INCRANSOM Ransomware Gang: 7 New Victims Posted in 72 Hours — Cross-Sector Campaign Analysis & Detection Engineering Brief

Classification: TLP:AMBER — Threat Intelligence Bulletin Published: 2026-08-19 Source: Live monitoring of INCRANSOM .onion leak site via ransomware.live, CISA KEV cross-reference Analyst: Security Arsenal — From The Dark Side Intel Hub

Executive Summary

Between 2026-08-16 and 2026-08-18, the INCRANSOM ransomware operation published 7 new victims to its dark web leak site — an aggressive posting cadence indicating an active, synchronized campaign wave rather than opportunistic single intrusions. The victim set spans financial services, healthcare, and professional services across six countries (AE, DE, MU, TW, MY, US), with two financial institutions and two healthcare providers posted within the same 24-hour window on 2026-08-18. All 7 victims were published with double-extortion framing: encrypted environments plus threatened data release.

Organizations running Check Point Security Gateway, ConnectWise ScreenConnect, or unpatched Microsoft Exchange should treat this bulletin as an immediate patching and threat-hunting trigger. Multiple CVEs with confirmed ransomware use — including CVE-2026-50751 (Check Point IKEv1 improper authentication) — align with INCRANSOM's known perimeter-device initial access pattern.

Threat Actor Profile — INCRANSOM

INCRANSOM distinguishes itself through sector-agnostic opportunism paired with deliberate regulatory leverage: healthcare victims are pressured with patient-data disclosure threats, financial services with regulatory notification triggers. Negotiations are handled professionally and quickly — the group favors rapid monetization over prolonged public pressure campaigns.

Current Campaign Analysis

Victim Set (2026-08-16 → 2026-08-18)

Sector Targeting

The campaign shows a tri-sector focus: financial services (2/7), healthcare (2/7), and professional/legal services (2–3/7). This is not random. All three sectors share two properties INCRANSOM exploits: (1) high regulatory breach-notification pressure that shortens victim decision time, and (2) dense concentrations of monetizable PII/PHI/financial records. The pairing of a US community bank (Third Coast Bancshares) with a US urgent care clinic in the same wave suggests affiliates are working sector playbooks in parallel rather than a single intrusion thread.

Geographic Concentration

Six countries with no single dominant geography: US (2), AE, DE, MU, TW, MY (1 each). This distribution is consistent with perimeter-vulnerability-driven opportunism — victims are selected by exposed and exploitable edge devices, not by regional targeting logic. The presence of Mauritius and Malaysia victims indicates the affiliate pool is scanning broadly across under-monitored regions where patching cadence on VPN gateways lags.

Victim Profile

Victims skew small-to-midsize enterprise (estimated 50–1,500 employees; ~$10M–$500M revenue). Community banks, regional law firms, specialty pharma, and urgent care chains fit the classic INCRANSOM profile: large enough to pay six-to-seven-figure ransoms, small enough to lack 24/7 SOC coverage and rapid patch deployment on edge infrastructure.

Posting Frequency & Escalation

Six of seven victims were posted on a single day (2026-08-18). Burst publication of this kind typically means one of two things: (1) a negotiation deadline batch expired simultaneously, or (2) the group is signaling capacity to recruit affiliates. Either interpretation implies the intrusion wave behind these posts occurred roughly 1–2 weeks ago — meaning additional victims from the same access wave are likely already compromised and not yet posted. Expect follow-on publications through late August.

CVE Correlation — Probable Initial Access Vectors

Cross-referencing the current CISA KEV entries with confirmed ransomware use against INCRANSOM's known tradecraft:

• CVE-2026-50751 (Check Point Security Gateway, IKEv1 improper authentication) — added to KEV 2026-06-08. This is the highest-confidence initial access match for this wave. INCRANSOM has historically favored VPN gateway exploitation, and the ~10-week gap between KEV addition and this victim burst fits the patch-lag exploitation window almost exactly. Any organization running Check Point gateways with IKEv1 enabled that has not patched should assume exposure.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — matches the MSP/RMM-tooling intrusion path; relevant for professional services victims who commonly outsource IT.
• CVE-2025-60710 (Windows link following privilege escalation) — post-exploitation elevation, consistent with moving from initial foothold to domain admin.
• CVE-2023-21529 (Exchange deserialization) — authenticated RCE path; plausible for the healthcare victims where on-prem Exchange remains common.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply chain vector; lower confidence for this specific wave but notable given developer-tooling compromise potential at pharmaceutical targets.

