INC Ransomware
Attribution profile
- Type
- Criminal
- Location
- United Kingdom
- Known incidents
- 3 incidents
- Sources
- 0 sources
- First seen
- 2024-06-24
- Last seen
- 2025-11-01
- Updated
- 2026-10-13 06:31
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
INC Ransomware, also known as INC Ransomware, is a threat actor observed operating from the United Kingdom. The group has targeted government emergency alert systems, a Hungarian state agency responsible for military and law‑enforcement procurement, and a UK‑based academic publisher. Its activities are financially motivated, as evidenced by ransom demands ranging from $100 000 to $5 million and the use of double‑extortion tactics that involve stealing data before encrypting it and threatening public release. Observed TTPs include deploying ransomware to encrypt files, exfiltrating usernames, phone numbers and outdated passwords, and posting screenshots of stolen credentials to pressure victims. No public attribution to a state sponsor or criminal consortium has been made. Representative operations include the 2025 disruption of Spokane County’s Alert Spokane platform, the 2024 ransomware attack on Hungary’s defence procurement agency, and the 2024 incident affecting Cambridge University Press & Assessment.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 0 sources.