LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1139: INC Ransomware

INC Ransomware is a ransomware strain that has been used by the INC Ransom group since at least 2023 against multiple industry sectors worldwide. INC Ransomware can employ partial encryption combined with multi-threading to speed encryption.[1][2][3]

EnterpriseS1139MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

INC Ransomware is a Windows ransomware strain that MITRE reports has been used by the INC Ransom group since at least 2023 across multiple industry sectors worldwide. Its practical significance is speed and operational disruption: MITRE notes partial encryption combined with multi-threading, which can reduce the time defenders have to contain activity before business data becomes unavailable.

Executive priority

Treat this as a resilience and incident-readiness issue, not only a malware signature problem. Leadership should ask whether Windows endpoints, file shares, recovery mechanisms, and service availability are monitored well enough to catch ransomware staging behaviors before encryption impact. Priority should go to proving backup recoverability, visibility into administrative execution paths such as WMI, and SOC playbooks for service stopping, recovery inhibition, lateral file transfer, and rapid encryption behavior.

Technical view

MITRE does not provide a dedicated detection section for this malware, so defenders should validate coverage through the related ATT&CK behaviors. For Windows environments, focus on WMI execution, process/file/share/storage discovery, lateral tool transfer, service stop activity, attempts to inhibit recovery, internal defacement artifacts, and data encryption for impact. Detection should emphasize behavioral chains rather than single indicators: discovery of processes, files, shares, devices, drivers, or local storage followed by internal file movement, service interruption, recovery-control changes, and high-volume file modification or encryption-like writes.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • WMI activity and remote/local WMI execution logs
  • Service control events showing stop or disable actions
  • File and directory enumeration telemetry
  • Network share and SMB access telemetry

Detection direction

  • Validate that ransomware detections are behavior-based and not limited to known hashes or static malware names.
  • Correlate discovery behaviors with later file transfer, service stop, recovery inhibition, and encryption-impact activity.
  • Tune WMI execution analytics to distinguish routine administration from unusual command execution, remote use, or execution from unexpected accounts or hosts.
  • Review false positives from software deployment, backup, patch management, inventory tools, and legitimate administrative scripts.
  • Confirm visibility on shared drives and file servers, since network share discovery and encryption impact can make endpoint-only telemetry insufficient.

Mitigation priorities

  • Prioritize tested, isolated, and recoverable backups for critical Windows systems and shared data stores.
  • Limit administrative privileges and WMI/remote administration access to authorized users, hosts, and management paths.
  • Segment access to critical file shares and enforce least-privilege permissions to reduce blast radius.
  • Harden and monitor recovery mechanisms so attempts to disable or delete recovery options are visible and actionable.
  • Maintain phishing-resistant user controls and email security processes because MITRE links this malware to phishing behavior.
Additional notes and limits

This take is based only on the supplied MITRE STIX object, external references, and relationships. The object is a malware entry for INC Ransomware with Windows listed as the platform. ATT&CK relationships associate it with execution, discovery, lateral movement, initial access, stealth, and impact techniques, including WMI, phishing, lateral tool transfer, service stop, recovery inhibition, internal defacement, and data encrypted for impact.

MITRE provides no official detection text for this object, and the supplied fields do not include indicators, hashes, commands, filenames, ransom note names, or guaranteed detection logic. Local environment baselines are required to distinguish malicious behavior from legitimate administration, backup, inventory, and software deployment activity.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

INC Ransomware

INC Ransomware is a ransomware strain that has been used by the INC Ransom group since at least 2023 against multiple industry sectors worldwide. INC Ransomware can employ partial encryption combined with multi-threading to speed encryption.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1120Peripheral Device Discovery

INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.[4]

EnterpriseT1570Lateral Tool Transfer

INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.[2]

EnterpriseT1566Phishing

INC Ransomware campaigns have used spearphishing emails for initial access.[1]

EnterpriseT1106Native API

INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.[4]

EnterpriseT1652Device Driver Discovery

INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.[4]

EnterpriseT1490Inhibit System Recovery

INC Ransomware can delete volume shadow copy backups from victim machines.[4]

EnterpriseT1047Windows Management Instrumentation

INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.[2][3]

EnterpriseT1680Local Storage Discovery

INC Ransomware can discover and mount hidden drives to encrypt them.[4]

EnterpriseT1135Network Share Discovery

INC Ransomware has the ability to check for shared network drives to encrypt.[4]

EnterpriseT1486Data Encrypted for Impact

INC Ransomware can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.[1][2][4][5][1]

EnterpriseT1140Deobfuscate/Decode Files or Information

INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.[4]

EnterpriseT1083File and Directory Discovery

INC Ransomware can receive command line arguments to encrypt specific files and directories.[4][1]

EnterpriseT1057Process Discovery

INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.[4]

EnterpriseT1489Service Stop

INC Ransomware can issue a command to kill a process on compromised hosts.[4]

EnterpriseT1491.001Internal DefacementSub-technique

INC Ransomware has the ability to change the background wallpaper image to display the ransom note.[4][3]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1570: Lateral Tool TransferEnterpriseuses · TechniqueT1566: PhishingEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1652: Device Driver DiscoveryEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · GroupG1032: INC RansomEnterpriseuses · TechniqueT1491.001: Internal DefacementEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
3bf8a839a38e906e...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle3bf8a839a38e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  2. [2]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  3. [3]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
  4. [4]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  5. [5]
    SOCRadar INC Ransom January 2024

    SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.

    Open source URL
  6. [6]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  7. [7]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  8. [8]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
  9. [9]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
  10. [10]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  11. [11]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  12. [12]
    mitre-attackS1139
    Open source URL
  13. [13]
    mitre-attackS1139
    Open source URL
  14. [14]
    mitre-attackS1139
    Open source URL
  15. [15]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  16. [16]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  17. [17]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  18. [18]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  19. [19]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  20. [20]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  21. [21]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  22. [22]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  23. [23]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  24. [24]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  25. [25]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  26. [26]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  27. [27]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  28. [28]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
  29. [29]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
  30. [30]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  31. [31]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  32. [32]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  33. [33]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  34. [34]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  35. [35]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  36. [36]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  37. [37]
    Huntress INC Ransom Group August 2023

    Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.

    Open source URL
  38. [38]
    SOCRadar INC Ransom January 2024

    SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.

    Open source URL
  39. [39]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  40. [40]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  41. [41]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  42. [42]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  43. [43]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  44. [44]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  45. [45]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  46. [46]
    SentinelOne INC Ransomware

    SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.

    Open source URL
  47. [47]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  48. [48]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  49. [49]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  50. [50]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
  51. [51]
    Cybereason INC Ransomware November 2023

    Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.

    Open source URL
  52. [52]
    Secureworks GOLD IONIC April 2024

    Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use