Trusted Design

INC Ransom

アクターID: G1032

· MITRE Pageへのリンク

脅威アクターの詳細

INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)

脅威アクターの別名・別称

INC Ransom
GOLD IONIC

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1218.013 - Mavinject
• T1587.001 - Malware
• T1542.005 - TFTP Boot
• T1007 - System Service Discovery
• T1036.009 - Break Process Trees
• T1140 - Deobfuscate/Decode Files or Information
• T1586.002 - Email Accounts
• T1083 - File and Directory Discovery
• T1055.004 - Asynchronous Procedure Call
• T1552.003 - Shell History
• T1199 - Trusted Relationship
• T1562.013 - Disable or Modify Network Device Firewall
• T1597 - Search Closed Sources
• T1157 - Dylib Hijacking
• T1027 - Obfuscated Files or Information
• T1566.004 - Spearphishing Voice
• T1591.004 - Identify Roles
• T1055.009 - Proc Memory
• T1070.009 - Clear Persistence
• T1209 - Time Providers
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1027.007 - Dynamic API Resolution

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1027)
• CVE-2015-5749 (T1027)
• CVE-2016-1898 (T1140)
• CVE-2016-1897 (T1140)
• CVE-2015-7261 (T1140)
• CVE-2015-6036 (T1560.001)
• CVE-2015-7262 (T1157)
• CVE-2015-0932 (T1140)
• CVE-2010-3081 (T1209)
• CVE-2017-16929 (T1027)
• CVE-2025-31125 (T1027)
• CVE-2025-68645 (T1209)
• CVE-2014-4114 (T1027.007)
• CVE-2017-0143 (T1027.007)
• CVE-2014-1761 (T1140)
• CVE-2015-1641 (T1140)
• CVE-2014-0329 (T1027)
• CVE-2016-9494 (T1027)
• CVE-2016-9496 (T1027)
• CVE-2016-9495 (T1027)
• CVE-2010-3333 (T1209)
• CVE-2014-0497 (T1027)
• CVE-2014-1776 (T1027)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2010-2883 (T1209)
• CVE-2013-0634 (T1027)
• CVE-2010-0232 (T1027)
• CVE-2009-3129 (T1209)
• CVE-2011-0611 (T1591.004)
• CVE-2025-24893 (T1027)
• CVE-2015-5119 (T1027)
• CVE-2015-5122 (T1027)
• CVE-2012-1856 (T1027.007)
• CVE-2015-2545 (T1027.007)
• CVE-2015-7645 (T1027)
• CVE-2017-0199 (T1027.007)
• CVE-2015-3043 (T1027)
• CVE-2015-3090 (T1027)
• CVE-2015-3113 (T1027)
• CVE-2015-2590 (T1140)
• CVE-2015-2424 (T1027)
• CVE-2015-0097 (T1027)
• CVE-2012-0158 (T1027.007)
• CVE-2015-2502 (T1027.007)
• CVE-2014-6271 (T1209)
• CVE-2013-2094 (T1027)
• CVE-2016-1010 (T1027)
• CVE-2016-1019 (T1027)
• CVE-2016-0984 (T1027)
• CVE-2016-1001 (T1027)
• CVE-2016-0998 (T1027)
• CVE-2015-1701 (T1027.007)
• CVE-2015-0313 (T1027)
• CVE-2015-0359 (T1027)
• CVE-2015-5130 (T1027)
• CVE-2015-5134 (T1027)
• CVE-2015-5539 (T1027)
• CVE-2015-5557 (T1027)
• CVE-2015-5563 (T1027)
• CVE-2015-5559 (T1027)
• CVE-2015-5540 (T1027)
• CVE-2015-5561 (T1027)
• CVE-2015-5551 (T1027)
• CVE-2015-5564 (T1027)
• CVE-2015-5565 (T1027)
• CVE-2015-5550 (T1027)
• CVE-2015-5566 (T1027)
• CVE-2015-5127 (T1027)
• CVE-2015-5556 (T1027)
• CVE-2015-3628 (T1027)
• CVE-2016-1287 (T1027)
• CVE-2015-8286 (T1140)
• CVE-2015-8287 (T1140)
• CVE-2017-0261 (T1027)
• CVE-2017-0262 (T1027)
• CVE-2025-55182 (T1027)
• CVE-2015-0311 (T1027)
• CVE-2013-3906 (T1027)
• CVE-2012-0056 (T1027)
• CVE-2015-0336 (T1027)
• CVE-2014-3153 (T1157)
• CVE-2014-4322 (T1027)
• CVE-2015-3636 (T1157)
• CVE-2013-6282 (T1027)
• CVE-2015-3105 (T1027)
• CVE-2013-0074 (T1027)
• CVE-2012-0507 (T1027)
• CVE-2014-8439 (T1209)
• CVE-2013-2551 (T1027)
• CVE-2014-0569 (T1027)
• CVE-2014-0515 (T1027)
• CVE-2015-0310 (T1027)
• CVE-2014-0556 (T1027)
• CVE-2012-1876 (T1027)
• CVE-2015-5560 (T1027)
• CVE-2012-2539 (T1055.004)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1027)
• CVE-2014-8440 (T1027)
• CVE-2010-0806 (T1547.013)
• CVE-2011-3402 (T1027)
• CVE-2014-7247 (T1027)
• CVE-2013-2595 (T1027)
• CVE-2015-4902 (T1140)
• CVE-2013-5990 (T1027)
• CVE-2016-0189 (T1027)
• CVE-2023-1389 (T1027)
• CVE-2025-34026 (T1027)
• CVE-2025-55183 (T1027)
• CVE-2025-55184 (T1027)
• CVE-2015-1770 (T1027.007)
• CVE-2015-6034 (T1157)
• CVE-2016-2342 (T1209)
• CVE-2012-1258 (T1209)
• CVE-2013-3660 (T1157)
• CVE-2014-3393 (T1027)
• CVE-2012-6422 (T1027)
• CVE-2012-0611 (T1597)
• CVE-2025-13928 (T1027)
• CVE-2014-6352 (T1027.007)
• CVE-2015-2546 (T1027)
• CVE-2015-3785 (T1027)
• CVE-2015-5897 (T1157)
• CVE-2015-3456 (T1027)
• CVE-2014-4113 (T1027.007)
• CVE-2016-1562 (T1597)
• CVE-2017-0263 (T1027)
• CVE-2017-3212 (T1597)
• CVE-2014-7911 (T1027)
• CVE-2015-0057 (T1027.007)
• CVE-2013-7331 (T1027.007)
• CVE-2015-2360 (T1027.007)
• CVE-2014-4148 (T1027.007)
• CVE-2014-6324 (T1027)
• CVE-2015-2426 (T1027)
• CVE-2008-1436 (T1027.007)
• CVE-2010-4398 (T1209)
• CVE-2014-2273 (T1597)
• CVE-2015-2387 (T1027)
• CVE-2017-7255 (T1027)
• CVE-2026-20127 (T1027)
• CVE-2015-7808 (T1157)
• CVE-2016-1990 (T1157)
• CVE-2015-0016 (T1027)
• CVE-2010-0188 (T1591.004)
• CVE-2012-4681 (T1027)
• CVE-2015-1761 (T1157)
• CVE-2010-0738 (T1027)
• CVE-2011-1255 (T1157)
• CVE-2017-0001 (T1027)
• CVE-2025-13927 (T1027)
• CVE-2026-1102 (T1027)
• CVE-2015-1427 (T1027)
• CVE-2014-6332 (T1027.007)
• CVE-2017-12149 (T1027)
• CVE-2010-1553 (T1209)
• CVE-2015-2852 (T1027)
• CVE-2015-2854 (T1027)
• CVE-2015-2853 (T1027)
• CVE-2015-7755 (T1027)
• CVE-2012-4969 (T1027.007)
• CVE-2016-2343 (T1027)
• CVE-2012-3213 (T1027)
• CVE-2014-0322 (T1027.007)
• CVE-2011-3544 (T1027)
• CVE-2017-17215 (T1027)
• CVE-2013-2465 (T1027)
• CVE-2012-5054 (T1027)
• CVE-2013-2678 (T1027)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2014-3897 (T1027)
• CVE-2010-2572 (T1027)
• CVE-2015-2419 (T1027)
• CVE-2016-4117 (T1027)
• CVE-2025-13335 (T1027)
• CVE-2026-0723 (T1027)
• CVE-2012-4792 (T1547.013)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る