Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Key Takeaways
- INC Ransom is a multi-extortion group active since July 2023, targeting healthcare, industrial, and education organizations across the US and Europe.
- The group relies on living-off-the-land tools like NETSCAN.EXE, AnyDesk, and SystemSettingsAdminFlows.exe for discovery, movement, and defense evasion.
- Defenders are blinded by tampering with Windows Defender settings, a custom av.exe killing EDR processes.
- Windows payloads combine Salsa20, AES, and Curve25519, while Linux and ESXi variants use X25519 ECDH with AES-128 CTR.
- The Picus Platform lets teams simulate INC Ransomware attacks and validate their security controls against real techniques.
INC Ransom is a multi-extortion threat group that first emerged in July 2023, rapidly establishing a reputation for targeting organizations across the healthcare, industrial, and education sectors, predominantly in the United States and Europe [1].
Article Link: INC Ransomware Explained: How It Attacks Healthcare and Education