[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f49jC7kMuIFH_tzwiXKp7r9B50la06VS7gJp1oBv6dzg":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"ab26bc48-3110-4d08-8dd2-7d49c69fda5d","INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023","inc-ransomware-emerges-as-major-raas-threat-in-2026-with-830-victims-since-2023-913690","Cybersecurity researchers have charted the evolution of INC from an nascent ransomware-as-a-service (RaaS) operation to one of the most prolific cybercrime groups in 2026, claiming no less than 830 victims since August 2023. \"The disruption of LockBit and the shutdown of BlackCat created opportunities for INC to expand as affiliates migrated to alternative ransomware operations,\" Acronis","INC Ransomware has rapidly evolved into a significant RaaS threat, impacting over 830 organizations since August 2023, with US entities being the primary targets. The group leverages rewritten Rust-based encryptors for Windows and Linux\u002FESXi, and exploits vulnerabilities in public-facing applications for initial access, alongside credential dumping from Veeam backups. The emergence of related families like Lynx and Sinobi, sharing significant code overlap, indicates INC's growing influence in the RaaS ecosystem.","INC Ransomware has become a major RaaS threat, claiming over 830 victims since August 2023.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Finc-ransomware-claims-830-victims-since.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh2MOms1DiyvYE-L_zXvrgrL_4cDaNBZwrhVFPq7ee58uPMORAF9v60xW8_QZbjJ05C34E2F5u9xKXBal4_DbVvUjcg8aDAvQ9iKSgWss6vnvlk4f1tgLYwb3a5xNc6T3lbGeE1pcTf35vf320No6XzS4mkw_5dTTILKfc0w6VpcTHX5VitEodFJBKMWzjA\u002Fs1600\u002Fransomware-malware.jpg","2026-06-18T14:12:48+00:00","2026-06-18T16:00:08.451004+00:00",8,[17,20,22,25],{"name":18,"type":19},"Acronis","vendor",{"name":21,"type":19},"Veeam",{"name":23,"type":24},"LockBit","product",{"name":26,"type":24},"BlackCat","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":27,"icon":29,"name":30,"slug":31},null,"Ransomware","ransomware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,57,59],{"type":52,"value":53,"context":54},"cve","CVE-2023-3519","Exploited for initial access by INC ransomware",{"type":52,"value":56,"context":54},"CVE-2025-5777",{"type":52,"value":58,"context":54},"CVE-2023-48788",{"type":52,"value":60,"context":54},"CVE-2024-57727",[18,21,23],{"controls":63,"vendors":149},[64,92,120],{"slug":65,"name":66,"problem":67,"products":68},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":65,"product_name":89,"url":90,"description":91},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":93,"product_name":117,"url":118,"description":119},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":121,"name":122,"problem":123,"products":124},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[150,156,161],{"slug":151,"name":152,"logo_path":153,"roles":154},"citrix","Citrix","\u002Fvendor-logos\u002Fcitrix.png",[155],"affected",{"slug":157,"name":158,"logo_path":159,"roles":160},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[155],{"slug":162,"name":21,"logo_path":163,"roles":164},"veeam","\u002Fvendor-logos\u002Fveeam.png",[155],{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":180},"inc-ransomware-exploits-unpatched-systems-and-veeam-credentials-to-compromise-830-victims","INC Ransomware Exploits Unpatched Systems and Veeam Credentials to Compromise 830+ Victims","INC Ransomware has become a major Ransomware-as-a-Service (RaaS) threat by targeting public-facing application vulnerabilities and extracting credentials stored in Veeam backup solutions — a critical misstep that turns recovery tools into attack vectors. The group's ability to rewrite encryptors in Rust for both Windows and Linux\u002FESXi environments demonstrates technical sophistication that bypasses many legacy defenses. With over 830 victims since 2023 and spawning related families like Lynx and Sinobi, INC illustrates how a single well-resourced RaaS operation can multiply its impact across the ecosystem. Organizations that fail to patch internet-facing applications promptly and secure backup infrastructure credentials are disproportionately exposed to this type of double-extortion ransomware campaign.",[170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 11: Data Recovery","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CP-9: Information System Backup","NIST SP 800-53 AC-3: Access Enforcement","NIST CSF RS.MI-1: Incidents are contained","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","ITIL: Problem Management — proactive identification of recurring vulnerabilities","GDPR Article 32: Security of Processing — technical measures to ensure data integrity and availability",{}]