INC Ransom Ransomware Decryption & Data Recovery

INC Ransom first appeared in July-August 2023, running multi-layered extortion - encryption, leak and direct harassment - with healthcare, education, industrial manufacturing and government as early focus areas and victims overwhelmingly in Europe and North America. Its Linux variant was first observed in December 2023 with full ESXi support.

2024 was the pivotal year. Attack volume climbed sharply, several UK NHS organisations and a children's hospital were hit, drawing significant attention. At the same time, INC's source code - Windows and Linux/ESXi versions included - was offered for sale on underground forums for 300,000 dollars. The Lynx ransomware that surfaced shortly afterwards was shown by Unit 42 to share roughly 48% of its functions with INC overall and 70.8% among common functions, with even higher overlap in the Linux/ESXi variant, indicating Lynx either bought or repurposed the INC codebase.

By 2026 INC had grown into one of the most active operations in the ecosystem, with public trackers counting more than 930 claimed victims on its leak site and dozens still added each month, alongside observed large-scale exploitation of SonicWall SMA 1000 series flaws for initial access.

The relevance for Chinese organisations lies in the entry points. INC leans heavily on edge device vulnerabilities - Citrix NetScaler CVE-2023-3519 and CVE-2023-4966 ("Citrix Bleed"), SonicWall SMA series - and RDP logins with valid accounts. Manufacturers and hospitals in China run the same classes of remote access appliances with typically long patch cycles, so the exposed surface is identical. No public report confirms a targeted INC campaign against mainland China organisations.

Extension. Encrypted files get .INC appended (lowercase .inc in some builds) with the original name preserved, so ledger.xlsx becomes ledger.xlsx.INC. A characteristic signature block is appended to the end of each encrypted file and is a reliable attribution artefact.

Ransom notes. Both INC-README.txt and INC-README.html appear in affected directories. The English text carries a victim-specific personal ID and a Tor portal address, pressing with a claim that data has been downloaded and a 72-hour contact deadline.

Printed notes. One of INC's signature behaviours is pushing the ransom note to every reachable printer and fax machine, so staff arriving in the morning find it on paper as well as on screen - frequently how the incident is first discovered.

Other indicators.

• Anomalous access and session hijacking against Citrix NetScaler or SonicWall SMA appliances beforehand.
• NETSCAN.EXE sweeps, AnyDesk installations, and PsExec renamed (for example to winupd) for deployment.
• SystemSettingsAdminFlows.exe abused to tamper with Windows Defender settings, and a custom av.exe terminating EDR processes.
• MEGASync, Rclone, 7-Zip or WinRAR appearing on non-administrative hosts, indicating exfiltration.

ESXi. Bulk VM shutdowns via esxcli or vim-cmd followed by encryption of files under /vmfs/volumes.

INC Ransom's access is concentrated on edge appliances and valid credentials - mature tradecraft applied repeatedly:

• Edge device exploitation. Citrix NetScaler ADC/Gateway CVE-2023-3519 and CVE-2023-4966 ("Citrix Bleed", which hijacks sessions and bypasses MFA) are its signature entry points, joined in 2026 by large-scale exploitation of SonicWall SMA 1000 series flaws.
• Valid accounts over RDP. Purchased or stolen credentials used for direct remote logins, skipping exploitation entirely.
• Phishing. Loader delivery to establish an initial foothold.
• Internal reconnaissance. NETSCAN.EXE, built-in commands and Active Directory queries to map the network and assets.
• Lateral movement. RDP, renamed PsExec, AnyDesk remote control and WMI.
• Defence evasion. Tampering with Defender configuration, custom tooling to kill EDR processes, and log clearing.
• Exfiltration. MEGASync and Rclone uploads with 7-Zip or WinRAR staging, aimed squarely at finance, HR, medical records and design data.
• Final deployment. Usually after taking the domain controller, pushed through GPO or bulk scripts with Windows and ESXi executed together.

Because Citrix Bleed-class flaws hijack already-authenticated sessions, MFA provides no backstop on this path - which is why organisations that had two-factor enabled still got breached.

Windows build. Salsa20 and AES for symmetric encryption with Curve25519 key agreement and an independent key per file. Command-line arguments select target directories, single files or encryption intensity, letting operators tune speed against thoroughness per environment.

Linux / ESXi build. X25519 ECDH produces a shared secret, SHA-256 derives keys, and AES-128-CTR encrypts content. ESXi-specific routines first enumerate and shut down VMs via vim-cmd - with the option to skip selected VM IDs - so file locks cannot leave encryption incomplete, then process vmdk, vmx and related files under /vmfs/volumes.

Partial encryption. Large files are encrypted partially or intermittently for speed, with the proportion varying by mode. That leaves untouched regions in database files and virtual disks, the primary repair entry point when no decryptor exists - though usability must be measured.

Recovery inhibition. Shadow copies deleted, database and backup services stopped, event logs cleared, and snapshot files handled on the ESXi side.

Multi-layered extortion. Data is exfiltrated before encryption and published in stages if unpaid, with ransom notes printed inside the victim's offices and direct pressure applied to related parties.