Published: 9/25/2026
Written By: Lizzie Danielson
INC is a ransomware operation associated with file encryption, ransom notes, and as seen in some Huntress investigations, data staging or exfiltration before encryption.
Huntress has documented INC-related activity in investigations from 2023, 2024, and in February and September 2026. The observed access paths, tooling, and operator behavior vary by incident, so this profile focuses on documented behaviors rather than presenting a single, fixed INC playbook.
Terms such as “INC ransomware group,” “INC operation,” and “INC-related activity” describe the ransomware name and activity observed in specific investigations. They do not establish that every incident involved the same individuals, infrastructure, or operating model.
Public reporting cited by Huntress places the group's emergence around August 2023. Shortly after, Huntress analysts documented a week-long intrusion involving discovery, data collection, staging, exfiltration, and an attempted deployment of the encryptor, giving defenders an early, detailed look at how an INC incident can unfold from initial access to attempted impact.
Huntress has since observed related activity in 2024, 2025, and 2026, including remote management and monitoring (RMM) software abuse and tampering with security controls. These findings are described as activity "observed by Huntress" in specific investigations. We do not claim that every later incident was carried out by the same individuals; ransomware variants are frequently used by more than one set of operators, and corroborating that is outside the scope of a single incident review.
Huntress investigations have not independently confirmed who is behind INC, and Huntress has identified different access paths and different tooling across INC-related incidents, making the case against treating INC as a single actor with one fixed method of operation.
Third-party reporting offers more specific attribution than Huntress' incident data does on its own. Fortra has reported that INC ransomware is operated by an anonymous, Russia-linked cybercriminal group tracked as INC Ransom (also identified as Gold Ionic or Tarnished Scorpion), operating on a Ransomware-as-a-Service (RaaS) model.
As with many ransomware operations, an INC incident can involve several distinct participants regardless of the operator's identity: an initial access broker who sells or provides entry into a network, an affiliate who conducts the intrusion, and an operator who deploys the encryption payload. These roles may or may not be filled by the same people from one incident to the next, even under a RaaS model.
The September 2026 incident Huntress investigated featured a 17-day lull between initial access and deployment of the ransomware and note, which could indicate the use of an initial access broker.
INC-related intrusions can involve different access paths and tools. The following stages summarize behaviors observed across specific investigations; they are not requirements for every INC-related intrusion.
Huntress has observed valid-account abuse and Remote Desktop Protocol (RDP) activity in different investigations, along with RMM activity in certain cases.
However, the initial access vector could not always be determined because visibility began after the intrusion or was incomplete. The available evidence does not support identifying phishing, a specific vulnerability, RDP, or RMM software as the definitive INC access method.
In the 2023 incident Huntress investigated, the operator performed domain and network discovery, enumerated domain administrator accounts, accessed multiple systems, and interacted with file shares.
Observed remote-administration and lateral-movement activity included RDP, Windows Management Instrumentation (WMI), PsExec, and remote service activity. These tools have legitimate administrative uses, so defenders should evaluate the account, host, parent process, timing, destination, and whether the activity matches an approved workflow.
In the September 2026 incident, the threat actor leveraged scheduled tasks pointing to PowerShell scripts for lateral movement and persistence.
A 2024 investigation documented activity involving changes to Windows Defender and attempts to interfere with other security controls.
The investigation observed SystemSettingsAdminFlows.exe alongside Windows Defender event ID 5007, which records configuration changes. This is an incident-specific detection lead, not a universal signature for INC activity.
In the September 2026 incident, the threat actor installed the AnyDesk remote desktop application to deploy netscan.exe and a vulnerable driver. Bring Your Own Vulnerable Driver (BYOVD) is a common tactic where attackers load a legitimate but vulnerable driver to gain kernel-level access, usually to disable security tools before further compromise.
Investigations documented data collection, archive creation, staging, and activity involving file-transfer or cloud-storage tools.
Observed tools included:
These tools have legitimate business uses. Detection should consider which account ran the tool, which process launched it, whether the activity was expected, where data was staged, and whether data was transferred to an approved destination.
In a February 2026 investigation, Huntress observed Restic-based data staging and activity associated with cloud-storage infrastructure. This finding describes that investigation and should not be treated as a required technique in every INC-related intrusion.
In the 2023 incident Huntress investigated, the encryptor was copied and executed remotely using WMI and PsExec.
In February 2026, Huntress observed an INC executable launched from C:\perflogs\win.exe with the switches --sup --hide --mode medium.
In September 2026, Huntress observed attackers using Impacket’s atexec.py remote execution utility to remotely execute tools on multiple endpoints by creating and running temporary scheduled tasks. The tasks were used to install the EDR/AV killer driver and launch INC ransomware.
Payload names, paths, hashes, and command-line arguments can vary between investigations. These indicators should be correlated with behavior rather than treated as permanent identifiers of INC activity.
INC ransom notes have threatened publication of stolen data. Huntress investigations documented ransom notes including INC-README.txt, DATALEAK_PRESS_RELEASE.txt, and related .inc note filenames.
These note patterns are documented examples, not requirements for every INC-related incident. Leak-site listings and threat-actor claims should be treated as unverified unless corroborated by an authoritative source.
INC-related activity affects organizations across different industries and environments. Rather than naming specific victims, this profile describes targeting and tradecraft at a sector level unless a victim has been publicly named by an authoritative source. Where a Huntress internal incident is referenced, the organization is anonymized and the focus stays on the tradecraft observed.
It's also worth noting that leak-site listings are claims made by the threat actor, not verified confirmations of a breach. Treat them as a starting point for research, not as established fact.
Ransom demands and payment outcomes can vary by victim, sector, and incident. Paying a ransom does not guarantee file recovery or deletion of stolen data.
Organizations experiencing a ransomware incident should involve appropriate incident-response, legal, insurance, and law-enforcement resources.
Huntress investigations documented the following characteristics in specific INC-related samples and incidents.
The encryptor targets files on affected systems, making them inaccessible until they are restored or decrypted.
The 2023 investigation documented:
.inc as an encrypted-file extensionINC-README.txtIn a 2026 investigation, Huntress researchers found two INC ransom notes on the victim organization’s impacted systems. The second note, DATALEAK_PRESS_RELEASE.txt, appeared to be an attempt to place further pressure on the victim.
These indicators should be scoped to the relevant investigation and should not be treated as immutable signatures.
Investigations observed payloads executed from operational or temporary locations, including:
C:\perflogs\win.exeC:\Users\win.exeC:\ProgramData\w.exeC:\Users\Public \ hwau.exe
Paths and filenames can change between incidents.
One observed sample used the following switches:
--hide--sup--mode medium
These switches were associated with a specific sample and should not be treated as stable identifiers across all INC-related activity.
A February 2026 investigation noted apparent use of the Restart Manager API. This behavior may allow a process to release file locks so encryption can proceed against files that are otherwise in use.
Hashes, filenames, paths, command-line arguments, supporting tools, and infrastructure can vary between incidents.
The presence of an INC ransom note or file extension does not independently establish that the same operator conducted the preceding intrusion. Malware identity and operator identity are separate questions.
The table below summarizes behaviors documented in specific investigations.
Tactic | Observed behavior | Example | Defensive takeaway |
Initial Access | Valid-account abuse and remote-access activity | Compromised accounts and RDP activity | Require MFA for remote access and privileged accounts; investigate unusual logins |
Execution | Command shell, PowerShell, WMI, or remote administration | Remote command execution | Review unusual scripting and WMI activity outside approved workflows |
Persistence | Services or scheduled tasks where supported by incident evidence | Attacker-created services or scheduled tasks | Review new services and scheduled tasks against an established baseline |
Defense Evasion | Security-tool configuration changes or removal attempts | Windows Defender configuration changes | Alert on unexpected security-control changes and product removal |
Discovery | Domain, account, network, and share enumeration | Domain administrator discovery | Investigate sequences of discovery commands across hosts |
Lateral Movement | RDP, WMI, PsExec, and remote service activity | Movement between multiple systems | Restrict remote administration to approved users, hosts, and workflows |
Collection | File collection and archive creation | 7-Zip archive activity | Review archive utilities used outside normal workflows |
Exfiltration | Staging and file-transfer activity | MEGAsync, rclone, Restic, or cloud-storage activity | Monitor unsanctioned transfer destinations and unusual outbound data movement |
Impact | Data encrypted for impact |
| Maintain tested, offline, or immutable backups |
Category | Indicator | Source incident |
Ransom-note name | INC-README.txt | 2023 and 2026 investigations |
Encrypted-file extension | .inc | 2023 investigation |
Execution path | C:\perflogs\win.exe | February 2026 investigation |
Execution path | C:\Users\win.exe | Specific approved investigation |
Execution path | C:\ProgramData\w.exe | Specific approved investigation |
Filename | ttt.exe | Specific approved investigation |
Filename | win.exe | Specific approved investigation |
Behavioral signal | Windows Defender configuration changes | 2024 investigation |
Behavioral signal | Security-product removal attempts | February 2026 investigation |
Behavioral signal | Unusual RDP, WMI, or PsExec activity | 2023 investigation |
Behavioral signal | Unexpected RMM installation or use | 2024 investigation |
Second ransom note name | DATALEAK_PRESS_RELEASE.txt | September 2026 investigation |
Obfuscated PowerShell implant referenced by an early scheduled task | C:\ProgramData\Vendettister\jocularities.ps1 | September 2026 investigation |
Domain contacted by the obfuscated PowerShell implant | throughoutes[.]net | September 2026 investigation |
Command-and-control IP associated with the observed AnyDesk installation | 213.111.185[.]108 | September 2026 investigation |
EDR/AV killer component found in C:\Users\Public\ on a domain controller | hwau.exe | September 2026 investigation |
Renamed Vicarius vRx executable, observed in C:\Program Files\7-Zip\ | HealthUpdater.exe | September 2026 investigation |
Driver loaded by the HwAudio kernel-driver service | HWAuidoOs2Ec.sys | September 2026 investigation |
Kernel-driver service used to load the EDR/AV killer driver | HwAudio | September 2026 investigation |
The impact of an INC-related incident can include:
Response should follow the evidence identified in the intrusion.
Isolate affected systems and preserve relevant evidence before making changes that could destroy forensic information.
Disable or restrict compromised accounts and rotate affected credentials according to the incident-response plan.
Audit RDP, VPN, RMM, WMI, PsExec, services, and scheduled tasks for unexplained activity.
Re-enable or reinstall security tools after containment, following the organization’s incident-response procedures and product-specific guidance.
Search the environment for related accounts, tools, paths, hashes, command-line patterns, scheduled tasks, services, and network destinations.
Confirm that backups are clean and usable before restoring systems. Rebuild compromised systems where appropriate.
Consider engaging law enforcement, legal counsel, cyber insurance, external incident responders, and relevant technology providers.
Early endpoint visibility, centralized logging, and analyst review can help organizations investigate activity before encryption occurs. These capabilities do not guarantee prevention, containment, recovery, decryption, or deletion of stolen data.
Huntress has documented INC-related activity as recently as September 2026.
These observations demonstrate recent activity associated with the INC ransomware name, but they do not prove that one group has operated continuously since 2023 or that every incident involved the same operators.
Defenders should focus on behaviors observed in the relevant investigations, including:
Organizations should consider the following controls:
Ransomware is a type of malware that cuts off your access to computers, systems, or networks. Watch the video from our Security Operations Center (SOC) for a breakdown of the ransomware attack path, so you can spot it early, shut it down, and steer clear of hacker paydays.
By the time you see the ransom note, the attack's been underway for hours, sometimes days. The encryption is the last step, not the first. If you only react when files lock up, you've already lost the part that mattered.
INC is a ransomware operation associated with file encryption and extortion. Huntress-observed cases have included data staging or exfiltration before encryption in some incidents.
Observed access paths vary by incident. Huntress has documented valid-account abuse, RDP activity, and RMM activity, but the initial access vector could not always be determined because visibility began after the intrusion or was incomplete.
Potential warning signs include:
.inc extensionNo single indicator is conclusive on its own.
There is no blanket answer. Recovery depends on the specific sample, available backups, whether a decryptor exists, and the circumstances of the incident.
Paying a ransom does not guarantee file recovery or deletion of stolen data.
Huntress has documented INC-related activity as recently as September 2026. This confirms recent activity associated with the INC ransomware name but does not establish continuous operation by one group or identical operators across all incidents.
