INCRANSOM Ransomware Gang: 5 New Victims Posted — Manufacturing & Energy Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Published: 2026-08-29 | Analyst: Security Arsenal Threat Intelligence | Source: ransomware.live monitoring of INCRANSOM .onion leak infrastructure

Executive Summary

Security Arsenal's dark web monitoring has confirmed 5 new victim postings to the INCRANSOM leak site within a 72-hour window (2026-08-27 through 2026-08-29). The posting cadence — roughly one to two victims per day — indicates an active detonation wave, not backlog publishing. Targeting is concentrated in Manufacturing, Energy & Utilities, Professional Services, and Technology, with victims spanning Mexico, the United States, and South Africa.

Two of the five victims are industrial-sector organizations (Wittmann — plastics injection molding machinery; Oilquip Inc — oilfield equipment/services). This continues INCRANSOM's documented preference for operationally-technology-heavy victims where production downtime pressure maximizes ransom payment probability. Organizations in these sectors should treat this bulletin as an immediate patching and hunting directive.

Threat Actor Profile — INCRANSOM

INCRANSOM affiliates are known to be opportunistic but disciplined: they prioritize victims with cyber-insurance policies (identifiable via exfiltrated documents) and organizations where operational disruption creates public pressure. Their negotiators respond quickly and cite leaked financials to justify demand sizing — confirming that data theft precedes encryption in virtually every confirmed case.

Current Campaign Analysis

Victimology (last 100 postings — 5 most recent)

Sector Targeting

• Manufacturing (40%): Consistent with INCRANSOM's historical profile — industrial firms with high downtime cost and often weaker IT/OT segmentation. Wittmann and Rohloff Group are both machinery/industrial groups with multinational footprints.
• Energy & Utilities (20%): Oilquip Inc targets oilfield services — organizations in this vertical frequently run legacy remote access into field operations, a classic INCRANSOM entry point.
• Professional Services & Technology (40%): BENCIVIL (engineering/construction consulting) and Ruby Seven Studios (game development) suggest affiliate-level opportunism alongside the industrial focus — likely separate affiliate intrusions funneled to the same leak pipeline.

Geographic Concentration

US-dominant (3/5) with meaningful spread into Mexico and South Africa — consistent with affiliate-driven operations where access brokers sell whatever perimeter exposure they find. No evidence of politically motivated geographic selection; this is financially driven.

Victim Profile

Estimated revenue range across the five victims: $10M–$500M USD — the classic INCRANSOM mid-market sweet spot. Large enough to pay six-to-seven-figure ransoms, small enough to lack 24/7 SOC coverage. All five are organizations where a weekend detonation would plausibly go undetected for 48+ hours.

Posting Frequency & Escalation

Five postings in 72 hours is elevated for INCRANSOM's baseline (~2–3/week historically). This pattern typically indicates one of: (a) a successful new initial-access vector yielding multiple concurrent affiliate intrusions, (b) synchronized detonation from a shared access-broker purchase, or (c) negotiation failures being published in batch. The sector diversity argues for (b) or (c).

CVE Correlation — Likely Initial Access Vectors

The following CISA KEV entries (confirmed ransomware use) map directly to INCRANSOM's known playbook and the current victim profile:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1): Perimeter VPN compromise is INCRANSOM's #1 documented entry vector. Manufacturing/energy firms with Check Point gateways at plant/field sites are the highest-risk population. If you run Check Point Security Gateway and have not patched this, assume you are a target.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE): Directly matches INCRANSOM's abuse of legitimate RMM tooling. ScreenConnect compromise yields both initial access AND a persistent remote-access channel that blends with legitimate admin traffic.
• CVE-2026-48027 (Nx Console embedded malicious code): Supply-chain compromise of developer tooling — the likely vector into Ruby Seven Studios (Technology). Developer workstations are high-value: they hold source code, signing keys, and CI/CD credentials.
• CVE-2025-60710 (Windows link following → privilege escalation): Post-exploitation escalation primitive; consistent with INCRANSOM's rapid admin-level compromise before staging.
• CVE-2023-21529 (Exchange Server deserialization): Webmail-facing initial access for the professional-services victim profile; authenticated RCE on Exchange typically pivots straight to domain credentials.

Assessment: The cluster of Check Point VPN and ScreenConnect CVEs in this window strongly suggests affiliates are chaining perimeter exploitation with RMM persistence — exactly the intrusion lifecycle the detection rules below target.

Detection Engineering

The following Sigma rules target INCRANSOM's specific kill chain: VPN/RMM initial access, living-off-the-land lateral movement, and pre-encryption staging. Deploy all three — they are designed as a correlated set.

