INC Ransom has hit hospitals, councils and schools with an intrusion playbook built on edge appliance flaws, valid accounts and ordinary admin tools, and its encryptor lives on under the Lynx name after the source code was offered for sale. This profile treats the two families together because the code evidence links them and the defences are the same. It draws on MITRE ATT&CK v20, Palo Alto Networks Unit 42, Group-IB, Secureworks and SentinelOne, plus public statements on the NHS Dumfries and Galloway and Leicester City Council incidents. It is written for security operations, identity and infrastructure teams, especially in healthcare and the public sector. Attribution follows each source's wording, and the page names no individuals and reproduces no leak-site material.
Key takeaways
- Two brands, one codebase. Unit 42 found 48 per cent of INC functions present in Lynx, and Group-IB measured more than 91 per cent overlapping functions between the two ESXi variants, so detections and playbooks for one apply to the other.
- Edge appliances opened the door. Sources record exploitation of Citrix NetScaler CVE-2023-3519 and CitrixBleed CVE-2023-4966, both in the CISA Known Exploited Vulnerabilities catalogue, alongside phishing and compromised valid accounts.
- The middle of the intrusion is administration in disguise. RDP with valid accounts, AdFind, Advanced IP Scanner, PsExec renamed to winupd, WMIC and AnyDesk carry the attack from foothold to mass deployment.
- Healthcare and public bodies are in scope despite Lynx's claims. Lynx says it avoids hospitals and government, but INC's documented victims include NHS Dumfries and Galloway and Leicester City Council, and ATT&CK lists healthcare and education among its most common sectors.
- Credential hygiene and backup isolation decide the outcome. MFA on every remote path, a tiered admin model, alerting on new services and remote copies, and backups that domain credentials cannot reach break most of the documented chain.
Who they are (names and aliases)
INC Ransom is a ransomware and data extortion operation that MITRE ATT&CK dates to at least July 2023. Unit 42 places the first INC samples, for both Windows and Linux, in August 2023, and reports that INC's source code was offered for sale on criminal forums from March 2024. Lynx was discovered in July 2024. Unit 42 describes Lynx as a repackaged INC codebase, and Group-IB says its comparison "strongly indicates" Lynx bought or adapted INC's source. Whether the same people run both is not established in the sources: treat Lynx as a successor or derivative brand, not a proven rebrand by the same operators.
| Name or ID | Source | What it refers to |
|---|---|---|
| INC Ransom (G1032) | MITRE ATT&CK | The group deploying INC Ransomware; active since at least July 2023 |
| GOLD IONIC | Secureworks (alias recorded in ATT&CK) | Secureworks' name for the INC operators |
| INC Ransomware (S1139) | MITRE ATT&CK | The encryptor; partial encryption with multi-threading for speed |
| Lynx | Unit 42, Group-IB | Ransomware-as-a-service brand from mid 2024; Windows, Linux and ESXi builds; .lynx or .LYNX extension |
| Ransom notes | SentinelOne, Unit 42 | INC: INC-README.TXT and INC-README.HTML; Lynx: README.txt with Tor links and a contact email |
For how these names fit the wider market, see the Ransomware Groups Guide and the Ransomware Family Lineage and Rebrands Guide.
Targeting and motivation
- Motivation: financial. ATT&CK maps INC's model to T1657 Financial Theft: data is stolen and encrypted, then the victim pays for decryption and for the data to stay private.
- Sectors: ATT&CK lists industrial, healthcare and education as the most common INC targets, in the US and Europe. Secureworks counted 72 leak-site victims between August 2023 and March 2024, with education at more than double the cross-group average and the UK second only to the US.
- Size: SentinelOne describes INC as hitting multiple industries with little discrimination and notes small and medium-sized organisations among victims.
- Lynx's stated rules: Group-IB's copy of the Lynx affiliate advert, posted on the RAMP forum from 8 August 2024, excludes healthcare, government, churches and children's charities, and excludes CIS countries, Ukraine, China, Iran and North Korea. Unit 42 saw Lynx victims in US and UK retail, real estate, architecture, financial and environmental services. Stated exclusions are marketing, not a control: do not lower defences because of them.
- Affiliate economics: Lynx offers affiliates an 80/20 split in their favour, a victim management panel and a paid calling service to pressure victims. See the Ransomware-as-a-Service Business Model Guide.
Tactics and techniques (MITRE ATT&CK)
IDs below are ATT&CK v20 relationships recorded against G1032 and S1139, plus Lynx behaviour from Unit 42 and Group-IB. Defence impairment now sits under tactic TA0112 Defense Impairment.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application | Citrix NetScaler CVE-2023-3519 (ATT&CK, SentinelOne); CitrixBleed CVE-2023-4966 (Secureworks) | Patch KEV-listed edge flaws first; kill all sessions after patching |
| Initial access | T1566 Phishing; T1078 Valid Accounts | Spear-phishing; compromised accounts used over RDP | Phishing-resistant MFA; block legacy authentication |
| Discovery | T1087.002 Domain Account; T1069.002 Domain Groups; T1046 Network Service Discovery; T1135 Network Share Discovery | Scanning for domain admins with AdFind and Nltest; NETSCAN.EXE and Advanced IP Scanner | Alert on bulk LDAP queries and scanner binaries from user hosts |
| Lateral movement | T1021.001 RDP; T1570 Lateral Tool Transfer | RDP with valid accounts; rapid copy of the encryptor across endpoints (Secureworks saw more than 500 systems) | Restrict RDP to jump hosts; block admin shares between workstations |
| Execution | T1047 WMI; T1569.002 Service Execution; T1059.003 Windows Command Shell | WMIC to deploy; service "winupd" running %SystemRoot%\winupd.exe as LocalSystem (System event 7045) | Alert on new services from remote sessions and on WMIC process creation |
| Stealth | T1036.005 Match Legitimate Resource Name or Location | PsExec renamed winupd to look like a Windows update | Detect by hash, signer and command line, not file name |
| Command and control | T1219 Remote Access Tools | AnyDesk and PuTTY | Allowlist one approved remote tool; block the rest |
| Defence impairment | T1685 Disable or Modify Tools | SystemSettingsAdminFlows.exe used to disable Microsoft Defender | Tamper protection; alert on Defender state changes |
| Collection and exfiltration | T1074 Data Staged; T1560.001 Archive via Utility; T1537 Transfer Data to Cloud Account | 7-Zip and WinRAR archives; MegaSync (more than 70 GB in one case) and Rclone | Egress controls on personal cloud storage; DLP volume alerts |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1489 Service Stop; T1491.001 Internal Defacement | Partial encryption; shadow copies removed through DeviceIoControl; backup, Veeam, SQL and Exchange processes killed; note set as wallpaper and printed | Immutable, isolated backups; VSS and backup service tamper alerts |
What Lynx adds
- Encryption: AES-128 in CTR mode with Curve25519 Donna. Group-IB lists fast (5 per cent), medium (15 per cent), slow (25 per cent) and entire (100 per cent) modes on Windows and Linux.
- File access: on Windows it enables SeTakeOwnershipPrivilege, rewrites file DACLs and uses the Restart Manager API to release locked files.
- Recovery inhibition: shadow copies are destroyed by setting the VSS maximum diff area size to 1 byte.
- Hypervisors: the ESXi build stops virtual machines by World ID, deletes snapshots with vim-cmd and can set the ransom note as the message of the day. See the ESXi Ransomware Playbook.
How they abuse identities and credentials
Every documented INC intrusion depends on identities: either stolen sessions at the edge or valid domain accounts inside. The encryptor is the last step; the account abuse is what makes it possible.
- Session tokens from the edge: CitrixBleed leaked valid NetScaler session cookies that let attackers skip passwords and MFA, which is why patching alone was not enough. The CitrixBleed 2023 breach shows the same flaw used against Boeing, ICBC and Xfinity. Revoke all active sessions after any appliance patch or compromise. See the Token and Session Security Guide.
- Valid accounts over RDP: ATT&CK records INC using compromised accounts to reach targets and RDP to move laterally. Any account with remote interactive logon to servers is a target.
- Hunting for domain admins: AdFind, Nltest and net commands enumerate privileged groups so the operators know which credentials to take next. Privileged accounts that log on to ordinary servers leave reusable credentials behind. See the Tiered Administration and Enterprise Access Model Guide.
- Backup credentials: SentinelOne lists a Veeam credential-dumping tool among INC's post-compromise tooling, and both families stop backup processes before encrypting. Backup service accounts that are domain-joined fall with the domain. See the Backup Identity Isolation Guide.
- Service accounts for deployment: mass deployment through PsExec and WMIC runs as LocalSystem or as a privileged account on hundreds of hosts at once. Service accounts with local admin rights everywhere make this trivial.
Notable incidents
| Victim | Date | What is public |
|---|---|---|
| NHS Dumfries and Galloway (NHS Scotland) | Disclosed 15 March 2024 | INC claimed the attack and 3 TB of data, and published a sample including patients' test results, names and home addresses. The Scottish Government worked with Police Scotland, the National Crime Agency and the NCSC; the board described a "focused and ongoing cyberattack". |
| Leicester City Council | Detected 7 March 2024 | The council confirmed ransomware, shut systems down and notified the ICO. INC claimed 3 TB; by 3 April about 25 sensitive documents, including rent statements and ID records, had been published. |
| Unnamed victim (Secureworks) | 2023 to 2024 | CitrixBleed access, Meterpreter, AdFind, more than 70 GB exfiltrated through MegaSync, then the encryptor copied to more than 500 systems and run with PsExec. |
Both UK public-sector cases follow the double extortion pattern: services recover from backups, but the leaked data keeps causing harm, because patients and residents become targets for follow-on fraud. Plan notification and support from day one. See the Ransomware Data Leak Site Listing Playbook and the Threat Actors Targeting Healthcare Guide.
Detection and defence
Detections that fit this playbook
| Signal | Where to look | Why it matters |
|---|---|---|
| New service installed remotely, especially with a name like winupd running from %SystemRoot% | Windows System log event 7045; Security event 4697 where enabled | The documented deployment step for the encryptor |
| Same executable written to many hosts within minutes | EDR file creation telemetry; SMB admin share access (Security event 5145) | Lateral tool transfer before encryption |
| AdFind, Nltest or bulk LDAP queries from a workstation | EDR process events; domain controller LDAP logs | Domain admin hunting precedes privilege theft |
| Interactive RDP logons by accounts that do not normally use RDP | Security event 4624 logon type 10 | Valid account abuse for lateral movement |
| MegaSync, Rclone or unapproved AnyDesk on servers | EDR, application control logs, proxy and DNS logs | Exfiltration and remote control channels |
| Microsoft Defender disabled or tamper protection changes | Defender operational log; EDR alerts | Defence impairment ahead of impact |
| Shadow copy or backup job deletion; Veeam service stops | VSS and backup application logs | Final stage: act immediately |
Rollout order for defences
- Close the edge first: inventory internet-facing VPN, Citrix and remote access appliances; patch KEV-listed flaws within your shortest service level; after each patch, terminate every active session and rotate appliance credentials.
- Enforce phishing-resistant MFA on VPN, Citrix, RDP gateways and cloud consoles; pilot with IT staff, then expand. Keep a documented break-glass account. See the Phishing-Resistant MFA Guide.
- Tier admin accounts: stop domain admins logging on to workstations and member servers; give helpdesk and server teams separate accounts.
- Control admin tools: allowlist one remote access product, block PsExec and WMIC remote execution except from jump hosts, and run application control in audit mode for two to four weeks before enforcing. Roll back by returning the policy to audit. See the RMM Tool Security Guide.
- Isolate backups: separate credentials, immutability, and a tested restore of a critical system each quarter, including ESXi hosts.
- Exercise the scenario: run a tabletop that starts with a leak-site listing and patient data exposure, not just encryption.
Decision guidance
- Small organisations without a SOC: prioritise appliance patching, MFA and offline backups, and use a managed detection service for out-of-hours alerts, since deployment often happens overnight.
- Large estates: the biggest gain is the tiered admin model and blocking workstation-to-workstation SMB and RDP, because those stop the 500-host deployment pattern.
- Healthcare: clinical systems that cannot run EDR need network segmentation and strict jump-host access instead. See the Healthcare Identity Security Guide.
Metrics
- Edge exposure: days from KEV listing to patch on internet-facing appliances (target: inside your critical SLA).
- MFA coverage: percentage of remote access paths requiring phishing-resistant MFA.
- Admin hygiene: number of tier 0 accounts with logons to non-tier-0 hosts in the last 30 days (target: zero).
- Tool control: count of unapproved remote access or sync tools found on servers each month.
- Recovery: time to restore a critical system from isolated backup in the latest test.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Account and credential management | PR.AA-01, PR.AA-05 | IA-2, AC-6 |
| Monitoring for lateral movement and tool abuse | DE.CM-01 | SI-4 |
| Backups | PR.DS-11 | CP-9 |
| Containment | RS.MI-01 | SI-4 (with incident response plans) |
Practitioner checklist
- Confirm Citrix NetScaler and other edge appliances are patched for CVE-2023-3519, CVE-2023-4966 and later KEV entries, and that sessions were reset afterwards.
- Require phishing-resistant MFA on every external remote access path and block legacy authentication.
- Remove domain admin logons from workstations and member servers; review tier 0 group membership monthly.
- Alert on event 7045 service creation from remote sessions and on one binary copied to many hosts.
- Detect AdFind, Nltest bulk queries, NETSCAN and Advanced IP Scanner from user endpoints.
- Allowlist one remote access tool; block MegaSync, Rclone and unapproved AnyDesk on servers.
- Turn on Defender tamper protection and alert on any change to security tooling state.
- Keep backups immutable with credentials outside the domain, and test an ESXi host restore.
- Prepare a data leak response: notification, regulator contact (for example the ICO) and support for affected people.
Standards and references
- MITRE ATT&CK: INC Ransom (G1032)
- MITRE ATT&CK: INC Ransomware (S1139)
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: Cybersecurity Framework 2.0
- Palo Alto Networks Unit 42: INC Ransomware Rebrand to Lynx
- Group-IB: Cat's Out of the Bag, Lynx Ransomware-as-a-Service
- Secureworks: GOLD IONIC Deploys INC Ransomware
- SentinelOne: INC Ransom
Related NHI Mgmt Group resources: Ransomware Groups Guide · Ransomware Response and Recovery Guide · Tiered Administration and Enterprise Access Model Guide · Threat Actors Targeting Healthcare Guide