Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
INC Ransom is a double-extortion ransomware-as-a-service operation active since 2023; researchers assess the Lynx ransomware (from mid-2024) to be a direct rebrand of INC based on very high code similarity.
INC Ransom emerged in 2023 as a RaaS running double-extortion attacks across healthcare, government, manufacturing and other sectors, exfiltrating data and threatening leak-site publication. In mid-2024, Lynx ransomware appeared and was assessed by Unit 42 and others as a direct rebrand of INC, with over 90% code similarity; Lynx amassed hundreds of victims through 2025. The INC/Lynx lineage illustrates the common ransomware pattern of rebranding to shed law-enforcement and reputational attention while retaining tooling.
Activity attributed to the INC/Lynx lineage continued through 2025 across manufacturing, legal, energy and other sectors, with aggressive double-extortion pressure.
INC Ransom has claimed victims in Saudi Arabia and the UAE among its listings. These are extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.
Tools observed in intrusions leading to IncRansom's ransomware, per the community Ransomware Tool Matrix — observed use, not exhaustive. Snapshot 2026-08-07.
Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →
| Date | Victim | Country | Sector |
|---|---|---|---|
| 2026-08-08 | Louisville Bar Association | US | Professional Services |
| 2026-08-07 | ATMS | IN | Transportation |
| 2026-08-05 | vprj.org | US | — |
| 2026-08-04 | lantisnet.com | US | Technology |
| 2026-08-04 | https://geleximco.vn/ | VN | Manufacturing |
| 2026-08-04 | lccgroup.com | PH | Professional Services |
| 2026-08-04 | pushidrosal.id | ID | Other |
| 2026-08-04 | TRULITE GLASS & ALUMINUM SOLUTIONS | US | Manufacturing |
| 2026-08-03 | clintonhealthaccess.org | US | Healthcare |
| 2026-08-02 | ecfa.org | US | Professional Services |
| 2026-08-01 | quantinuum.com | US | Technology |
| 2026-07-31 | Oleoductos del Valle | AR | Energy & Utilities |