---
title: INCRANSOM - Suspicious RMM Tool Execution from Non-Standard Path
id: 8f3a2b1c-incr-0001-aaaa-000000000001
status: experimental
description: Detects execution of ScreenConnect, AnyDesk, or similar RMM tooling from non-standard directories or with suspicious parent processes. INCRANSOM affiliates abuse legitimate RMM (CVE-2024-1708 follow-on) for persistence and lateral movement that evades application allowlists.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
 detection: null
detection:
    selection_rmm_img:
        Image|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
            - '\AnyDesk.exe'
            - '\AteraAgent.exe'
            - '\Splashtop.exe'
    selection_suspicious_path:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
            - '\Users\Public\'
            - '\Windows\Temp\'
    selection_suspicious_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    condition: selection_rmm_img and (selection_suspicious_path or selection_suspicious_parent)
falsepositives:
    - Legitimate RMM deployed via scripts by MSP tooling (tune with known MSP deployment paths)
level: high
tags:
    - attack.command_and_control
    - attack.t1219
---
title: INCRANSOM - Pre-Encryption Staging and Shadow Copy Destruction
id: 8f3a2b1c-incr-0002-bbbb-000000000002
status: experimental
description: Detects the classic INCRANSOM pre-detonation sequence - volume shadow copy deletion via vssadmin/wmic/bcdedit combined with bulk archive creation (7z/rar) targeting sensitive directories. Fires in the T-minus window before ransomware detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith: '\vssadmin.exe'
          CommandLine|contains:
              - 'delete shadows'
              - 'Delete Shadows'
        - Image|endswith: '\wmic.exe'
          CommandLine|contains: 'shadowcopy'
        - Image|endswith: '\bcdedit.exe'
          CommandLine|contains:
              - 'recoveryenabled no'
              - 'ignoreallfailures'
        - Image|endswith: '\wbadmin.exe'
          CommandLine|contains: 'delete catalog'
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - ' -p'
    condition: selection_vss or selection_archive
falsepositives:
    - Backup software performing legitimate shadow copy management (whitelist known backup process trees)
    - Developer use of 7-Zip on build servers (scope exclusions by host OU)
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
---
title: INCRANSOM - Lateral Movement via PsExec or WMI with Cobalt Strike Artifact Patterns
id: 8f3a2b1c-incr-0003-cccc-000000000003
status: experimental
description: Detects remote service creation (PsExec-style) and WMI remote process execution consistent with INCRANSOM affiliate lateral movement, including randomly-named services and ADMIN$ writes typical of Cobalt Strike psexec_psh lateral movement.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    service: system
    definition: 'Windows Event Log 7045 (Service Installation) and 4697'
detection:
    selection_service_install:
        EventID:
            - 7045
            - 4697
    selection_suspicious_service:
        ServiceName|re: '^[A-Za-z0-9]{7,9}$'
        ImagePath|contains:
            - 'ADMIN$'
            - '\\%COMSPEC%'
            - 'powershell'
            - '\\PSEXESVC'
            - '%SystemRoot%\\TEMP'
    condition: selection_service_install and selection_suspicious_service
falsepositives:
    - Legitimate PsExec use by sysadmins (baseline admin accounts and source hosts, alert on deviations)
    - EDR/SCCM remote push installs (exclude known management server source IPs)
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002

Microsoft Sentinel KQL — Pre-Ransomware Staging & Lateral Movement Hunt

This query hunts the INCRANSOM exfiltration-before-encryption pattern: bulk archive creation followed by outbound transfer tooling, correlated against the same host within a 24-hour window. Run it daily across your endpoint fleet.

let Lookback = 7d;
let StagingProcs = dynamic(["7z.exe","7za.exe","rar.exe","winrar.exe"]);
let ExfilProcs = dynamic(["rclone.exe","megacmd.exe","filezilla.exe","winscp.exe","curl.exe"]);
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (StagingProcs)
    | where ProcessCommandLine has_any (" a ", " -p", "\\finance", "\\hr", "\\legal", "\\backup")
    | project StagingTime=TimeGenerated, DeviceName, AccountName, StagingCmd=ProcessCommandLine, DeviceId;
let Exfil =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (ExfilProcs)
    | where ProcessCommandLine has_any ("mega", "copy", "sync", "--transfers", "sftp", "https://")
    | project ExfilTime=TimeGenerated, DeviceName, ExfilCmd=ProcessCommandLine, DeviceId;
let VssDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
       or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
       or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
    | project VssTime=TimeGenerated, DeviceName, VssCmd=ProcessCommandLine, DeviceId;
Staging
| join kind=inner Exfil on DeviceId
| join kind=leftouter VssDelete on DeviceId
| where ExfilTime between (StagingTime .. StagingTime + 24h)
| extend KillChainScore = iif(isnotnull(VssTime), 3, 2)
| project DeviceName, AccountName, StagingTime, StagingCmd, ExfilTime, ExfilCmd, VssTime, VssCmd, KillChainScore
| sort by KillChainScore desc, StagingTime desc

