INCRANSOM Ransomware Gang: 4 New Victims Posted — Hospitality, Education, Retail and Manufacturing Alert

Bulletin type: Dark web leak-site monitoring and defensive intelligence
Observation window: 2026-09-17 to 2026-09-20
Source posture: ransomware.live aggregation of INCRANSOM .onion leak-site postings
Confidence: High for victim postings; moderate for CVE linkage until confirmed by victim telemetry

Threat Actor Profile — INCRANSOM

INCRANSOM, also tracked in community reporting as INC Ransom, operates as a ransomware-as-a-service ecosystem with affiliate-driven intrusion activity and a centralized leak-site/negotiation apparatus. The group is associated with double extortion: data theft first, encryption second, leak-site publication as pressure when payment stalls. Public reporting historically links this cluster to opportunistic initial access through exposed remote services, phishing with malicious attachments, compromised VPN/firewall appliances, abused RMM tooling, and valid accounts purchased or harvested from access brokers.

Typical behavior patterns to prioritize in detection:

• Model: RaaS with affiliates; varying operator skill and tooling between intrusions.
• Ransom posture: Frequently sector- and revenue-scaled demands; negotiation handled through TOR portals and leak-site deadlines.
• Initial access: Edge appliance exploitation, VPN concentrators, weak or reused credentials, RDP exposure, phishing macros, ScreenConnect/RMM abuse, and supply-chain/developer-tool tampering when opportunity aligns.
• Extortion: Data exfiltration before detonation; victim naming, countdown timers, sample data leaks and threatened resale/publication.
• Dwell time: Often days to a few weeks from access to impact; faster when edge exploitation provides immediate privileged foothold.
• Common operator tooling: PsExec/WMI/WinRM for lateral movement, Cobalt Strike or similar beacons, Rclone/MEGA/cloud sync tools, 7-Zip/WinRAR staging, vssadmin, bcdedit, wbadmin, service creation and scheduled tasks.

Current Campaign Analysis

Recent leak-site postings show four claimed victims in a compressed 48-hour window:

Sector targeting: Hospitality, education, retail/e-commerce and manufacturing. This mix suggests opportunistic access rather than a single vertical exploit chain, but the common thread is high operational disruption value: reservation systems, publishing workflows, POS/e-commerce availability, distributor logistics, and production/ERP dependencies.

Geography: US remains the largest concentration with two victims; NL and AR indicate broad affiliate reach across North America, Europe and Latin America. Multinational organizations should assume cross-border data handling and regulatory exposure even where the named entity is regional.

Victim profile: Mostly mid-market enterprises rather than global mega-brands. Estimated revenue bands are plausibly USD 10M-500M for education publishing, manufacturing and regional retail distribution, and USD 1M-100M for hospitality operators. These organizations often have lean security teams, flat legacy networks, externally exposed remote access and under-monitored backup infrastructure.

Posting cadence: Four posts across two days indicates an active publication pulse after intrusion completion or failed negotiations. Escalation pattern to watch: partial proof-of-leak, countdown, then bulk archive release. A burst often reflects affiliates clearing completed intrusions rather than brand-new access on the publication date.

CVE relevance: The listed KEV entries are plausible initial access or access-enablement paths rather than confirmed causes for these four victims. Prioritize edge exposure and management-plane controls:

• CVE-2026-59310 Broadcom VMware vCenter path traversal: virtualization management plane compromise can enable mass datastore access and rapid encryption.
• CVE-2026-20316 Cisco Secure FMC hard-coded password: management-plane credential weakness can expose firewall policy and VPN context.
• CVE-2026-50751 Check Point Security Gateway improper authentication in IKEv1: VPN edge compromise aligned to ransomware affiliate access patterns.
• CVE-2026-48027 Nx Console embedded malicious code: developer workstation supply-chain risk and credential theft.
• CVE-2024-1708 ConnectWise ScreenConnect path traversal/RCE: RMM abuse for interactive intrusion and deployment.

Detection Engineering

---
title: INCRANSOM - Edge Management Plane Exploit Followed By Admin Tool Execution
id: 9b1d0a5e-inc-0001
status: experimental
description: Detects suspicious process execution on VPN, firewall management, vCenter, RMM or jump hosts consistent with INCRANSOM affiliate initial access and hands-on-keyboard activity.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wmic.exe'
      - '\psexec.exe'
      - '\rclone.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\vssadmin.exe'
      - '\bcdedit.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  selection_cli:
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'delete shadows'
      - 'recoveryenabled no'
      - 'copy c:\'
      - 'mega.nz'
      - 'wmic /node:'
      - 'psexec \\'
      - 'Invoke-'
      - 'FromBase64String'
  filter_edge_mgmt:
    Computer|contains:
      - 'vc'
      - 'vcenter'
      - 'fmc'
      - 'fw'
      - 'vpn'
      - 'rdp'
      - 'jump'
      - 'mgmt'
  condition: selection_img and selection_cli and filter_edge_mgmt
falsepositives:
  - Legitimate administration on named management hosts
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
  - attack.t1490
---
title: INCRANSOM - Pre Encryption Staging With Archiving And Cloud Exfil Tooling
id: 9b1d0a5e-inc-0002
status: experimental
description: Detects compression, staging and exfiltration behaviors frequently observed before ransomware detonation and leak-site publication.
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_exfil:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\rsync.exe'
      - '\curl.exe'
      - '\wget.exe'
  selection_flags:
    CommandLine|contains:
      - ' a -p'
      - ' -mx'
      - 'copy --'
      - 'sync --'
      - '--transfers'
      - ':backup'
      - 'AppData\\Local\\Temp'
      - 'ProgramData'
  selection_paths:
    CommandLine|contains:
      - '\\Finance'
      - '\\HR'
      - '\\Payroll'
      - '\\ERP'
      - '\\POS'
      - '\\Reservations'
      - '\\Student'
      - '\\CAD'
      - '\\PLM'
  condition: 1 of selection_archive and 1 of selection_flags and selection_paths or selection_exfil and selection_flags
falsepositives:
  - Enterprise backup jobs and approved archive utilities
level: critical
tags:
  - attack.collection
  - attack.t1560
  - attack.exfiltration
  - attack.t1567
---
title: INCRANSOM - RDP Brute Force Or Valid Account Abuse Followed By Lateral Movement
id: 9b1d0a5e-inc-0003
status: experimental
description: Correlates remote logon anomalies with service creation, remote process launch and shadow copy tampering associated with ransomware affiliate intrusion chains.
logsource:
  category: process_creation
  product: windows
detection:
  selection_lateral:
    Image|endswith:
      - '\psexec.exe'
      - '\wmic.exe'
      - '\wmiprvse.exe'
      - '\sc.exe'
      - '\schtasks.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  selection_cmd:
    CommandLine|contains:
      - '\\ADMIN$'
      - '\\IPC$'
      - '/node:'
      - 'process call create'
      - 'create '
      - ' binpath='
      - 'start '
      - 'accepteula'
  selection_impact:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'wbadmin delete catalog'
      - 'bcdedit /set'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_lateral and selection_cmd or selection_impact
falsepositives:
  - Remote software deployment systems and approved admin scripting
level: high
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1047
  - attack.t1543
  - attack.impact

// INCRANSOM hunt: edge access to staging to impact in Microsoft Sentinel
let lookback = 14d;
let edge_hosts = dynamic(['vc','vcenter','fmc','fw','vpn','rdp','jump','mgmt']);
let suspicious = dynamic(['psexec.exe','wmic.exe','rclone.exe','7z.exe','winrar.exe','vssadmin.exe','bcdedit.exe','wbadmin.exe','schtasks.exe','sc.exe','rundll32.exe','regsvr32.exe','mshta.exe']);
let auth = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4624,4625,4776)
| extend LogonType = tostring(EventData.LogonType), TargetUser = tostring(EventData.TargetUserName), IpAddress = tostring(EventData.IpAddress)
| where LogonType in ('3','10') or EventID == 4625
| summarize Failed = countif(EventID == 4625), Success = countif(EventID == 4624), Users = dcount(TargetUser), SrcIPs = dcount(IpAddress) by Computer, bin(TimeGenerated, 15m)
| where Failed > 20 or (Success > 0 and SrcIPs > 3) or (Failed > 5 and Success > 0);
let proc = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ (suspicious) or ProcessCommandLine has_any ('shadowcopy delete','delete shadows','recoveryenabled no','wmic /node:','psexec \\','rclone copy','rclone sync',' a -p','--transfers','ProgramData','AppData\\Local\\Temp')
| project DeviceName, TimeGenerated, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let net = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any ('mega.nz','pastebin','transfer.sh') or RemoteIPType =~ 'Public'
| project DeviceName, TimeGenerated, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName;
let vms = proc
| join kind=leftouter net on DeviceName, $left.TimeGenerated between ($right.TimeGenerated - 15m .. $right.TimeGenerated + 15m)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Processes=make_set(FileName), Commands=make_set(ProcessCommandLine), Exfil=make_set(RemoteUrl) by DeviceName, AccountName;
auth
| join kind=inner vms on $left.Computer == $right.DeviceName
| project Computer, AccountName, Failed, Success, SrcIPs, FirstSeen, LastSeen, Processes, Exfil, Commands
| order by LastSeen desc;

