INTRODUCTION
This article intended to focus on the unexplored side of INC Ransomware Group which is not yet reported (or limited reporting). Hence, you would not see any sample analysis, MITRE Framework or Toolings used by the group, however if you intend to know what’s different, this is for you!
INC Ransomware Group emerged in 2023, infecting about 870+ victims so far, targeting the US, Canada, Germany, UK, Australia and many more.
BREAKTHROUGH — DISCOVERING NEGOTIATION PANEL REAL IP
During the routine scouting of Investigation, I found the real IP address of the Negotiation Chat Panel dedicated for INC Ransomware Victims.
The Onion Domain of INC is:-
incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion
Here is the Web URL Chat:-
It is evident that this has been active since 2024, as its found in an INC Sample, tracing back to April 2024.
- MD5: fb14aae2ed93a7ddfa718f433f585735
Upon inspecting the Tech Stack, it is found that the back-end is being hosted on Server: nginx 1.27.5 with Yii PHP 8.3.24 framework.
Here is the Real IP Address of the Onion Domain discovered:-
URL: http://178.20.41.208:1002/loginIP: 178.20.41.208ASN: AS 48282Hosting: Hosting technology LTDLocation: Russia
1002: UNUSUAL PORT NUMBER
It is unusual for Ransomware to use the Port Number 1002. This could be for:-
Non-Standard Port Evasion (MITRE ATT&CK T1571): Threat actors frequently use non-standard ports to bypass corporate firewalls. Many basic firewalls automatically block or heavily flag suspicious outbound traffic on common web ports. By binding their malicious chat server to an obscure port like 1002, they attempt to blend in with background network noise or exploit weak firewall rules that fail to inspect deeper packet traffic.
Internal convention: Some ransomware groups (especially those using custom panels) pick arbitrary high ports (1000+ range) for their C2/panel infrastructure. Some use high ports like 8443, 1337, 31337, 9999 for admin panels to reduce noise.
JS FILE ANALYSIS
While checking out both Clear Web and Onion Domain of same Negotiation Panel, I uncovered a JS file named “index-k5F9oSPw.js”.
This is the main bundled JavaScript for the company-side ransomware panel (built with React + Redux + Socket.io).
KEY FINDINGS
TECH STACK
- ➵React 18 + Redux Toolkit
- ➵Socket.io (real-time chat)
- ➵React-Toastify for notifications
- ➵react-timer-hook (countdown timers)
- ➵react-viewer (image gallery)
CORE FEATURES
- ➵Login with Token-based Auth
- ➵Chat interface with Support (real-time messaging)
- ➵Announcement System (leaks, proofs, categories like “Encrypted”, “AD Dump”)
- ➵Disclosure/Leak management
- ➵File Upload for Test Decryption
- ➵Ransom Tracking (paid status, amounts in $)
- ➵Ban System
BACKEND INTEGRATION
- ➵API endpoints under /api/v1/company/
- ➵Socket events: ROOM:JOIN, ROOM:NEW_MESSAGE, ROOM:ACTION, etc.
