INC Ransom decryptor

Unfortunately, there is no publicly available decryptor for INC Ransom. The ransomware uses strong AES-256 encryption in CBC mode, making decryption without the attacker’s key virtually impossible. The good news — UnderDefense’s incident response team is on standby to contain the attack, eliminate the malware, prevent reinfection, and restore your systems using verified, uncompromised backups so you can safely resume operations.

INC Ransom IOCs

Important note: IOCs often change because INC Ransom constantly updates its tools. This list includes recurring, widely confirmed indicators based on Trend Micro, Halcyon, SentinelOne, Microsoft Threat Intelligence, Palo Alto Unit 42, and IR case data.

File extensions
The original .INC extension is the most common. Some variants append custom extensions such as .FGqogsxF or {original file name}.{original extension}.INC.

Ransom note filenames
Apart from the original INC-README.txt and INC-README.html, some affiliate variations include:

RECOVER-[seven random letters]-FILES.txt
INC-README.txt
INC-README.html

*The exact filenames vary.

INC Ransom hashes
These are SHA-256 hashes used for encrypting payloads in known attacks:

accd8bc0d0c2675c15c169688b882ded17e78aed0d914793098337afc57c289c
02472036db9ec498ae565b344f099263f3218ecb785282150e8565d5cac92461
05e4f234a0f177949f375a56b1a875c9ca3d2bee97a2cb73fc2708914416c5a9
571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b
82eb1910488657c78bef6879908526a2a2c6c31ab2f0517fcc5f3f6aa588b513
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc
80908a51e403efd47b1d3689c3fb9447d3fb962d691d856b8b97581eefc0c441
a0ceb258924ef004fa4efeef4bc0a86012afdb858e855ed14f1bbd31ca2e42f5

INC Ransom tools
For EDR disabling:

HackTool.Win32.ProcTerminator.A
ProcessHacker
SystemSettingsAdminFlows.exe (disables Windows Defender)

For credential dumping:

HackTool.PS1.VeeamCreds.A
Mimikatz

For reconnaissance:

NetScan
Advanced IP Scanner
Active Directory enumeration tools

For data exfiltration:

MegaSync
7-Zip
WinRAR

For lateral movement:

PsExec
AnyDesk
TightVNC
Windows Management Instrumentation (WMI)

Malware:

GootLoader (via Storm-0494 partnership)
INC Ransom binary (Windows, Linux, ESXi variants)

Most common red flag
INC Ransom almost always runs this code:

vssadmin.exe Delete Shadows /all /quiet
wmic shadowcopy delete

*If you detect this, data encryption is moments away.

INC Ransom vectors

Case outcomes

INC Ransom is a highly aggressive double-extortion operator that shows no mercy when negotiations stall.

Most INC Ransom affiliates maintain dual leak sites — one requiring login credentials for victim communication, and a second publicly accessible site where stolen data is published. The group frames their attacks as “security services” while conducting financially motivated extortion. Victims face immediate pressure as the group threatens to publish sensitive data within days if ransom demands are not met.

Decryptors, when provided after payment, may be slow or unstable. Some victims experience repeated extortion attempts even after paying. Partial data recovery failures are common when backups were destroyed or encrypted during the attack.

Also, INC Ransom is known to publish data rapidly if negotiations fail or if victims attempt to involve law enforcement.

How to remove INC Ransom ransomware?

Note: Attempting to remove INC Ransom ransomware and self-remedy may lead to greater data loss.

To remove INC Ransom ransomware, immediately engage INC Ransom ransomware removal experts to guide your response and ensure no critical steps are missed. Then, begin by isolating all affected systems: disconnect compromised machines from the network (disable Wi-Fi, unplug Ethernet cables, and block their IPs at the firewall).

Next, perform a comprehensive forensic analysis to uncover the depth of the breach. Use endpoint detection and response (EDR) tools to trace the attacker’s path. Collect and review file-hash indicators of compromise (IOCs), registry changes, deleted Volume Shadow Copies, and any tampering with event logs. After mapping the intrusion, reimage all infected devices using clean, verified system images.

Finally, rely on INC Ransom ransomware removal and recovery experts to validate the cleanup, conducting rootkit scans, reviewing system configurations, rotating compromised credentials, and reinforcing your security posture. Their specialized knowledge ensures thorough removal and helps prevent future incidents through strategic hardening and lessons learned.

How to recover from INC Ransom ransomware?

To recover from INC Ransom ransomware, follow these essential steps:

Immediately isolate affected machines to stop any further malicious activity, then only reintroduce them into production once you’ve verified clean restorations and confirmed there’s no lingering malware.
Recover your data exclusively from offline, write-protected backups, and validate their integrity by checking checksums and performing test restores in a controlled environment.
Perform a thorough post-incident review to map the attack chain and identify root causes, then harden or rotate all credentials (especially admin/service accounts) to eliminate any leftover access points.
Bring in external IR specialists to audit your environment, ensure complete ransomware eradication, and help update your incident-response and business-continuity plans.

Ransom amounts

INC Ransom demands vary widely depending on the size of the victim organization and the amount of data stolen. Ransoms are almost always demanded in Bitcoin.

Because INC Ransom conducts double-extortion attacks, victims face two simultaneous financial threats:

The ransom itself
The cost of leaked, stolen, or destroyed data

Organizations should never attempt ransom negotiation alone — INC Ransom is known to escalate threats quickly, publish data when provoked, and maintain aggressive communication tactics if payment is delayed.

Average ransom:

Small business: $100,000 – $250,000
Medium business: $400,000 – $1,200,000
Large enterprise: $1,500,000+