INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
Summary: Researchers at Acronis documented INC's rise from a nascent ransomware-as-a-service operation to one of the most prolific groups in 2026, with at least 830 victims claimed since August 2023 and more than 65% of listed victims in the United States. INC's Windows and Linux/ESXi encryptors were rewritten in Rust, its attacks use an updated credential dumper targeting newer Veeam backup deployments using salted DPAPI credential encryption, and its Windows and Linux variants were sold on the cybercrime underground in May 2024, with related families Lynx and Sinobi showing significant code overlap.
Why it matters: INC ranked fourth among ransomware groups in Q1 2026 with over 120 incidents, behind Qilin (338), Akira (197) and The Gentlemen (192), and it concentrates on legal services, manufacturing, construction, technology and health care - sectors where operational downtime creates strong financial pressure to pay and where breaches can expose vendor networks and downstream partners.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·