{"id":1166,"date":"2026-08-20T10:58:10","date_gmt":"2026-08-20T05:28:10","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1166"},"modified":"2026-08-20T11:00:36","modified_gmt":"2026-08-20T05:30:36","slug":"inc-ransomware-raas-rust-veeam-credential-theft","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/inc-ransomware-raas-rust-veeam-credential-theft\/","title":{"rendered":"INC Ransomware Emerges as a Major RaaS Threat in 2026"},"content":{"rendered":"

INC ransomware has rapidly emerged as one of the most active ransomware-as-a-service (RaaS) operations, demonstrating how modern threat groups continue to scale attacks through proven enterprise weaknesses rather than novel exploits alone. Its affiliates combine exposed edge infrastructure, stolen credentials, legitimate remote administration tools, and Rust-based ransomware encryptors to compromise Windows, Linux, and virtualized environments with increasing efficiency.<\/p>\n

For enterprise security teams, INC’s growing activity reinforces a familiar reality: ransomware operators are succeeding by chaining together common security gaps across identity, endpoint, backup, and remote access infrastructure. As the group’s tactics continue to evolve, organizations need to strengthen detection, reduce attack surface exposure, and improve resilience against increasingly coordinated ransomware campaigns.
\n

\n
\n
\n
\n \"Hexnode-UEM-An-inside-look_infographics\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Hexnode UEM: An inside look\n <\/h4>\n

\n Look at how Hexnode UEM helps IT admins to manage and secure their corporate mobile devices.\n <\/p>\n \n Get the infographic\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section><\/p>\n

How INC Ransomware Executes Enterprise Attacks<\/h2>\n

Rather than relying on a single intrusion technique, INC affiliates combine multiple access vectors to maximize their chances of compromising enterprise environments. Initial access commonly begins through spear-phishing campaigns, credentials purchased from initial access brokers (IABs), or the exploitation of internet-facing applications, including vulnerabilities affecting platforms such as Citrix, Fortinet, and SimpleHelp.<\/p>\n

Once inside the network, the attackers establish persistence and expand their foothold using a combination of credential theft and legitimate administrative tools. Observed activity includes:<\/p>\n