INC Ransom

{
  "id": "ATTACK:enterprise:G1032",
  "title": "INC Ransom",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1032",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--cb41e991-65f4-4668-a65f-f4200545b5a1",
  "external_id": "G1032",
  "domain": "enterprise",
  "created": "2024-06-06T17:16:38.704Z",
  "modified": "2026-07-31T20:48:47.333Z",
  "version": "1.0",
  "aliases": [
    "INC Ransom",
    "GOLD IONIC"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "GOLD IONIC"
    },
    {
      "source_name": "Secureworks GOLD IONIC April 2024",
      "url": "https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"
    },
    {
      "source_name": "Cybereason INC Ransomware November 2023",
      "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"
    },
    {
      "source_name": "SentinelOne INC Ransomware",
      "url": "https://www.sentinelone.com/anthology/inc-ransom/"
    },
    {
      "source_name": "Bleeping Computer INC Ransomware March 2024",
      "url": "https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/"
    }
  ]
}