# INCRANSOM rapid response snapshot: run as local admin on suspected servers and management hosts
$days = 7
$out = "$env:ProgramData\incransom_triage_$(Get-Date -Format yyyyMMdd_HHmmss)"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1) RDP exposure and recent remote interactive logons
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' | Select-Object fDenyTSConnections | Export-Csv "$out\rdp_state.csv" -NoTypeInformation
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddDays(-$days)} -ErrorAction SilentlyContinue |
  Where-Object {$_.Message -match 'Logon Type:\s*(3|10)'} |
  Select-Object TimeCreated, Id, Message | Export-Csv "$out\remote_logons.csv" -NoTypeInformation

# 2) Scheduled tasks created or changed recently
Get-ScheduledTask | ForEach-Object {
  $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  [pscustomobject]@{TaskName=$_.TaskName; TaskPath=$_.TaskPath; State=$_.State; LastRunTime=$info.LastRunTime; NextRunTime=$info.NextRunTime; Actions=($_.Actions | Out-String).Trim()}
} | Where-Object {$_.Actions -match 'powershell|psexec|rclone|7z|vssadmin|bcdedit|mshta|rundll32|regsvr32|temp|programdata'} |
  Export-Csv "$out\suspicious_tasks.csv" -NoTypeInformation

# 3) Services and run keys pointing to temp/programdata/cloud tools
Get-CimInstance Win32_Service | Where-Object {$_.PathName -match 'Temp|ProgramData|rclone|7z|psexec|vssadmin|ScreenConnect|Atera|AnyDesk|TeamViewer'} |
  Select-Object Name, DisplayName, State, StartMode, PathName | Export-Csv "$out\suspicious_services.csv" -NoTypeInformation
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object {
  Get-ItemProperty $_ -ErrorAction SilentlyContinue | Out-File "$out\runkeys.txt" -Append
}

# 4) Volume shadow copy health and deletion artifacts
vssadmin list shadows | Out-File "$out\shadows.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,7040,7045; StartTime=(Get-Date).AddDays(-$days)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, ProviderName, Message | Export-Csv "$out\service_events.csv" -NoTypeInformation

# 5) Listening ports for exposed management services
Get-NetTCPConnection -State Listen | Where-Object {$_.LocalPort -in 3389,5985,5986,443,8443,9443,22,445,135,139} |
  Select-Object LocalAddress, LocalPort, OwningProcess | Export-Csv "$out\listeners.csv" -NoTypeInformation

Write-Host "Triage bundle written to $out"

Incident Response Priorities

T-minus detection checklist: before encryption fires

Prioritize containment when you see two or more of the following in a 24-72 hour window:

• New admin logons from unusual countries, ASN or TOR-adjacent infrastructure after VPN/edge appliance events.
• Failed logon bursts followed by a single successful RDP, WinRM or VPN session.
• Execution of whoami, net group, nltest /dclist, quser, ipconfig /all, arp -a on management servers.
• PsExec, WMI /node:, WinRM, remote service creation or ADMIN$ writes outside change windows.
• Archive creation touching Finance, HR, Payroll, ERP, POS, reservations, student records, CAD/PLM or backup catalogs.
• Rclone, MEGACMD, curl/wget to uncommon cloud storage, or large outbound transfers from file/database servers.
• vssadmin delete shadows, bcdedit /set {default} recoveryenabled no, wbadmin delete catalog, backup job disablement.
• New local/domain accounts, GPO changes, disabled EDR services, tampered Windows Defender exclusions.
• Beacon-like HTTPS/DNS periodicity, suspicious rundll32/regsvr32 with no parent, or Cobalt Strike-style named pipes.

Critical assets this gang historically prioritizes for exfiltration

Expect theft before encryption from systems that maximize leverage and proof value:

• File shares containing finance, payroll, HR, legal, contracts, customer PII and student records.
• ERP, POS, property management/reservation platforms, warehouse and manufacturing execution systems.
• Email mailboxes of executives, finance, legal, HR and IT administrators.
• Backup consoles, Veeam/Commvault/Rubrik configurations, storage snapshots and recovery credentials.
• vCenter/ESXi datastores, domain controllers, PKI/AD CS materials, password vault integrations and network device configs.

Containment actions ordered by urgency

1. Isolate without tipping off prematurely: quarantine affected hosts via EDR network isolation; disable switch ports for confirmed encryption processes.
2. Protect identity: reset KRBTGT twice if DC exposure is suspected; revoke sessions for impacted admins; disable suspect accounts; rotate VPN, firewall, RMM, service and cloud secrets.
3. Cut command-and-control and exfil: block identified domains/IPs, sinkhole beacon traffic, throttle egress from servers, deny cloud-storage endpoints not business-approved.
4. Preserve evidence: capture memory on key servers, export Security/System/EDR logs, snapshot affected VMs read-only, retain VPN/firewall/vCenter/RMM logs.
5. Defend backups: verify offline/immutable copies, disable suspicious backup jobs, rotate backup credentials, test restore before declaring recovery.
6. Stop lateral spread: restrict SMB/RDP/WinRM between user and server VLANs, enforce admin tiering, block PsExec-style service creation with application control.
7. Engage comms/legal early: prepare regulator, customer and cyber-insurance workflows; assume data publication even if encryption is prevented.

Hardening Recommendations

Immediate — next 24 hours

• Patch or mitigate CVE-2026-59310, CVE-2026-20316, CVE-2026-50751, CVE-2026-48027 and CVE-2024-1708 where present; if patching is blocked, isolate management interfaces behind allowlists and jump hosts.
• Enforce phishing-resistant MFA for VPN, firewall, vCenter, RMM, email, cloud consoles and all remote admin paths; disable legacy IKEv1 where feasible.
• Block outbound Rclone/MEGA/anon file-sharing from servers unless explicitly approved; alert on any server-to-consumer-cloud egress.
• Deploy the Sigma and KQL logic above; create high-severity alerts for shadow copy deletion, backup catalog deletion and GPO/EDR tampering.
• Audit scheduled tasks, services, run keys, local admins, RMM agents and remote access tools installed in the last 14 days.
• Lock down RDP/WinRM/SMB from user subnets; require privileged access workstations and just-in-time admin for Tier-0 assets.
• Verify immutable/offline backups and perform a time-boxed restore test for at least one critical business service.

Short-term — next 2 weeks

• Move edge management planes off the internet: vCenter, FMC, Check Point SmartConsole, RMM consoles and backup UIs behind ZTNA/bastion with device identity and conditional access.
• Implement application control for servers: deny execution from Temp, ProgramData and user-writable paths; restrict 7-Zip/RAR/Rclone to approved service accounts.
• Segment by business function: POS, hospitality reservations, education SIS, manufacturing OT/ICS and corporate IT should not share unrestricted east-west paths.
• Establish data egress controls: DLP for sensitive shares, per-host egress rate limits, cloud API anomaly detection and impossible travel for service principals.
• Harden virtual infrastructure: separate vCenter identity, restrict datastore browsing, enable ESXi lockdown where compatible, monitor VM encryption and snapshot anomalies.
• Create a ransomware tabletop specific to double extortion: legal hold, leak-site monitoring, customer notification thresholds, and decision gates for shutdown/isolation.

Related Resources

Security Arsenal Incident Response
Managed SOC & MDR Services
AlertMonitor Threat Detection
From The Dark Side Intel Hub