INC Ransomware Explained: How It Attacks Healthcare and Education

Key Takeaways

• INC Ransom is a multi-extortion group active since July 2023, targeting healthcare, industrial, and education organizations across the US and Europe.
• The group relies on living-off-the-land tools like NETSCAN.EXE, AnyDesk, and SystemSettingsAdminFlows.exe for discovery, movement, and defense evasion.
• Defenders are blinded by tampering with Windows Defender settings, a custom av.exe killing EDR processes.
• Windows payloads combine Salsa20, AES, and Curve25519, while Linux and ESXi variants use X25519 ECDH with AES-128 CTR.
• The Picus Platform lets teams simulate INC Ransomware attacks and validate their security controls against real techniques.

INC Ransom is a multi-extortion threat group that first emerged in July 2023, rapidly establishing a reputation for targeting organizations across the healthcare, industrial, and education sectors, predominantly in the United States and Europe [1].

This adversary is characterized by a "living-off-the-land" (LOLBin) approach, heavily relying on legitimate administrative tools such as NETSCAN.EXE, AnyDesk, and SystemSettingsAdminFlows.exe to conduct reconnaissance, move laterally, and impair defenses while evading detection. Initial access vectors vary but frequently involve the exploitation of public-facing vulnerabilities, including CVE-2023-3519 (Citrix NetScaler) and CVE-2023-4966 (Citrix Bleed).

In this blog, we will walk through INC Ransom's full attack chain from initial access to encryption. In the end, we will show how Picus helps you validate your security controls against this ransomware threat.

How Does INC Ransomware Work?

INC ransomware gains initial access through valid accounts or public-facing vulnerabilities, conducts network discovery with native and dual-use tools, disables security controls with legitimate system binaries, harvests credentials and moves laterally, then stages and exfiltrates data before deploying its ransomware payload for double-extortion.

The subsections below break down each stage in order.

Initial Access

Threat actors associated with INC Ransom utilize diverse methods to breach victim environments. Observed techniques include the use of compromised valid accounts to access systems via Remote Desktop Protocol (RDP). Additionally, they exploit known vulnerabilities in public-facing applications, specifically Citrix NetScaler (CVE-2023-3519) and "Citrix Bleed" (CVE-2023-4966), to gain an initial foothold [2].

Discovery and Enumeration

Once access is established, the attackers conduct extensive discovery to map the network and identify high-value targets.

This phase relies heavily on native Windows utilities and dual-use software. Tools such as NETSCAN.EXE and Advanced IP Scanner are deployed to profile the internal network. An example usage would be as follows:

The net command-line utility is used to enumerate domain administrators and groups.

Additionally, nltest.exe and AdFind are utilized for enumeration. Here are the command examples the threat actor might execute:

Defense Evasion

A distinct characteristic of INC Ransom operations is the specific targeting of security software using legitimate system binaries and custom tools.

The group leverages the native SystemSettingsAdminFlows.exe utility to tamper with Windows Defender settings. The following command sequence has been observed [4]:

Additionally, a tool often named av.exe is utilized to terminate Endpoint Detection and Response (EDR) processes, such as CylanceSvc.exe.

For masquerading purposes, the PsExec utility is frequently renamed to winupd [3] to mimic legitimate Windows update processes during execution.

Credential Access and Lateral Movement

To escalate privileges and move across the network, the attackers use a combination of credential dumping and remote execution tools.

The tool lsassy.py has been identified in attack chains, used to extract credentials from remote hosts. The usage example of the command is:

Movement between systems is facilitated by RDP, PuTTY, and AnyDesk [1].

Collection and Exfiltration

Prior to encryption, data is staged and exfiltrated. The attackers use 7-Zip (7.exe) and WinRAR to compress data. Below is an observed command format for 7-Zip staging [3]:

Exfiltration is conducted using cloud storage tools. MEGASync is frequently installed to upload staged data to the cloud. Rclone has also been observed with inclusion lists to target specific data structures [4]:

Encryption and Impact

The ransomware payload is often distributed via rapid copy commands to the C:\Windows\Temp directory on multiple endpoints [3]:

The malware supports several command-line arguments to control its behavior [5]. Here are the most remarkable ones:

• --ens: Encrypt network shares.
• --sup: Stop processes holding file handles.
• --lhd: Local hidden drives (encrypts boot/recovery volumes, potentially rendering the device non-bootable).

Rust-based samples expose a richer operator-configurable argument set. A few of the most important parameters observed are:

• --proc <mask>: Kill processes by mask to unlock files and backups before encrypting.
• --serv <mask>: Kill services by mask, disabling backup and database services.
• --mode <fast|medium|slow>: Select the encryption speed and depth (default is medium).
• --quiet: Encrypt files and restore their original last-write timestamps, leaving no notes or extension, as an anti-forensic pass.

The Windows variant of the ransomware uses a hybrid scheme. It combines symmetric encryption (Salsa20 and AES) with Curve25519 elliptic-curve cryptography.

The Linux/ESXi variant generates a per-thread ephemeral X25519 key pair, performs Elliptic-Curve Diffie-Hellman (ECDH) against a hardcoded attacker X25519 public key, hashes the resulting shared secret with SHA-256, and uses that digest as an AES-128 key in CTR mode to XOR the file contents block by block [6].

The ransomware also attempts to send the ransom note to connected printers and fax machines, physically printing the extortion demand.

The ransom note typically contains a unique personal ID and a Tor onion link for the victim to use when signing into the payment site [5]:

How Picus Simulates INC Ransomware Attacks?

We strongly suggest simulating INC Ransomware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other ransomware variants, such as Warlock, BlackCat, Black Basta, and Akira, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the INC Ransomware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] “INC Ransom.” Accessed: Feb. 04, 2026. [Online]. Available: https://attack.mitre.org/groups/G1032/

[2] “GOLD IONIC Deploys INC Ransomware,” Sophos. Accessed: Feb. 04, 2026. [Online]. Available: https://www.sophos.com/en-gb/blog/gold-ionic-deploys-inc-ransomware

[3] “Investigating New INC Ransom Group Activity,” Huntress. Accessed: Feb. 04, 2026. [Online]. Available: https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity

[4] H. Carvey, “LOLBin to INC Ransomware,” Huntress. Accessed: Feb. 04, 2026. [Online]. Available: https://www.huntress.com/blog/lolbin-to-inc-ransomware

[5] “Inc. Ransom,” SentinelOne. Accessed: Feb. 04, 2026. [Online]. Available: https://www.sentinelone.com/anthology/inc-ransom/

[6] Acronis Threat Research Unit, “From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware,” Acronis. Accessed: Jul. 23, 2026. [Online]. Available: https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware/