INC Ransomware Has Hit 800 Victims Using LOLBins, Stolen Veeam Credentials and Rust Payloads

INC ransomware, a Ransomware-as-a-Service operation active since mid-2023, has claimed more than 800 victims globally and ranks among the most technically sophisticated ransomware groups currently active, according to research published by Acronis. The group primarily targets high-profile organisations in the United States, with a particular focus on the legal, manufacturing, technology, and healthcare sectors, though its double-extortion playbook and cross-platform capabilities make it a threat to any enterprise with recoverable data.

How INC gains access

INC affiliates use several methods for initial access. Spear-phishing campaigns targeting organisation-specific personnel are the most common vector. The group also purchases access from initial access brokers, acquiring credentials or established footholds on target networks. Vulnerability exploitation against internet-facing applications is the third primary vector, with historically exploited vulnerabilities including Citrix NetScaler, Fortinet EMS, and Citrix Bleed 2.

Once inside, affiliates use standard command-line tools and IP scanners to map the environment quietly. Privilege escalation is achieved through a Base64-encoded PowerShell script that dumps credentials directly from Veeam backup servers. This is a deliberate and operationally significant choice: Veeam, as a widely deployed data protection and backup platform, holds administrative credentials across the environment it manages. Extracting those credentials gives the attacker deep and broad access to infrastructure that the IT team specifically designed to be recoverable in a disaster scenario.

The Rust rewrite and cross-platform capability

INC's ransomware payloads have been entirely rewritten in Rust. The practical consequences of this rewrite are significant for defenders. Rust-compiled binaries are harder to reverse-engineer than those compiled from legacy languages commonly used in earlier ransomware generations. The Rust payloads also operate cross-platform, supporting both Windows and Linux environments including VMware ESXi servers.

On Windows, the malware uses multithreading and a tiered partial-encryption routine to maximise encryption speed. It avoids critical system files so the machine remains functional enough to display ransom notes on the desktop and print extortion demands on network printers. On Linux and ESXi, the payload uses VMware management commands to shut down all running virtual machines before encrypting them, ensuring that no files are locked by the hypervisor during the process.

Both payload variants use hybrid encryption combining Curve25519 elliptic curve cryptography and AES-128, a scheme that is computationally resistant to offline decryption without the attacker's private key.

The exfiltration layer

Before encryption, INC affiliates exfiltrate data using rclone, a legitimate open-source cloud data synchronisation tool that transfers files to attacker-controlled cloud storage. This is a LOLBin approach: using a trusted, signed tool to move data means the transfer is unlikely to trigger signature-based detection. Remote monitoring and management tools are also used to maintain access and move laterally during the pre-encryption phase.

The group operates a dual-site extortion model with a private negotiation portal and a public leak site. Non-cooperating victims have their data published on the leak site, which generates additional reputational pressure on the affected organisation.

What GCC enterprises must prioritise

Given INC's specific focus on Veeam credential extraction, any GCC enterprise running Veeam for backup and data protection should treat the following as immediate security review items.

Restrict access to the Veeam management console to a dedicated, isolated management network with no internet access. Ensure that Veeam service account credentials are rotated on a schedule and are not reused across other systems. Enable multi-factor authentication on Veeam console access where supported. Review which accounts hold Veeam administrative privileges and apply least-privilege access.

For broader ransomware resilience, immutable offline backups that cannot be reached from the primary network remain the single most effective recovery control. INC specifically targets recovery infrastructure to eliminate the victim's ability to restore without paying the ransom. Organisations whose Veeam environment is accessible from the same network segment as production systems should prioritise network segmentation as a near-term defensive improvement.