INC Ransomware: Analyzing the RaaS Threat Landscape in 2026

Key Technical Findings

Technical Background

INC ransomware grew into a leading RaaS (830+ victims since August 2023), aided by the disruption of LockBit and BlackCat. Its chain: phishing (T1566) for access, command-line execution (T1059) of payloads, WMI persistence (T1047), credential dumping (T1003) for lateral movement, C2 communication, exfiltration over C2 (T1041) before encryption, and finally file encryption with ransom demands.

Defenses: phishing-aware training, MFA, detection of credential dumping/WMI abuse/suspicious command lines, pre-encryption exfiltration monitoring, offline backups, and segmentation.

Attack Chain Analysis

1. Initial Access

   ActivityPhishing (T1566).

   EvidenceSuspicious emails; unusual logins.

   TelemetryEmail gateway, auth logs.

   Detection opportunityFlag phishing and login anomalies.

2. Credential Access

   ActivityCredential dumping (T1003).

   EvidenceLSASS access.

   TelemetrySysmon EID 10.

   Detection opportunityDetect credential dumping.

3. Persistence

   ActivityWMI persistence (T1047).

   EvidenceWMI subscriptions/processes.

   TelemetrySysmon EID 19-21, WMI logs.

   Detection opportunityDetect WMI persistence.

4. Exfiltration

   ActivityExfiltrate over C2 (T1041) before encryption.

   EvidenceAnomalous outbound transfers.

   TelemetryProxy/firewall.

   Detection opportunityAlert on bulk egress.

Deep Technical Behavior Analysis

The defining behaviors are phishing-led access, credential dumping, WMI persistence, and pre-encryption exfiltration. The strongest defenses are credential-dumping and WMI detection, egress monitoring, offline backups, and segmentation.

Specific INC indicators are not fully specified in the source material and require validation.

Indicators of Compromise

Indicators of Behavior

Behavioral indicators to hunt for even when atomic IoCs are limited (Potential — validate against your baseline).

Detection Engineering Guidance

Defensive detection logic (Potential — tune to your environment). No exploit code is included; logic is for hunting and alerting only.

Sigma ruletitle: LSASS Access
logsource: { product: windows }
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess: ['0x1010','0x1410']
  condition: selection
level: high

Sigma ruletitle: Suspicious Script Host Execution
logsource: { product: windows, category: process_creation }
detection:
  selection:
    Image|endswith: ['\powershell.exe','\wscript.exe','\cscript.exe']
    CommandLine|contains: ['-enc','-nop','DownloadString','FromBase64String']
  condition: selection
level: high

Recommended Log Sources

MITRE ATT&CK Mapping

Incident Response Guidance

• Validate exposure and confirm whether the issue applies to your environment.
• Preserve evidence (memory, disk, relevant logs) before remediation.
• Isolate affected hosts/accounts if compromise is suspected.
• Collect volatile data and review the log sources listed above.
• Hunt for the indicators of behavior and any related atomic indicators.
• Rotate potentially exposed credentials, keys, and session tokens.
• Remove persistence (tasks, services, keys, web shells, cron, OAuth grants).
• Patch affected systems; reimage where integrity cannot be assured.
• Run post-remediation validation and a BAS/security-validation retest.

Remediation and Hardening

• Patch affected systems and reduce internet-exposed services.
• Enforce MFA and least-privilege for privileged and remote access.
• Improve endpoint telemetry (Sysmon/EDR) and PowerShell logging.
• Restrict script execution and constrain LOLBins where feasible.
• Monitor persistence locations and disable unnecessary services.
• Segment critical assets and review privileged accounts.
• Rotate secrets and remove credentials from configuration files.
• Tune SIEM/EDR detections, then validate controls after changes.

Business Risk

• Service disruption: degraded or unavailable systems during compromise or recovery.
• Data exposure: risk to sensitive, regulated, or customer data depending on scope.
• Regulatory exposure: potential breach-notification and compliance obligations.
• Financial impact: incident response, downtime, and potential extortion costs.
• Brand and trust impact: reputational damage with customers and partners.
• Operational continuity: ransomware can halt critical business processes until restored.
• Identity blast radius: compromised accounts can expand access across cloud and SaaS.

Executive Takeaway

Validating Your Defenses with Valitrix

The Valitrix Breach and Attack Simulation (BAS) platform provides an essential layer of protection by continuously validating security controls against real-world threats like INC ransomware. By simulating specific T1566 — Phishing, T1003 — Credential Dumping, and T1059 — Command-Line Interface techniques, organizations can identify potential weaknesses in their defenses before they are exploited by adversaries.

This proactive approach ensures that detection mechanisms are not only in place but are also effective in real-time scenarios. Through continuous testing and simulations, Valitrix empowers security teams to fortify their defenses against evolving threats such as INC ransomware.

Key Takeaways

Frequently Asked Questions