INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023

INC Ransomware has become a major Ransomware-as-a-Service (RaaS) threat by targeting public-facing application vulnerabilities and extracting credentials stored in Veeam backup solutions — a critical misstep that turns recovery tools into attack vectors. The group's ability to rewrite encryptors in Rust for both Windows and Linux/ESXi environments demonstrates technical sophistication that bypasses many legacy defenses. With over 830 victims since 2023 and spawning related families like Lynx and Sinobi, INC illustrates how a single well-resourced RaaS operation can multiply its impact across the ecosystem. Organizations that fail to patch internet-facing applications promptly and secure backup infrastructure credentials are disproportionately exposed to this type of double-extortion ransomware campaign.