Group profile34 claimed in last 30d55 total tracked

incransom

Forward this

INC Ransom is running at an unusually high tempo right now, claiming 32 victims in the past 30 days alone out of 40 total recorded on the tracker, with U.S.-based business services firms absorbing the heaviest share of recent hits (12 claims) followed by manufacturing and healthcare. The geographic concentration is tight: 24 of the last 40 claimed victims are in the United States, with scattered hits in Romania, Spain, Taiwan, and Turkey suggesting opportunistic rather than regionally curated targeting. Described externally as a ransomware-as-a-service operation active since mid-2023, INC Ransom is known to exfiltrate data before encryption and publish it to a leak site as leverage, a double-extortion model that has been documented across its claimed victim set. Technically, the group has been associated with living-off-the-land techniques, abusing legitimate remote management tools to move laterally through networks before deploying its encryptor, which reduces its visibility against standard detection. The current spike in claims, with law firms, a healthcare provider, a financial services firm, and a crop science company all appearing within a single week, points to broad, sector-agnostic targeting driven by access availability rather than vertical specialization.

Brief by The Nexus · Jun 27 · 15:01 UTC

INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

First seen: May 18 · 01:00 UTCLast seen: Jul 6 · 23:59 UTC

Sectors hit

Business Services15
Unspecified9
Healthcare7
Technology6
Manufacturing6
Public Sector3
Financial Services2
Consumer Services2

Countries hit

United States31
Brazil4
Romania2
United Kingdom2
Spain2
Germany2
Taiwan1
Türkiye1
Singapore1
Mexico1

Recent claimed victims

HealthcareUnited StatesJul 7 · 19:56 UTC

Aesthetic Surgical Images

tecnocurva.com.br

samberger24.de

oakparkmi.gov

tambasa.com

tricountyhs.org

acworth-ga.gov

carvalima.com.br

ezortea.com.br

hamilton-eye.com

Colorado Rehabilitation and Occupational Medicine

https://www.roundshield.com/

horizoneye.com

https://sza.it/

GDN AR(Dorinka)

callhorton.com

johndufourlaw.com

theswansonlawgroup.com

Life Bridges

GSP Crop Science Pvt

horizoneye.com

belpointeasset.com \ belpointe.com

jktornel

Newspaper Media Group

Horizon Family Medical Group

neuwoges.de

jasperplastics.info

framesiprofessional.com

smithassociatescpa.com

Kewaunee Scientific

Signazon_USA

DISCOLABINDU

fineconsulting

FIZA

kelmreuter.com

obrieneng.com

Stuga Machinery

pdcbodynits

CUSTOMSIGN

Colina Financial Advisors

Oztugotomotiv

trrac.net

Bradley law firm

Champaign-Urbana Public Health District

www.labexpress.com

belimed.com

lawants

Distrigaz Vest S.A.

PILLER AIMMCO

Open Door Health Center

Meirc training and consulting

Mecanizados y Montajes Aeronáuticos (mymgroup.es)

threadinnovations

Nothing

bergen1.net