Detection Engineering

The following detections target INCRANSOM's observed playbook: VPN/edge-device initial access → macro or RMM execution → Cobalt Strike/WMI/PsExec lateral movement → staging and exfiltration → encryption.

---
title: INCRANSOM - Suspicious Authentication Anomaly Following VPN Gateway Exploitation
id: 8f3a1c2e-7b41-4e9a-a3d5-incransom001
status: experimental
description: Detects anomalous logon patterns consistent with post-exploitation activity after VPN gateway compromise (e.g., CVE-2026-50751 Check Point IKEv1 improper auth), including logons from VPN-assigned IPs at unusual hours followed by rapid internal authentication to multiple hosts.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: windows
detection:
  selection_logon:
    EventID: 4624
    LogonType:
      - 3
      - 10
  selection_vpn_source:
    IpAddress|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_known_admins:
    TargetUserName|endswith:
      - '_adm'
      - '-admin'
  condition: selection_logon and selection_vpn_source and not filter_known_admins
falsepositives:
  - Legitimate VPN remote access by non-admin users
  - Scheduled service account authentication
level: medium
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
---
title: INCRANSOM - PsExec or WMI Remote Execution for Lateral Movement
id: 9c4b2d3f-8c52-5f0b-b4e6-incransom002
status: experimental
description: Detects PsExec service installation and WMI process creation patterns used by INCRANSOM affiliates to move laterally and stage ransomware payloads across domain hosts prior to detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rclone.exe'
      - '\7z.exe'
      - '\vssadmin.exe'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Legitimate administrative PsExec use by IT teams
  - SCCM or management tooling spawning processes via WMI
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: INCRANSOM - Pre-Encryption Staging and Shadow Copy Destruction
id: 0d5c3e4a-9d63-6a1c-c5f7-incransom003
status: experimental
description: Detects the critical T-minus behaviors observed in INCRANSOM intrusions before encryption fires - mass archive creation in staging directories, RClone execution, and Volume Shadow Copy deletion. Alerting on this combination provides a last-chance detection window before detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss_delete:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_exfil_tooling:
    Image|endswith:
      - '\rclone.exe'
      - '\megasync.exe'
      - '\filezilla.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - '--transfers'
  selection_staging_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance deleting old shadow copies
  - IT-managed RClone backup jobs (whitelist known job hosts and args)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1567.002
  - attack.collection
  - attack.t1560.001

The following KQL query hunts the 72-hour pre-detonation window INCRANSOM typically operates in: suspicious logon from VPN space, followed by remote execution tooling and archive/exfil staging on the same host chain.

// INCRANSOM Pre-Detonation Hunt: VPN foothold -> lateral movement -> staging/exfil
// Lookback: 14 days | Focus: hosts showing the full intrusion chain
let lookback = 14d;
let vpn_subnets = dynamic(["10.", "172.16.", "192.168."]);
// Step 1: Identify hosts that received remote logons from VPN-assigned source IPs
let VpnFootholds = DeviceLogonEvents
| where TimeGenerated > ago(lookback)
| where LogonType in ("Network", "RemoteInteractive")
| where RemoteIP has_any (vpn_subnets)
| where AccountName !endswith "$"
| summarize FirstVpnLogon = min(TimeGenerated) by DeviceName, AccountName, RemoteIP;
// Step 2: Lateral movement tooling spawned on those hosts after VPN logon
let LateralTools = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("psexec.exe", "psexesvc.exe", "wmic.exe", "wsmprovhost.exe", "winrs.exe")
   or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe", "powershell.exe", "rclone.exe", "7z.exe"))
| summarize LateralActivity = min(TimeGenerated), LateralCmds = make_set(ProcessCommandLine, 20) by DeviceName, InitiatingProcessAccountName;
// Step 3: Staging / exfil / shadow-copy destruction indicators on the same hosts
let StagingExfil = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("rclone.exe", "megasync.exe", "7z.exe", "rar.exe")
   or (ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no"))
| summarize StagingActivity = min(TimeGenerated), StagingCmds = make_set(ProcessCommandLine, 20) by DeviceName;
// Correlate the full kill chain
VpnFootholds
| join kind=inner LateralTools on DeviceName
| join kind=inner StagingExfil on DeviceName
| where LateralActivity >= FirstVpnLogon and StagingActivity >= LateralActivity
| extend DwellTimeHours = datetime_diff("hour", StagingActivity, FirstVpnLogon)
| project DeviceName, AccountName, RemoteIP, FirstVpnLogon, LateralActivity, StagingActivity, DwellTimeHours, LateralCmds, StagingCmds
| order by StagingActivity desc;

Rapid-response script: run on domain controllers and jump hosts to enumerate persistence and pre-encryption indicators created in the last 7 days — scheduled tasks, shadow copy tampering, and unexpected RDP exposure.

<#
.SYNOPSIS
  INCRANSOM Rapid Triage - 7-day persistence & pre-encryption sweep
.DESCRIPTION
  Enumerates: (1) scheduled tasks created in last 7 days, (2) Volume Shadow Copy
  status/recent deletions, (3) RDP exposure & NLA state, (4) suspicious recently
  created local admins. Run elevated on DCs, file servers, and jump hosts.
#>

$Cutoff = (Get-Date).AddDays(-7)
$Report = [ordered]@{}

Write-Host "=== INCRANSOM Rapid Triage - $(hostname) - $(Get-Date -Format 'u') ===" -ForegroundColor Cyan

# 1. Scheduled tasks created in the last 7 days (common INCRANSOM persistence/staging trigger)
Write-Host "`n[1] Scheduled tasks created since $Cutoff" -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $Cutoff -and
    $_.TaskPath -notlike "\Microsoft*"
} | Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}}
if ($RecentTasks) {
    $RecentTasks | Format-Table -AutoSize
    $Report['SuspiciousTasks'] = $RecentTasks
} else { Write-Host "  None found." -ForegroundColor Green }

# 2. Volume Shadow Copies - ransomware deletes these pre-detonation
Write-Host "`n[2] Volume Shadow Copy status" -ForegroundColor Yellow
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($Shadows) {
    $Shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
} else {
    Write-Host "  WARNING: No shadow copies present. If VSS was expected, treat as potential T1490 (Inhibit System Recovery)." -ForegroundColor Red
    $Report['ShadowCopiesMissing'] = $true
}

# 3. Shadow copy deletion events in System log (Event ID via vssadmin/wmic execution traces)
Write-Host "`n[3] Recent VSS deletion indicators (Security/System logs)" -ForegroundColor Yellow
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,7040; StartTime=$Cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'shadow|vss' }
if ($VssEvents) { $VssEvents | Select-Object TimeCreated, Id, Message | Format-List } else { Write-Host "  None found." -ForegroundColor Green }

# 4. RDP exposure check
Write-Host "`n[4] RDP configuration" -ForegroundColor Yellow
$RdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$NlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
Write-Host "  RDP Enabled: $RdpEnabled | NLA Required: $NlaEnabled"
if ($RdpEnabled -and -not $NlaEnabled) {
    Write-Host "  WARNING: RDP enabled WITHOUT NLA - brute-force exposure (INCRANSOM T1110 vector)." -ForegroundColor Red
    $Report['RdpWithoutNla'] = $true
}
$RdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).PortNumber
Write-Host "  RDP Port: $RdpPort (default 3389 = higher scan exposure)"

# 5. Recently created local admin accounts
Write-Host "`n[5] Local admin accounts created since $Cutoff" -ForegroundColor Yellow
$NewAdmins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
    $u = $_.Name.Split('\')[-1]
    try { Get-LocalUser $u -ErrorAction Stop | Where-Object { $_.PasswordLastSet -gt $Cutoff } | Select-Object Name, Enabled, PasswordLastSet } catch {}
}
if ($NewAdmins) {
    $NewAdmins | Format-Table -AutoSize
    Write-Host "  WARNING: Unexpected new privileged accounts - verify against change tickets." -ForegroundColor Red
    $Report['NewAdminAccounts'] = $NewAdmins
} else { Write-Host "  None found." -ForegroundColor Green }

Write-Host "`n=== Triage complete. Escalate any WARNING findings to IR immediately. ===" -ForegroundColor Cyan

Incident Response Priorities — INCRANSOM Playbook

T-Minus Detection Checklist (Before Encryption Fires)

