INC Ransom Recovery: What's Recoverable

INC Ransom has been active since July 2023, a ransomware-as-a-service operation with over 200 documented victims in 2025 alone, concentrated in healthcare, government, education and manufacturing — sectors it targets systematically rather than opportunistically.

Entry is typically via compromised credentials, known vulnerabilities (including CVE-2023-3519 in Citrix NetScaler) or phishing. Once inside, it uses Advanced IP Scanner and AdFind for extensive domain reconnaissance, moves laterally via RDP, and exfiltrates data with 7-Zip, WinRAR and MEGA before encrypting — a pattern that indicates the group spends real time mapping an environment before doing damage.

That extensive reconnaissance phase means the actual footprint of an INC Ransom incident is often larger than what's immediately visible — the domain mapping they perform before encrypting suggests they identify high-value targets deliberately, so a recovery assessment needs to account for systems beyond the first ones found encrypted, not just the most obvious ones.