Tuning note: Hosts with KillChainScore = 3 (staging + exfil + shadow copy deletion on the same machine within 24h) should be treated as active intrusions requiring immediate isolation — that sequence is the final phase of INCRANSOM's playbook before detonation.

Rapid-Response PowerShell — INCRANSOM Exposure & Staging Audit

Run this from an elevated prompt on domain-joined systems (or via your RMM/EDR at scale) to check the three things INCRANSOM relies on: exposed RDP, recent persistence via scheduled tasks, and shadow copy tampering.

# INCRANSOM Rapid Exposure & Staging Audit - Security Arsenal Threat Intel (2026-08-29)
# Run elevated. Outputs findings to console and C:\IR\INCRANSOM_Audit_<timestamp>.log

$logDir = "C:\IR"
if (!(Test-Path $logDir)) { New-Item -ItemType Directory -Path $logDir | Out-Null }
$log = Join-Path $logDir ("INCRANSOM_Audit_" + (Get-Date -Format "yyyyMMdd_HHmmss") + ".log")
function Write-Finding($msg) { $line = "[$(Get-Date -Format 'HH:mm:ss')] $msg"; Write-Host $line; Add-Content $log $line }

Write-Finding "=== INCRANSOM Rapid Audit Started on $env:COMPUTERNAME ==="

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
if ($rdpEnabled) {
    Write-Finding "[ALERT] RDP is ENABLED. NLA enforced: $nlaEnabled"
    if (-not $nlaEnabled) { Write-Finding "[CRITICAL] RDP without NLA - prime INCRANSOM brute-force/spray target. Disable or restrict now." }
    Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | ForEach-Object {
        Write-Finding "[INFO] RDP listening on $($_.LocalAddress):$($_.LocalPort)"
    }
} else { Write-Finding "[OK] RDP disabled." }

# 2. Scheduled tasks created in last 7 days (persistence hunt)
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = "$($_.TaskPath)$($_.TaskName)"
    $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue
    if ($xml -and ([xml]$xml).Task.RegistrationInfo.Date) {
        $created = [datetime]([xml]$xml).Task.RegistrationInfo.Date
        if ($created -gt $cutoff) {
            $action = ([xml]$xml).Task.Actions.Exec.Command -join '; '
            Write-Finding "[SUSPICIOUS] Task created $created : $taskPath -> $action"
        }
    }
}

# 3. Volume Shadow Copy status (INCRANSOM deletes these pre-encryption)
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Finding "[OK] $($shadows.Count) shadow copies present. Oldest: $(($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate)"
} else {
    Write-Finding "[CRITICAL] NO volume shadow copies found - either never configured or recently deleted (T-minus indicator). Correlate with vssadmin/wmic process logs immediately."
}

# 4. Recently dropped executables in staging-friendly directories
$stagingPaths = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP", "C:\Windows\Temp")
foreach ($p in $stagingPaths) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll,*.ps1,*.7z,*.rar -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt $cutoff } |
        ForEach-Object { Write-Finding "[REVIEW] Recent file: $($_.FullName) (created $($_.CreationTime))" }
}

# 5. Suspicious outbound tools present on disk
foreach ($tool in @("rclone.exe","megacmd.exe","PSEXESVC.exe","AnyDesk.exe","ScreenConnect.ClientService.exe")) {
    $found = Get-ChildItem "C:\" -Recurse -Filter $tool -ErrorAction SilentlyContinue -Depth 4 | Select-Object -First 3
    foreach ($f in $found) { Write-Finding "[SUSPICIOUS] Tool found: $($f.FullName) (created $($f.CreationTime))" }
}

Write-Finding "=== Audit complete. Review [CRITICAL]/[SUSPICIOUS] entries first. Log: $log ==="

Incident Response Priorities (INCRANSOM Playbook-Specific)

T-Minus Detection Checklist — Catch Them Before Encryption

INCRANSOM's dwell time of 5–14 days gives defenders a real window. Alert on, and investigate immediately, any of:

1. Shadow copy deletion commands (vssadmin delete shadows, wmic shadowcopy delete, bcdedit recoveryenabled no) — this is the 24–72h pre-detonation signal. Non-negotiable page-the-SOC event.
2. Bulk archive creation (7z/rar) against file shares, especially finance/HR/legal directories, running under service or admin accounts outside backup windows.
3. RClone/MEGA/cloud sync binaries appearing on servers that have no business running them.
4. New RMM agents (ScreenConnect, AnyDesk) installed outside your approved MSP deployment pipeline — especially following any Check Point gateway or VPN anomaly.
5. Randomly-named Windows services (7–9 char alphanumeric) or 7045 events referencing ADMIN$ — PsExec/Cobalt Strike lateral movement.
6. Unusual Kerberos TGS bursts or DCSync-style replication requests from non-DC hosts — credential harvesting phase.

Critical Assets INCRANSOM Prioritizes for Exfiltration

Based on negotiation patterns observed on their leak site, INCRANSOM specifically hunts: financial statements and tax records (used to size ransom demands), cyber-insurance policy documents (used to calibrate demands to coverage limits), HR/PII databases (leak leverage), legal/contracts, and — for industrial victims like Wittmann and Oilquip — CAD drawings, schematics, and operational process documentation. Classify and canary-token these data stores now.

Containment Actions — Ordered by Urgency

1. Isolate the affected host(s) from the network immediately (EDR network isolation, not just unplug — preserve memory).
2. Disable the compromised identity set — any account observed in staging/lateral movement telemetry, plus all service accounts that touched those hosts.
3. Block exfil channels at egress — MEGA, RClone endpoints, and unidentified high-volume outbound flows; enable TLS inspection alerting on unusual destinations.
4. Snapshot/verify backup integrity offline — confirm backups predate earliest staging indicator; INCRANSOM routinely attempts backup destruction.
5. Hunt laterally from patient-zero using the KQL query above — assume at least one additional foothold (affiliates typically maintain 2+ persistence mechanisms).
6. Rotate VPN/RMM credentials and certificates if any perimeter device compromise is suspected; patch CVE-2026-50751 / CVE-2024-1708 before reconnecting.
7. Engage IR retainer and legal/comms before any negotiation consideration; preserve all artifacts for law enforcement reporting.

Hardening Recommendations

Immediate (Next 24 Hours)

• Patch Check Point Security Gateway (CVE-2026-50751) on every internet-facing gateway — industrial and field-site gateways first. If patching is not possible tonight, disable IKEv1 or take the gateway's VPN service offline temporarily.
• Patch ConnectWise ScreenConnect (CVE-2024-1708) and audit for rogue ScreenConnect/AnyDesk installations fleet-wide (script above).
• Disable or ACL-restrict RDP — no internet-facing 3389, enforce NLA, require VPN + MFA for any remote administration.
• Deploy the three Sigma rules and the KQL hunt to your SIEM/Sentinel; treat KillChainScore=3 hits as active incidents.
• Alert (don't just log) on vssadmin/bcdedit/wmic shadowcopy execution — this single control catches nearly every ransomware family in its final phase.
• Verify Exchange patch level (CVE-2023-21529) on any remaining on-prem Exchange, and review IIS/Exchange logs for deserialization indicators.
• Confirm immutable/offline backups are current and that backup admin credentials are separate from domain credentials.

Short-Term (Next 2 Weeks)

• Segment IT/OT networks — Manufacturing and Energy victims consistently suffer worst outcomes where flat networks let intrusions reach production systems. Enforce deny-by-default between OT and corporate VLANs.
• Deploy application allowlisting on servers and industrial workstations; INCRANSOM's reliance on 7z/rclone/PsExec makes allowlisting disproportionately effective against this group.
• Implement egress filtering with DNS/destination analytics — data theft is this gang's leverage; if exfil is blocked or detected, their extortion model collapses even if encryption occurs.
• Migrate VPN authentication to phishing-resistant MFA (FIDO2) and inventory all remote access appliances against the CISA KEV catalog weekly.
• Establish a 24/7 detection capability (in-house SOC or MDR) — all five victims in this wave were posted after weekend-scale dwell windows. INCRANSOM counts on Friday-night detonations.
• Review developer workstation controls (CVE-2026-48027 lesson): pin and verify IDE extension sources, and isolate build/signing infrastructure from general browsing and email.

Bottom line: INCRANSOM is in an active wave with a clear industrial-sector appetite and a well-understood playbook. Every element of that playbook — VPN exploitation, RMM abuse, staging, shadow copy deletion — is detectable with the content in this briefing. The organizations that get hit are the ones that had the telemetry and didn't alert on it. Don't be posting #6.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub