INC Ransom

Names and who uses them

• INC RansomOur name
• GOLD IONICSecureworks

Targets

Sectors: Healthcare, Education

Regions: Europe, United States

Known techniques

• T1021.001Remote Desktop Protocol
• T1036.005Match Legitimate Resource Name or Location
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1059.003Windows Command Shell
• T1069.002Domain Groups
• T1070.004File Deletion
• T1071Application Layer Protocol
• T1074Data Staged
• T1078Valid Accounts
• T1087.002Domain Account
• T1105Ingress Tool Transfer
• T1135Network Share Discovery
• T1190Exploit Public-Facing Application
• T1219Remote Access Tools
• T1486Data Encrypted for Impact
• T1537Transfer Data to Cloud Account
• T1560.001Archive via Utility
• T1566Phishing
• T1569.002Service Execution
• T1570Lateral Tool Transfer
• T1588.002Tool
• T1657Financial Theft
• T1685Disable or Modify Tools

Malware and tools used