- ➵WebSocket connection to Hs (likely the backend hostname)
SECURITY MEASURES/OBFUSCATION
- ➵Some strings are encoded (e.g., decodeURIComponent)
- ➵Token stored in Redux
- ➵Aggressive no-cache on previous PHP backend
Following are the utilities used in the JS file of INC Ransomware Negotiation Portal:-
BREAKING DOWN JS FILE
Inspecting each element from the file, we get to know the following pointers such as:-
- MESSAGE SENDING LOGIC
sendMessage: c => { if (s.is_banned) { // s = company state oe.error("Error: ban"); // toast return; } const d = { // fake loading message _id: "loading", message: c.split('\n').map(m => encodeURIComponent(m)), type: "message", sender: "company", is_deleted: false, is_read: false, is_loading: true, company: a, // company id createdAt: Date.now() }; e(Ed(d)); // Redux dispatch new message i?.emit("ROOM:NEW_MESSAGE", { // Socket emit message: c, type: "message", company: a });}
2. LEAK ANNOUNCEMENT LOGIC
// Fetch announcementskd = po("company/getAnnouncement", async () => await on.get("/api/v1/company/get/announcement").then(...));// Fetch disclosures/leaksDd = po("company/getDisclosures", async () => await on.get("/api/v1/company/get/disclosures").then(...));// Redux reducers for leaksputDisclosure: (e, t) => { e.disclosures.push(t.payload) }
Leak categories decoded as following:-
- Encrypted
- Proof
- AD Dump
- Stocks
- Contracts
- Financial data
- Confidential
- Customer’s data
- Incidents
- HR
The group also maintains a Countdown, whose logic can be spotted at
o.leakAt > Date.now() && <Zr expiryTimestamp={o.leakAt} />
NOTE: A Redux action is a plain JavaScript object that describes an event or a change that happened in your application
3. API ENDPOINTS
- ➵GET /api/v1/company/get/announcement
- ➵GET /api/v1/company/get/disclosures
- ➵POST /api/v1/blog/download/{id} (for proofs)
- ➵Socket base: Hs (from env)
Socket Events Handled:-connectconnect_errordisconnectROOM:JOINROOM:NEW_MESSAGEROOM:READ_MESSAGESROOM:ACTION (ransom change, ban, paid, announcement, delete, etc.)ROOM:TYPINGROOM:LEAVE
Redux Actions=============Ed = add messageO8 = read messagesKx = change ransommy = reset passwordXx = ban chate8 = mark paidt8 = new announcementn8 = open ransomL8 = delete all messagesI8 = delete single messageL6 = remove announcementr8 = delete leak
4. COUNTDOWN LOGIC
This defines the scheduled leak:-
o.leakAt > Date.now() && <Zr expiryTimestamp={o.leakAt} />
DECODING STYLE
The negotiation panel is a modern, dark-themed admin/support panel UI built with plain CSS (no Tailwind, though it mimics utility classes).
Some of the interesting observations on the panel are:-
- ➵Custom Font used: BinancePlex (Medium + Regular) — which is a strong Binance/crypto exchange influence
- ➵Primary color is Golden Yellow — common in Crypto, Trading, and “Premium” panels
- ➵Heavy use of Flexbox for layout
- ➵Animation classes (sparkling, twinkling, etc.) for attention-grabbing elements
- ➵Responsive considerations for mobile (Toastify adjustments)
NOTE: The exclusive finding ends here. The following section is the generic intel about INC Ransomware, which I had analyzed various aspects of this Ransomware Group to get a generic picture from different sources.
RANSOM NOTE
Here is the a Ransom Note obtained from the Group, which goes back to 2025:-
-----> Your data is stolen and encrypted.If you don't pay the ransom, the data will be published on our TOR darknet sites.The sooner you pay the ransom, the sooner your company will be safe.Tor Browser Link: http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/Link for normal browser: http://incblog.su/ -----> What guarantees are that we won't fool you?We are not a politically motivated group and we want nothing more than money.If you pay, we will provide you with decryption software and destroy the stolen data.After you pay the ransom, you will quickly restore your systems and make even more money.Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you.Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it.If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future.You can get more information about us on Twitter https://twitter.com/hashtag/incransom?f=live-----> You need to contact us on TOR darknet sites with your personal IDDownload and install Tor Browser https://www.torproject.org/Write to the chat room and wait for an answer, we'll guarantee a response from you.Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack tens of companies around the world.Tor Browser Link for chat: http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/Your personal ID: xxxxxxxxxxxxxxxxxxxx-----> Warning! Don't delete or modify encrypted files, it will lead to problems with decryption of files!-----> Don't go to the police or the FBI for help. They won't help you.The police will try to prohibit you from paying the ransom in any way.The first thing they will tell you is that there's no guarantee to decrypt your files and remove stolen files.This is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it's a matter of our reputation.Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees.The police and the FBI don't care what losses you suffer as a result of our attack, and we'll help you get rid of all your problems for a modest sum of money.If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom.The police and FBI won't be able to stop lawsuits from your customers for leaking personal and private information.The police and FBI won't protect you from repeated attacks. -----> Don't go to recovery companies!They are essentially just middlemen who will make money off you and cheat you.We are well aware of cases where recovery companies tell you that the ransom price is $5M dollars, but in fact they secretly negotiate with us for $1M.If you approached us directly without intermediaries you would pay several times less.-----> For those who have cyber insurance against ransomware attacks.Insurance companies require you to keep your insurance information secret.In most cases, we find this information and download it.-----> If you do not pay the ransom, we will attack your company again in the future.
