Ministry of Health

Summary

The INC ransomware group has targeted healthcare organizations across Oceania, gaining initial access through compromised credentials purchased from brokers, spear‑phishing, and exploitation of exposed vulnerabilities, then moving laterally, escalating privileges, deploying ransomware, and exfiltrating personal and health data. In Tonga the group attacked the Ministry of Health, disrupting its information and communications networks and shutting down core national health services. Similar incidents have been reported in Australia and New Zealand, where the group encrypted servers, stole data, and published it on leak sites, prompting a joint advisory from the Australian Cyber Security Centre, Tonga’s CERT, and New Zealand’s National Cyber Security Centre that identified an affiliate known as “blackod” as the perpetrator of the Tonga intrusion.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

INC ransomware group initially focused its operations in the United States and the United Kingdom. Around the summer of 2024 the group began targeting Australian companies in the professional services and healthcare sectors. Activity increased throughout 2025 and spread to neighboring New Zealand and Tonga. In May 2025 INC compromised a healthcare organization in New Zealand, exfiltrating a large volume of data and encrypting servers and endpoint devices before publishing the stolen information on its dark‑web leak site. On June 15, 2025 INC directed its attack at the Kingdom of Tonga's Ministry of Health, bypassing individual health facilities and targeting the ministry’s information and communications networks directly. The intrusion gave the attackers initial access, after which they moved laterally inside the ministry’s networks, escalated privileges to administrator level, deployed a ransomware locker and left a ransom note. During the operation the attackers also exfiltrated personally identifying information and protected health information using legitimate compression and data‑transfer tools.

The encryption and disruption of the Ministry of Health’s information and communications networks effectively shut down core national health services in Tonga. The outage prevented normal operation of health‑related information systems, affecting the ability to coordinate patient care across the country. Because Tonga relies on a centralized, resource‑constrained health infrastructure, the interruption had a disproportionate impact relative to the size of the nation. No specific figures on the number of patients affected or duration of the outage are provided in the source material. The attack contributed to the broader pattern of INC ransomware activity observed by Oceania cybersecurity authorities, who noted eleven incidents in Australia between July 2024 and December 2025 that primarily involved healthcare or professional services victims.

On March 6, 2026 the Australian Cyber Security Centre, the Kingdom of Tonga's National Computer Emergency Response Team, and New Zealand's National Cyber Security Centre issued a joint advisory concerning INC’s targeting of critical networks in the Oceania region. The advisory highlighted the group’s use of compromised credentials purchased from initial access brokers, occasional spear‑phishing, and exploitation of known vulnerabilities in internet‑facing devices. As part of the investigative follow‑up, authorities identified a specific individual behind the Tonga Ministry of Health attack, naming Roman Khubov, known online as “blackod”, and released a photograph of his face. No further details about the attacker’s affiliation, motive, or subsequent legal proceedings are disclosed in the available sources. The joint advisory also noted that INC’s tactics, techniques, and procedures varied according to the affiliate conducting each attack due to its ransomware‑as‑a‑service model.

Sources

Sources available to members: 1 source.