INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023

INC ransomware has rapidly ascended the ranks of cyber threats to establish itself as one of the most formidable ransomware-as-a-service operations in the current threat landscape. Security researchers tracking the group's evolution have documented its trajectory from a relatively unknown entity to a dominant player, capitalizing on voids left by the disruption of major ransomware families. The group's aggressive expansion has resulted in more than 830 victim organizations since August 2023, making it a critical concern for cybersecurity professionals worldwide.

The emergence of INC as a major threat directly correlates with the law enforcement actions against previously dominant ransomware operations. Following the disruption of LockBit and the shutdown of BlackCat, many cybercriminal affiliates sought new platforms to conduct their illicit activities. INC skillfully positioned itself to absorb these displaced threat actors, rapidly scaling its operations and victim count. This migration of affiliates has significantly bolstered INC's capabilities and reach, enabling it to target organizations across various sectors with increasing sophistication. The group's ransomware-as-a-service model provides affiliates with access to potent encryption tools, exfiltration capabilities, and negotiation infrastructure, streamlining the attack process.

For security teams, the rise of INC ransomware necessitates immediate attention and defensive adaptations. Organizations should