INCRANSOM Ransomware Gang: 5 Victims Posted in 24 Hours — Energy, Healthcare & Professional Services Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Briefing Date: 2026-08-13 | Source: Direct monitoring of INCRANSOM .onion leak site via ransomware.live + CISA KEV correlation

Executive Summary

INCRANSOM (INC Ransom) published five victims in a single 24-hour window (all posted 2026-08-12), spanning four sectors: Technology, Professional Services (2x), Energy & Utilities, and Healthcare. Geographic concentration is the United States (4/5) with one Australian critical-infrastructure-adjacent target (BEDC.COM.AU). The clustering of posts on a single date is characteristic of INCRANSOM's "batch disclosure" tactic — victims who failed to pay within the negotiation window are dumped simultaneously to maximize reputational pressure on current negotiations.

Organizations in energy, healthcare, and professional services in the US and Australia should treat this as an active threat window. INCRANSOM has demonstrated willingness to hit regulated, downtime-intolerant sectors where extortion leverage is highest.

Threat Actor Profile — INCRANSOM

Current Campaign Analysis

Victims Posted (2026-08-12)

Sector Targeting

• Professional Services (2/5): Law and consulting firms hold concentrated client-confidential data — prime double-extortion material. Legal firms are especially pressured because a leak constitutes a confidentiality breach for their clients.
• Healthcare (diabetesandmetabolism.com): A specialty medical practice — PHI exposure triggers HIPAA obligations and class-action exposure. INCRANSOM knows healthcare pays to avoid breach-notification cascade.
• Energy & Utilities (BEDC.COM.AU): A Bermudan/Australian-listed electricity utility domain. Utility targeting signals either affiliate escalation or deliberate pursuit of critical-infrastructure leverage. Energy sector SOCs should treat this as the highest-priority signal in this batch.
• Technology: Likely targeted for downstream supply-chain pivot potential.

Geographic Concentration

US-dominant (80%), consistent with INCRANSOM's historical focus on US mid-market organizations. The AU utility post breaks pattern and may indicate an affiliate operating in APAC time zones.

Victim Profile

Small-to-mid-market enterprises, roughly 50–500 employees, $10M–$250M revenue. INCRANSOM avoids Fortune 500 (heavier defenses, law-enforcement heat) and micro-businesses (can't pay). Specialty medical practices, regional law firms, and mid-size utilities sit squarely in their sweet spot: enough revenue to pay seven figures, weak enough security posture to breach via edge devices.

Posting Frequency / Escalation

5 simultaneous posts after a quieter period = batch disclosure. Expect a second wave of postings within 7–14 days as the next negotiation cohort expires. The single-day dump also suggests a mature victim pipeline — intrusions likely occurred 2–6 weeks ago, meaning other compromised-but-unposted organizations exist right now.

CVE Correlation — Probable Initial Access Vectors

INCRANSOM's known tradecraft (edge-device exploitation + remote access tooling abuse) aligns directly with the currently KEV-listed vulnerabilities:

Assessment: CVE-2026-50751 (Check Point) and CVE-2024-1708 (ScreenConnect) are the most probable ingress vectors for this victim cohort based on INCRANSOM's established playbook.

Detection Engineering

Sigma Rules

---
title: INCRANSOM - Volume Shadow Copy Deletion Pre-Encryption
id: 9e4a1c2d-7f3b-4e1a-9c5d-incransom0001
status: production
description: Detects deletion or resizing of Volume Shadow Copies, a near-universal INCRANSOM pre-encryption step to prevent recovery
date: 2026/08/13
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.impact
  - attack.t1490
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
  selection_vss:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    CommandLine|contains: 'shadowcopy delete'
  selection_bcd:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and (selection_vss or selection_wmic or selection_bcd)
falsepositives:
  - Legitimate backup administration (rare on endpoints)
fields:
  - CommandLine
  - ParentCommandLine
  - User
---
title: INCRANSOM - Remote Execution via PsExec or WMI Service Install
id: 9e4a1c2d-7f3b-4e1a-9c5d-incransom0002
status: production
description: Detects PsExec service installation and WMI remote process creation consistent with INCRANSOM lateral movement and mass-encryption deployment
date: 2026/08/13
author: Security Arsenal Threat Intel
logsource:
  product: windows
  service: system
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
  selection_susp_svc:
    EventID: 7045
    ImagePath|contains:
      - '\ADMIN$\'
      - 'cmd.exe /c'
      - 'powershell.exe -enc'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software deployment tools (SCCM, PDQ) - baseline approved service names
fields:
  - ServiceName
  - ImagePath
  - ComputerName
---
title: INCRANSOM - Rclone or MegaSync Data Exfiltration Staging
id: 9e4a1c2d-7f3b-4e1a-9c5d-incransom0003
status: production
description: Detects execution of cloud-sync exfiltration tooling (Rclone, MEGAsync, WinSCP scripted transfers) used by INCRANSOM for pre-encryption data theft
date: 2026/08/13
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
level: medium
tags:
  - attack.exfiltration
  - attack.t1567.002
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\mega.cmd'
      - '\WinSCP.exe'
      - '\filezilla.exe'
  selection_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - 'mega.nz'
  filter_admin_share:
    CommandLine|contains: '\\'
  condition: selection_img and selection_args
falsepositives:
  - Legitimate Rclone backup jobs - whitelist known service accounts and scheduled task names
fields:
  - CommandLine
  - User
  - ParentImage

KQL — Microsoft Sentinel: Pre-Ransomware Staging & Lateral Movement Hunt

// INCRANSOM pre-detonation hunt: VSS tampering, remote service installs,
// suspicious RMM execution, and exfil tooling within a 14-day window
let lookback = 14d;
let rmm_tools = dynamic(["ScreenConnect","AnyDesk","psexesvc","rclone","megasync","winscp"]);
let vss_events = (DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","resize shadowstorage","recoveryenabled no")
    | project VssTime=Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName);
let svc_installs = (DeviceEvents
    | where Timestamp > ago(lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any (rmm_tools) or ServiceName matches regex @"^[A-Za-z0-9]{8}$"  // random 8-char names typical of Cobalt Strike/PsExec clones
    | project SvcTime=Timestamp, DeviceName, ServiceName, InitiatingProcessAccountName);
let exfil_procs = (DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName has_any (rmm_tools)
    | project ExfilTime=Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName);
let net_beacons = (DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName has_any (rmm_tools)
    | summarize ConnCount=count(), DestIPs=make_set(RemoteIP, 10) by DeviceName, InitiatingProcessFileName
    | where ConnCount > 20);
vss_events
| join kind=leftouter svc_installs on DeviceName
| join kind=leftouter exfil_procs on DeviceName
| join kind=leftouter net_beacons on DeviceName
| summarize arg_max(VssTime, *) by DeviceName
| project DeviceName, VssTime, VssCmd=ProcessCommandLine, SvcTime, ServiceName, ExfilTime, ExfilTool=FileName, ConnCount, DestIPs
| sort by DeviceName asc

Interpretation: Any single device with VSS tampering is an immediate P1. A device with VSS tampering + a random-named service install + exfil tooling within the window is an active intrusion in the final staging phase — isolate immediately.

PowerShell — Rapid Triage & Containment Script

<#
.SYNOPSIS
  INCRANSOM Rapid Triage - run on any suspect host or via GPO/Intune fleet-wide.
  Checks: shadow copy integrity, services/tasks created in last 7 days,
  exposed RDP, suspicious persistence, exfil tool artifacts.
  Run elevated. Review output file before taking destructive actions.
#>

$report = "$env:TEMP\incransom_triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
"=== INCRANSOM Rapid Triage - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $report

# 1. Shadow copy status (INCRANSOM deletes these pre-encryption)
"`n[1] VOLUME SHADOW COPIES" | Out-File $report -Append
try { vssadmin list shadows 2>&1 | Out-File $report -Append }
catch { "vssadmin query failed - shadows may already be deleted (BAD SIGN)" | Out-File $report -Append }

# 2. Services installed in last 7 days (PsExec clones, random-name services)
"`n[2] SERVICES / DRIVERS INSTALLED (LAST 7 DAYS)" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Out-File $report -Append

# 3. Scheduled tasks created in last 7 days (common persistence)
"`n[3] SCHEDULED TASKS (LAST 7 DAYS)" | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date | Format-Table -AutoSize | Out-File $report -Append

# 4. RDP exposure check
"`n[4] RDP STATUS" | Out-File $report -Append
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"RDP Disabled flag (1=disabled): $($rdp.fDenyTSConnections)" | Out-File $report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Out-File $report -Append

# 5. Exfil/RMM tool artifacts
"`n[5] EXFIL / RMM TOOL ARTIFACTS" | Out-File $report -Append
$tools = 'rclone','megasync','winscp','filezilla','screenconnect','anydesk','psexesvc'
Get-Process | Where-Object { $n=$_.Name.ToLower(); $tools | Where-Object { $n -like "*$_*" } } |
  Select-Object Name, Id, Path | Out-File $report -Append
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)','C:\ProgramData' -Recurse -Depth 2 -ErrorAction SilentlyContinue |
  Where-Object { $n=$_.Name.ToLower(); $tools | Where-Object { $n -like "*$_*" } } |
  Select-Object FullName, LastWriteTime | Out-File $report -Append

# 6. Recent failed logons (brute-force indicator)
"`n[6] FAILED LOGONS LAST 24H (COUNT BY SOURCE)" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
  Group-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress' | Select-Object -Expand '#text' } |
  Sort-Object Count -Descending | Select-Object Count, Name -First 10 | Format-Table | Out-File $report -Append

Write-Host "Triage complete: $report" -ForegroundColor Cyan
Write-Host "RED FLAGS: missing shadow copies, 7045 events with random service names, rclone/megasync processes, >50 failed logons from one IP" -ForegroundColor Yellow

Incident Response Priorities — INCRANSOM Playbook

T-Minus Detection Checklist (Before Encryption Fires)

• VSS deletion events on servers — INCRANSOM runs this 15–60 minutes before detonation. This is your final alarm.
• New 7045 service installs with 8-character random names or ADMIN$ paths (mass PsExec push of the encryptor)
• Rclone/MegaSync processes or large outbound transfers to mega.nz, Backblaze B2, or unfamiliar cloud storage
• New AnyDesk/ScreenConnect installations not tied to a change ticket
• Sudden spike in SMB writes from a single host to many servers (encryptor staging)
• Antivirus/EDR tampering events (defender exclusions added, services stopped)
• GPO modifications — INCRANSOM has pushed encryptors via Group Policy after compromising a DC

Exfiltration Priorities This Gang Targets

1. Client legal/financial documents (professional services leverage)
2. PHI / patient records (healthcare regulatory pressure)
3. Financial records, payroll, contracts, insurance policies
4. Email archives from executive mailboxes (often via compromised Exchange — see CVE-2023-21529)
5. Proprietary source code / engineering schematics (technology and energy victims)

Containment Actions (Ordered by Urgency)

1. Isolate the VSS-deletion host from the network immediately — encryption is imminent, not theoretical
2. Disable compromised accounts and force credential rotation for all admin/DA accounts; INCRANSOM harvests and reuses creds across hosts
3. Block SMB (445) laterally between workstations via host firewall rules to stop mass-deployment
4. Kill and remove unauthorized RMM tools; block their domains/IPs at egress
5. Throttle/block egress to consumer cloud storage (mega.nz, etc.)
6. Snapshot/preserve volatile evidence on the patient-zero host before reimaging — edge-device logs (VPN/firewall) are critical for attribution
7. Verify backup integrity and confirm backups are offline/immutable — INCRANSOM actively hunts backup infrastructure

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1) — this is the highest-confidence ingress vector for this campaign. If patching isn't possible today, disable IKEv1 aggressive mode / apply vendor workaround.
• Audit ConnectWise ScreenConnect instances (CVE-2024-1708). Update to patched versions; remove internet exposure; inventory all RMM tools and alert on any not on the approved list.
• Patch Cisco FMC/SCC (CVE-2026-20131) and Exchange (CVE-2023-21529) per CISA KEV deadlines.
• Enforce phishing-resistant MFA (FIDO2) on all VPN, RDP, and remote access portals.
• Enable tamper protection on EDR and alert on any vssadmin delete execution fleet-wide.
• Block outbound to mega.nz, and alert on rclone.exe/megasync.exe execution outside approved backup jobs.
• Disable or restrict RDP exposure; verify no hosts answer on 3389 from the internet (Get-NetTCPConnection -LocalPort 3389).

Short-Term (2 Weeks)

• Segment management planes (Cisco FMC, backup consoles, hypervisors) onto isolated networks with jump-box-only access.
• Deploy application allow-listing on servers to block PsExec clones and unauthorized RMM binaries by hash/signature.
• Implement canary file shares and honey credentials — INCRANSOM's enumeration phase touches these reliably.
• Move backups to immutable/offline storage with separate credentials; test restoration.
• Baseline SMB write rates per host and alert on anomalous fan-out (mass encryption signature).
• Conduct a tabletop exercise using INCRANSOM's exact playbook: edge-device entry → RMM persistence → exfil → VSS deletion → mass PsExec deployment.
• Review developer tooling supply chain (Nx Console — CVE-2026-48027) if you have engineering teams using affected versions.

Analyst Assessment

INCRANSOM's batch-posting behavior confirms a healthy victim pipeline and a deliberate shift toward high-leverage, regulated sectors. The appearance of an Australian energy utility alongside US healthcare and legal targets suggests at least one affiliate is pursuing critical-infrastructure-adjacent organizations. Given the 5–14 day average dwell time and the confirmed KEV alignment with their ingress tradecraft, organizations running unpatched Check Point gateways, ScreenConnect servers, or Cisco FMC should assume they are being actively scanned and prioritize those patches above routine work this week.

Confidence: High on victim data (direct leak-site observation); Moderate on CVE-as-ingress attribution (TTP correlation, not confirmed per-victim forensics).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub