessible).
2. Enforce MFA on all remote access — VPN, RDP, webmail, and any cloud service portal. INCRANSOM affiliates routinely exploit credential-only access paths. MFA on VPN alone would have blocked a significant percentage of historical intrusions attributed to this group.
3. Disable RDP from the internet — if RDP must be accessible, restrict it to specific source IP ranges via firewall rule and enforce Network Level Authentication (NLA).
4. Block or alert on vssadmin/wmic shadow copy deletion — deploy the Sigma rules provided above. At minimum, create an alert for any execution of vssadmin delete shadows or wmic shadowcopy delete across all Windows endpoints.
5. Audit for unauthorized compression and exfiltration tools — search endpoints for rclone, 7-Zip (if not standard), WinRAR, and similar utilities. Alert on execution from non-standard paths.
6. Review scheduled tasks — audit all scheduled tasks created in the last 14 days for unauthorized persistence mechanisms.

Short-Term (2 Weeks)

1. Deploy network segmentation between user workstations, server infrastructure, and backup systems. INCRANSOM's ransomware deployment relies on lateral movement — flat networks allow a single compromised endpoint to become an enterprise-wide encryption event.
2. Implement application allowlisting on servers — prevent execution of unauthorized binaries (rclone, PsExec, 7z) on systems where they are not operationally required.
3. Enable tamper protection on EDR/AV agents and verify that shadow copies and backup catalogs cannot be deleted by standard or even local admin accounts without additional authorization.
4. Establish a baseline of normal administrative tooling — document which systems legitimately use PsExec, WMI remote execution, and compression utilities. Alert on any deviation.
5. Review and restrict service accounts — ensure service accounts do not have interactive logon rights, cannot authenticate from unexpected sources, and use managed service accounts (gMSA) where possible.
6. Test backup restoration — not just backup completion, but full restoration of critical systems within your RTO. INCRANSOM targets backup infrastructure during intrusions; an untested backup is not a recovery plan.
7. Deploy honeypot credentials and canary files — place decoy credentials in LSASS memory paths and canary files in file shares that trigger alerts on access. INCRANSOM affiliates conduct broad reconnaissance; canary trips provide early warning.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub