INC Ransom
INC Ransom is a ransomware group with a financial motive, tracked by Brandefense. It targets 19 sectors, including Government and Technology, in 86 countries, including the United States and the United Kingdom. It uses 69 MITRE ATT&CK techniques and exploits 36 known CVEs.
Also known as
- GOLD IONIC
- INC Ransom Team
- Techniques
- 69
- Exploited CVEs
- 36
- First seen
- Aug 9, 2023
- Last seen
- Sep 7, 2026
- Record updated
Who They Target.
Sectors · 19
Countries · 86
Labelsdouble-extortioneducation-targetinggold-ionichealthcare-targetinginc ransomindustrial-targetingransomware
About INC Ransom.
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.