Top Tweets for #Incransomware
SOCRadar reveals 7 servers run by INC Ransomware affiliates, exposing an INC Ransomware affiliates AI workbench, Phantom, and 46 encryptors.
#INCRansomware #TheGentlemen #PhantomFramework #SOCRadar #AISecurity #Ransomware #Cybersecurity
https://t.co/Yja3FVwDjG
A PAN-OS GlobalProtect vulnerability, CVE-2026-0257, lets Qilin and Inc ransomware bypass VPN login and reach internal networks.
#PANOS #GlobalProtect #CVE20260257 #Qilin #IncRansomware #PaloAltoNetworks #Unit42 #Ransomware
https://t.co/ozL92a2xLG
INC Ransomware: 885 victims via CVSS 10 SonicWall SMA1000 zero-day. No credentials needed -- root access in minutes. Patch to 12.4.3-03453 now. Full IOCs + detection rules: https://t.co/hi6Gy04edk #SonicWall #INCRansomware #Ransomware #CyberSecurity #PatchNow #CISA
INC ransomware targets mainframes using cross-platform ransomware payloads. Attackers expose a new campaign hitting APAC manufacturing and food companies.
#INCRansomware #MainframeSecurity #CyberAttack #MalwareNews
https://t.co/e0p8WpIJgZ
INC Ransomware Climbs Into Top Tier of Cybercrime Operations, Surpasses 830 Victims https://t.co/zYGX2B2XKL #BYOVDAttack #Incransomware #LockBit
Panama’s Ministry of Economy and Finance Hit by INC Ransom
#Panama #MEF #INCransomware
https://t.co/3YZid9OmaY
Next ACCE release is available. See the updates for #CVE20258088 #AndeLoader #INCRansomware #KitsuneRat #MythicAgentsPoseidon https://t.co/nDVLkx9rWp
Just in: Another day, another ransomware attack! #DollarTree is the latest victim of the INC Ransomware gang, which claims to have stolen 1.2TB of sensitive data.
Read: https://t.co/5P95rtS1MG
#CyberSecurity #INCRansomware #Ransomware #CyberAttack #DataBreach
⚠️ New threat actor on the radar ⚠️
🥷🏻 SINOBI
👉🏻 rebrand of ransomware group Lynx
🗓️ added on July, 5
🥢 Overview
Lynx ransomware group first appeared in mid-2024 as a lineage, rebranded successor to the #INCRansomware family, which debuted in mid-2023. Analysts observed a 48–70% code overlap between Lynx and INC, suggesting the acquisition of INC’s code or developer team.
Unit 42 from Palo Alto Networks, confirmed that INC phased out between July–September 2024, making way for Lynx.
🎯 TTPs
→ operates as a RaaS, sharing revenue (around 80%) with affiliates
→ implements double extortion
→ targets Windows endpoints mainly
→ maintains multiple encryption modes (fast, medium, slow, entire) and works to disable backups
→ command-line options include disabling background changes, printers, or process killing for stealth
→ process/system termination (SQL, Veeam, Exchange, Backup) via Restart Manager APIs
→ shadow-copy deletion to hinder recovery
→ data exfiltrationvia cloud or affiliate channels
→ customization panel for affiliates to configure per-target encryption behavior
#ransomNews #security #infosec #newthreatactor
Ahold Delhaize confirms data breach of 2.2 million records amid #INCRansomware claims. Employee financial and health data at risk.
More: https://t.co/z5IyAYW3wA
#Cybersecurity #DataBreach #AholdDelhaize #CyberAttack #Ransomware
Individuata una nuova campagna di distribuzione del #ransomware RaaS INC, che sta colpendo realtà operative in Italia 🇮🇹
https://t.co/RGqQLPOLgm
#malware #INCransomware
#INCRansomware evolves rapidly by leveraging vulnerabilities in Netscaler ADC & Gateway for initial access.
Our latest #RansomwareSpotlight provides valuable insights into this evolving threat: https://t.co/Nbobv4W3k6
The #INCransomware group's reach extends across the globe, targeting enterprises in the US, Malaysia, Philippines, Switzerland, Australia, and Ireland. It is important to bolster your defenses as this group does not target a specific region.
Read more https://t.co/e5MOFfzkf0
🚨 A new player has emerged on the #ransomware scene: #INCransomware. This malicious software has been making headlines with high-profile attacks, and it's crucial to stay informed.
Read the blog for more: https://t.co/Zlzc722y9u
#cybersecurity #GoldIonic
1/ 🚨 Alerta para LatAm: Ciberataque golpea (nuevamente) la seguridad nacional del Perú 🇵🇪
🆕 #INCRansomware publicó al Ejército del Perú con 500 GB exfiltrados, en paralelo, el grupo #RansomEXX anunció al Ministerio de Defensa en su sitio en la Dark Web 757.5 GB exfiltrados.
BREAKING #INCRansomware INFRA
INC #Ransomware DLS previously hosted in a Russian IP, a week ago!
https://t.co/JRHxpc4SFK
178.154.202.184
Tracks to Yandex Cloud Provider running on Linux Machine!
#infosec #OSINT #darkweb #deepweb #security #cybersecurity #threatintel #malware
This happens when same scam grp contacts 2 #Ransomware Affiliates to post comp. victim data on diff. #Dataleak Blogs!
They gt paid,bt victims don't knw whom to pay & obtain keys;nor groups!
#D0nut (D#nut) grp warns #INCRansomware abt shady leakers!
#infosec #security #OSINT
The sample would identify the victim, at this stage I unfortunately am not able to share this. I can share some TTPs of the #incransomware.
*Ransomware binary drops INC-README.html ransomnote in each folder
*Ransomware binary runs from c:\windows\temp\ folder (1/n)
🌐 Lockbit #ransomware team is back to full activity with 16 new victims 🚨
➡️ #INC Ransom Team added. One German 🇩🇪 victim is on the group's website 👁️ This site is somewhat similar to another group's site 🤔
#Lockbit #INCransomware
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers