S1139: INC Ransomware
INC Ransomware is a ransomware strain that has been used by the INC Ransom group since at least 2023 against multiple industry sectors worldwide. INC Ransomware can employ partial encryption combined with multi-threading to speed encryption.[1][2][3]
Security context for executives and security teams
S1139: INC Ransomware describes [INC Ransomware](https://attack.mitre.org/software/S1139) is a ransomware strain that has been used by the [INC Ransom](https://attack.mitre.org/groups/G1032) group since at least 2023 against multiple industry sectors worldwide. [INC Ransomware](https://attack.mitre.org/software/S1139) can employ partial encryption combined with multi-threading to speed encryption.(Citation: SentinelOne INC Ransomware)(Citation: Huntress INC Ransom Group August 2023)(Citation: Secureworks GOLD IONIC April 2024)
Executive priority
S1139: INC Ransomware is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1139: INC Ransomware by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1139: INC Ransomware appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
INC Ransomware
INC Ransomware is a ransomware strain that has been used by the INC Ransom group since at least 2023 against multiple industry sectors worldwide. INC Ransomware can employ partial encryption combined with multi-threading to speed encryption.[1][2][3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1570 | Lateral Tool Transfer | INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.[2] |
| Enterprise | T1566 | Phishing | INC Ransomware campaigns have used spearphishing emails for initial access.[1] |
| Enterprise | T1047 | Windows Management Instrumentation | INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.[2][3] |
| Enterprise | T1490 | Inhibit System Recovery | INC Ransomware can delete volume shadow copy backups from victim machines.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1120 | Peripheral Device Discovery | INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1106 | Native API | INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1652 | Device Driver Discovery | INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1680 | Local Storage Discovery | INC Ransomware can discover and mount hidden drives to encrypt them.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1135 | Network Share Discovery | INC Ransomware has the ability to check for shared network drives to encrypt.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1486 | Data Encrypted for Impact | INC Ransomware can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.[1][2]CitationCybereason INC Ransomware November 2023CitationSOCRadar INC Ransom January 2024[1] |
| Enterprise | T1083 | File and Directory Discovery | INC Ransomware can receive command line arguments to encrypt specific files and directories.CitationCybereason INC Ransomware November 2023[1] |
| Enterprise | T1057 | Process Discovery | INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1489 | Service Stop | INC Ransomware can issue a command to kill a process on compromised hosts.CitationCybereason INC Ransomware November 2023 |
| Enterprise | T1491.001 | Internal DefacementSub-technique | INC Ransomware has the ability to change the background wallpaper image to display the ransom note.CitationCybereason INC Ransomware November 2023[3] |
Groups, software, and campaigns
G1032: INC Ransom
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.[1][2][3][4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | 3bf8a839a38e… | ||
| 19.1 | 1.0 | Older bundle | 3bf8a839a38e… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]SentinelOne INC Ransomware
SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.
Open source URL - [2]Huntress INC Ransom Group August 2023
Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.
Open source URL - [3]Secureworks GOLD IONIC April 2024
Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.
Open source URL - [4]mitre-attackS1139Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.