INSIDE NEGOTIATION PORTAL
The negotiation portal seems to be bit more attractive here. It is divided into 2 sections namely: Introduction and Chat.
Unlike other Ransomware Chat Rooms, the victim could not initiate the Chat without attaching the encrypted/locked file.
The panel uses JWT for session auth which is valid for 30 days.
The Algorithm is likely HS256 (symmetric key) in the backend.
INC RANSOM HOSTING TIMELINE
During analysis, 9 domains of INC had been found which are clear web domains. They are:-
incbackend.top: November 2023 to November 2024incapt.blog: November 2023 to August 2025incapt.su: February 2024 to March 2025inccdn2.lol: April 2024 to September 2024inccdn1.lol: April 2024 to November 2024incblog.su: April 2024 to May 2025incback.su: April 2024 to May 2025inccdn3new.lol: July 2024 to December 2024incadmin.su: February 2025 to May 2025
Graphically, we can visualize like this:-
There are about 170 Unique IPs found (with many repetitions). Out of which, 110 IPs are mapped to Russia, which marks 65%. It’s being followed by Germany(11), the US(9), Finland (6) and the Netherlands (6).
When following the hosting providers, naturally we can see the sharp increase of 🇷🇺 Russian Providers. Among 42 Hosting Providers, 19 are from Russia (45%).
Among the detailed IP Analysis, it is found that there are 10 IPs which are overlapped 6 times each. They are:-
Overlapping the above IPs 6 times each, makes it a strong indicator to associate the host with INC Ransomware Group or a constant network utilized by INC Group.
INTERESTING FACTS
Few of the interesting facts uncovered during the above IP Set are:-
➤incback.su and incblog.su are effectively the same deployment
Diffing the two IP sets shows near-total overlap — both share the identical “unique” block (185.72.144.221, 147.45.198.91, 194.59.186.197 etc.) on top of the same shared CDN pool, with only a handful of IPs differing (a few extra Google Cloud addresses on one side). This is consistent with both hostnames resolving to the same backing cluster, most likely as aliases or load-balanced mirrors of one deployment, captured at two slightly different points in time rather than genuinely separate infrastructure.
➤ CDN nodes show a Rotation Pattern
inccdn1.lol, inccdn2.lol, and inccdn3new.lol overlap almost completely in IP membership, and the naming itself tells a story: sequential numbering, with the third instance explicitly suffixed “new”. This reads as the operators cycling a CDN-fronting hostname — likely in response to blocklisting, abuse reports, or a prior domain being burned — while keeping the underlying proxy pool essentially intact. The lesson for defenders: blocking a single `inccdnN.lol` hostname has limited value, since the group appears to reuse the same IP infrastructure under a fresh name shortly after.
➤Mixed legitimate cloud usage inside the pool
Several IPs in the dataset fall within address ranges operated by major cloud providers rather than typical bulletproof/offshore hosts:
158.160.147.12: sits in a Yandex Cloud range, and is part of the core shared pool present across almost every domain
Multiple `34.x`/`35.x` addresses (`34.51.133.73`, `34.88.140.188`, `34.116.204.48`, `34.175.159.164`, `34.17.99.195`, `35.198.79.102`) fall within Google Cloud ranges and appear in the `incback.su`/`incblog.su`/`inccdn1.lol` unique blocks.
