Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
INC Ransomware Uses LOLBins, RMM Tools, and rclone for Network Intrusion and Data Exfiltration
Malware Families
Excerpt
The cybersecurity landscape faces a growing threat from INC ransomware, a highly active Ransomware-as-a-Service (RaaS) group that has claimed over 800 victims globally since its emergence in mid-2023. Known for its aggressive double-extortion tactics, INC primarily targets high-profile organizations in the United States, specifically focusing on the legal, manufacturing, technology, and healthcare sectors. The group’s rapid evolution has recently culminated in…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-5777 | High | Score 67/100 | First seen |
| CVE | CVE-2023-48788 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-3519 | High | Score 63/100 | First seen |
| MD5 | 766df58af7b444d8fcfd934a6e37d164 | Medium | Score 53/100 | First seen |
| MD5 | 4328615e2e4c50febd4b740c5c734a3b | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…