INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Encrypts files using AES and RSA
Disables recovery options
Exploits Citrix NetScaler vulnerabilities for access
Spreads via network shares