The INC ransomware group has targeted healthcare facilities across Oceania (Australia, New Zealand, Tonga), using phishing for access and encrypting critical files while exfiltrating patient data for extortion.
Healthcare facilities in Oceania and their patient data.
Healthcare ransomware disrupts patient care and exposes sensitive data, with safety and trust consequences.
- Harden against phishing and patch internet-facing systems.
- Maintain offline, tested backups and clinical-downtime procedures.
- Detect pre-encryption exfiltration via egress monitoring.
- Segment clinical networks and enforce MFA.
Key Technical Findings
Ransomware campaign (INC) targeting healthcare.
Healthcare IT systems across Oceania.
Phishing emails with malicious attachments (T1203).
Payloads executed from malicious attachments.
Techniques to maintain persistence (specifics not specified in the source material).
Not specified in the source material.
Techniques to evade detection (not detailed in the source material).
Not specified in the source material.
Not specified in the source material.
Patient data held/exfiltrated for extortion.
High – data encrypted for impact (T1486).
Technical Background
INC ransomware typically begins with phishing carrying malicious attachments (T1203), establishes a foothold, and proceeds to encrypt critical files (T1486) while using application-layer protocols for C2 (T1071). The group has repeatedly targeted Oceania healthcare facilities, holding patient data hostage.
The healthcare context elevates impact to patient safety. Defenses prioritize phishing resistance, backups, egress detection of exfiltration, and segmentation of clinical systems.
Attack Chain Analysis
-
Initial Access
ActivityPhish with malicious attachments (T1203).
EvidenceMalicious attachments in mail.
TelemetryEmail gateway, EDR.
Detection opportunityAnalyze attachments for malicious signatures.
-
Command and Control
ActivityCommunicate over application-layer protocols (T1071).
EvidenceUnusual outbound connections.
TelemetryProxy/DNS.
Detection opportunityMonitor for anomalous C2.
-
Exfiltration
ActivityExfiltrate patient data for extortion.
EvidenceEgress anomalies pre-encryption.
TelemetryProxy/firewall, DLP.
Detection opportunityDetect bulk outbound transfers.
-
Impact
ActivityEncrypt files and demand ransom (T1486).
EvidenceMass encryption; ransom notes.
TelemetryEDR/FIM.
Detection opportunityAlert on rapid mass file changes.
Deep Technical Behavior Analysis
The defining behaviors are phishing-based access and pre-encryption data theft for double extortion. Detecting the exfiltration phase and maintaining tested backups are the most effective ways to prevent both data loss and care disruption.
Specific INC indicators and persistence details are not specified in the source material and require validation.
Indicators of Compromise
Indicators of Behavior
Behavioral indicators to hunt for even when atomic IoCs are limited (Potential — validate against your baseline).
| Behavioral Indicator | Description | Data Source | Confidence |
|---|---|---|---|
| Anomalous PowerShell execution | Encoded/obfuscated commands, download cradles, or unusual parent-child process lineage. | Sysmon EID 1, PowerShell 4104 | Potential |
| Suspicious child process lineage | Office or web/service processes spawning script hosts or shells. | Sysmon EID 1, EDR | Potential |
| Security log clearing | Event log cleared or audit policy changed to hinder visibility. | Windows Security 1102, 4719 | Potential |
| New service / scheduled task creation | Unexpected persistence via services or tasks. | Security 7045, 4698; Sysmon | Potential |
| Beaconing to rare destinations | Periodic outbound connections to newly-seen domains/IPs or direct-IP C2. | Proxy, firewall, DNS logs | Potential |
| Unusual DNS queries | High-entropy or rare domains; possible tunneling. | DNS resolver logs | Potential |
| Authentication anomalies | Spraying/stuffing, impossible travel, or MFA fatigue patterns. | IdP/VPN logs, Azure AD/Okta sign-ins | Potential |
Detection Engineering Guidance
Defensive detection logic (Potential — tune to your environment). No exploit code is included; logic is for hunting and alerting only.
pseudo: periodic outbound (low jitter) to newly-seen domain/IP
with small uniform payloads => alert(level=medium)pseudo (SIEM): count(file.action in [rename,modify] by host) over 1m > 200
and file.extension changes to uncommon/random => alert(level=critical)Recommended Log Sources
| Platform | Log Source | What to Look For | Priority |
|---|---|---|---|
| Windows | Security Event Log | Logon (4624/4625), service (7045), task (4698), log clear (1102) | High |
| Windows | Sysmon | Process creation (1), network (3), image load (7), LSASS access (10) | High |
| Windows | PowerShell Operational | Script block logging (4104), module logging | High |
| Endpoint | EDR / Defender telemetry | Process tree, persistence, tamper attempts | High |
| Identity | IdP / VPN logs | Impossible travel, spraying, MFA fatigue | High |
| Network | DNS resolver logs | Rare/high-entropy domains, tunneling | Medium |
| Network | Proxy / firewall logs | Beaconing, direct-IP C2, exfil volume | High |
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Relevance | Detection Opportunity | Confidence |
|---|---|---|---|---|---|
| C2 Communication | T1071 | Application Layer Protocol | Utilizes legitimate application layer protocols for command and control communication. | Monitor network traffic for unusual outbound connections. | Reported |
| Impact | T1486 | Data Encrypted for Impact | Encrypts critical files to render them inaccessible until a ransom is paid. | File system changes and unauthorized encryption patterns may indicate compromise. | Reported |
| Initial Access | T1203 | Exploitation for Client Execution | Phishing emails with malicious attachments serve as common entry points. | Email filtering solutions should analyze attachments for known malicious signatures. | Reported |
Incident Response Guidance
- Validate exposure and confirm whether the issue applies to your environment.
- Preserve evidence (memory, disk, relevant logs) before remediation.
- Isolate affected hosts/accounts if compromise is suspected.
- Collect volatile data and review the log sources listed above.
- Hunt for the indicators of behavior and any related atomic indicators.
- Rotate potentially exposed credentials, keys, and session tokens.
- Remove persistence (tasks, services, keys, web shells, cron, OAuth grants).
- Patch affected systems; reimage where integrity cannot be assured.
- Run post-remediation validation and a BAS/security-validation retest.
Remediation and Hardening
- Patch affected systems and reduce internet-exposed services.
- Enforce MFA and least-privilege for privileged and remote access.
- Improve endpoint telemetry (Sysmon/EDR) and PowerShell logging.
- Restrict script execution and constrain LOLBins where feasible.
- Monitor persistence locations and disable unnecessary services.
- Segment critical assets and review privileged accounts.
- Rotate secrets and remove credentials from configuration files.
- Tune SIEM/EDR detections, then validate controls after changes.
Business Risk
- Service disruption: degraded or unavailable systems during compromise or recovery.
- Data exposure: risk to sensitive, regulated, or customer data depending on scope.
- Regulatory exposure: potential breach-notification and compliance obligations.
- Financial impact: incident response, downtime, and potential extortion costs.
- Brand and trust impact: reputational damage with customers and partners.
- Operational continuity: ransomware can halt critical business processes until restored.
- Identity blast radius: compromised accounts can expand access across cloud and SaaS.
Executive Takeaway
What leadership needs to know: Healthcare ransomware disrupts patient care and exposes sensitive data, with safety and trust consequences. Current assessed risk: High.
Prioritise: patching/exposure reduction, identity hardening (MFA, least privilege), and detection coverage for the techniques above.
Validate after remediation: re-test controls with breach & attack simulation to confirm the relevant techniques are now prevented or detected.
Validating Your Defenses with Valitrix
The Valitrix Breach and Attack Simulation (BAS) platform offers an innovative approach to validating security controls against real-world adversary techniques. By safely emulating specific tactics employed by the INC ransomware group, Valitrix allows organizations to assess their detection and prevention capabilities in a controlled environment.
This proactive validation enables security teams to identify gaps in their defenses, adjust their incident response strategies accordingly, and ensure that critical systems are adequately protected against evolving threats such as ransomware. Continuous security validation is essential for maintaining resilience in the face of persistent adversaries.
Key Takeaways
- The INC ransomware group is actively targeting healthcare facilities in Oceania.
- A deep understanding of their tactics is crucial for implementing effective defenses.
- Adopting robust security measures can significantly reduce the risk of ransomware attacks.
- Regular staff training and advanced detection capabilities are essential components of a comprehensive cybersecurity strategy.
Frequently Asked Questions
What should I do if my organization is attacked by ransomware?
First, disconnect compromised systems from the network to prevent further spread. Assess the situation, report the incident to authorities, and consider engaging cybersecurity experts for recovery and investigation.
How can we prevent ransomware attacks?
Implement strong security protocols, conduct regular software updates, train employees on phishing awareness, and maintain up-to-date backups to significantly reduce the risk of successful attacks.
What are the signs of a ransomware infection?
Common signs include unexplained file encryption, ransom notes appearing on screens, and unusual system performance issues. Monitoring network traffic can also aid in early detection.