INCRANSOM's 4–9 day dwell time and 48–72 hour pre-detonation staging window mean these indicators almost always appear before detonation:

1. Unexpected VPN logons at off-hours from accounts that haven't used VPN recently, followed by internal SMB/RDP fan-out (T1133, T1021)
2. New services named PSEXESVC or similar appearing on multiple hosts within a short window (T1569.002)
3. Archive utility execution (7z/rar) on file servers, domain controllers, or database hosts — especially with password flags (T1560.001)
4. RClone, MEGAsync, or cloud sync binaries on servers that have no business running them (T1567.002)
5. vssadmin delete shadows / bcdedit recoveryenabled no anywhere in the estate — treat as imminent detonation (T1490)
6. Unusual outbound volume to cloud storage ASNs or rare external IPs from server VLANs
7. New local admin accounts or scheduled tasks created outside change windows

Critical Assets INCRANSOM Prioritizes for Exfiltration

• File shares containing HR, legal, and financial records — the extortion leverage core
• Email archives / on-prem Exchange stores (relevant to CVE-2023-21529 exposure)
• EHR/patient data repositories for healthcare victims — drives the regulatory pressure angle
• Customer/account databases for financial victims — drives notification obligations
• Backup infrastructure credentials and configurations — targeted to ensure encryption sticks

Containment Actions (Ordered by Urgency)

1. Isolate staging hosts immediately — any host showing archive tooling or shadow copy deletion gets network-quarantined before investigation; minutes matter
2. Disable compromised VPN sessions and force credential reset for all accounts with VPN logons in the past 14 days; revoke active sessions at the gateway
3. Block exfiltration egress at the perimeter for RClone/MEGA/cloud storage endpoints not on the approved list
4. Protect backup infrastructure — isolate backup networks, rotate backup service account credentials, verify offline/immutable copies are intact
5. Hunt laterally from patient zero — do not assume a single foothold; INCRANSOM affiliates typically maintain 2+ access paths
6. Preserve memory and VPN gateway logs before remediation wipes volatile evidence of the initial access vector

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway for CVE-2026-50751 now. If patching is not possible today, disable IKEv1 where feasible and place gateways behind strict management-plane ACLs. This CVE is the highest-probability initial access vector for the current wave.
• Patch ConnectWise ScreenConnect (CVE-2024-1708) across all internal and MSP-managed instances; audit RMM tooling for unauthorized sessions.
• Enforce NLA on all RDP, move RDP behind VPN/ZTNA, and alert on any externally reachable 3389.
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days — victims of this wave may already be inside the dwell window.
• Block execution of rclone.exe, megasync.exe, 7z.exe on servers via AppLocker/WDAC where no legitimate use case exists.
• Alert on any shadow copy deletion as critical severity, no exceptions outside documented backup maintenance windows.

Short-Term (2 Weeks)

• Segment backup infrastructure onto isolated networks with separate credentials and immutable/offline copies; INCRANSOM explicitly targets backup access before detonation.
• Deploy canary shares and honey credentials on file servers to catch pre-encryption enumeration and staging.
• Implement egress filtering with TLS inspection on server VLANs — servers should not reach arbitrary cloud storage endpoints.
• Migrate off legacy VPN concentrators toward ZTNA with device posture checks; perimeter-device exploitation is this group's front door and patching cadence on gateways is measurably the weakest link in this campaign's victim set.
• Establish a leak-site monitoring watch for your organization, subsidiaries, and key suppliers — batch posting behavior means your peers appearing on the site is an early warning that your sector is in the current target rotation.
• Tabletop the double-extortion scenario: legal, comms, and IR should rehearse the decision tree for data-leak threats before a real deadline arrives — INCRANSOM negotiates fast, and slow internal alignment is their leverage.

Analyst Assessment

INCRANSOM's August wave reflects a mature, pipeline-driven operation: perimeter exploitation feeding parallel affiliate intrusions, 4–9 day dwell, then batch publication as negotiation deadlines expire. The 6-victims-in-one-day burst strongly suggests more intrusions from this access wave are still in the dwell window and have not yet been posted. Financial services, healthcare, and professional services organizations with Check Point, ScreenConnect, or on-prem Exchange exposure should operate on an assumption-of-breach footing for the next 14 days and hunt accordingly.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub