ransomware

IncRansom

active · last signal 1mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.RaaS: Operator

Ransomware

INC RansomINC RansomwareLynx (assessed rebrand)

Attribution

RaaS (financially motivated, unattributed)

Origin

Unknown

First seen

2023

Last active

2025

Motivation

Financially motivated (ransomware)

Attribution confidence

medium

RaaS role

Operator

MENA targeting

Saudi Arabia, UAE

Sectors

Energy, chemicals, training, logistics, facilities, legal services

Corpus activity · 6mo1 mention

AMJJAS

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia, UAE (Energy, chemicals, training sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

SarcomaactorTechnique overlap
EverestactorTechnique overlap
TrigonaactorTechnique overlap
Hunters InternationalactorTechnique overlap
Cicada3301actorTechnique overlap
BianLianactorTechnique overlap
RhysidaactorTechnique overlap
CactusactorTechnique overlap
DragonForce

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against IncRansom's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

6 / 6

Mean robustness (of covered)

2.2

Known tooling · Ransomware Tool Matrix

Tools observed in intrusions leading to IncRansom's ransomware, per the community Ransomware Tool Matrix — observed use, not exhaustive. Snapshot 2026-08-07.

Discovery · 2

AdFindAdvanced IP Scanner

LOLBAS · 2

FingerPsExec

Exfiltration · 5

BackBlazeMEGAResticRClones5cmd

5 source reports · latest 12 March 2026

Claimed victims · 10 tracked

Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →

Claim volume · last 12 months

Useful?

Date	Victim	Country	Sector
2026-08-18	nyklawfirm.com nyk.ae	UAE	Professional Services
2026-07-29	harwal.net	UAE	—
2026-06-03	Oztugotomotiv	Türkiye	Manufacturing
2026-05-10	lalsgroup.com	UAE	Other
2026-04-13	alupco.com	Saudi Arabia	Manufacturing
2026-03-10	Teknopres_TR	Türkiye	Manufacturing
2026-03-10	Meirc training and consulting	UAE	Professional Services
2026-02-28	http://ramet-trom.co.il/	Israel	Manufacturing
2026-02-15	acwapower.com \ https://www.larsentoubro.com/	Saudi Arabia	Energy & Utilities
2026-02-12	rswater.ae	Saudi Arabia	Agriculture and Food Production