15.197.240.20: Unique to `incbackend.top`, sits in an AWS-associated range
➤Cloudflare Fronting
Two of incapt.blog’s IPs — 172.67.210.81 and 104.21.37.155 — fall in known Cloudflare Anycast ranges. None of the other 8 domains show any Cloudflare IPs; they all exposed origin infrastructure directly.
ONION DOMAINS
So far, we know there are 5 Onions associated with INC Ransomware Group. They are:-
In this, only incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion is working (ATTOW).
In this, you can see the victim list with each icons under it. Those are:- Encrypted (Lock Icon), Proof (Image Icon) and AD Dump (Bug Icon).
The victims with “Lock Icon only” listed does not list any data or proof as it’s in the initial phase of negotiation or relatively new entry to the group’s DLS. Hence, the state is Encrypted.
The victims with “Image Icon only” lists the image from the leak as Proof of Hack. Also, the database would be listed as directory to navigate easily.
In the above image, you can see the size of the Database along with Disclosure Date and 6 icons namely:-
- Contracts
- Confidential
- Customer’s Data
- Financial Data
- Incidents
- HR
Each Victim is being assigned a unique ID which can be spotted at the path of the Disclosure (above).
While viewing DB, it looks like this:-
Upon analyzing the Dataset Size, it is found that the group is capable to host large files in a single server, which is common with major ransomware gangs like WorldLeaks.
BUILDER TIMELINE ANALYSIS
NOTE: This section does not cover any sample analysis of INC Ransomware as there are plenty reports available from multiple sources.
Let us check the timelines of the samples uncovered so far for INC Ransomware Group.
During my investigation, I had uncovered 108 Samples of INC Ransomware. Drawing an interesting timeline, we can see the following tidbits:-
Most of the samples’ “Creation Date” is set to 9th April 2024, numbered at 52.
A little drop is observed during this project inception i.e. in 2024 and 2023 and the following statistics shows:-
Here is the data for quick look-up:-
# | Date
==========
52 | 9th April 2024
28 | 14th August 2025
7 | 24th May 2025
5 | 13th October 2023
3 | 19th June 1992
2 | 12th October 2023
2 | 17th February 2024
1 | 12th September 2023
1 | 13th November 2023
1 | 14th August 2023
1 | 20th December 2023
1 | 21st September 2023
1 | 22nd September 2023
1 | 2nd September 2023
1 | 30th September 2023
1 | 9th December 2023Upon analyzing the file size (EXE), there are 49 Samples uncovered with the file sized at 161.50 KB. When we narrow down, we can extract information such as:-
This underlines the fact that a well-cooked ready to deploy samples are being generated on the fly of INC RaaS Ecosystem by various affiliates, just like AKIRA Group.
It’s interesting to note that both smallest EXE (140KB) and largest (3.81MB) builds traced back to October 2023, which can be assumed to be the sample created by the core member of INC Ransom Project.
Also, other sizes also did appear during that timeframe, which makes it experimental by the group, trying various builds with different options.
# | Size
===========
49 | 161.50 KB
35 | 2.10 MB
10 | 142.00 KB
3 | 202.00 KB
2 | 161.00 KB
2 | 177.05 KB
1 | 1.88 MB
1 | 140.00 KB
1 | 141.00 KB
1 | 156.68 KB
1 | 157.00 KB
1 | 161.54 KB
1 | 3.81 MB Soon after, the group decided to sell off their INC Project which was found on RAMP forum “FOR SALE” for $300,000 in March 2024.
NOTE: It is assumed that another group named “LYNX” emerged right after this purchase as they too share identical code base. So there is a high chance that the group might have purchased it, or INC might have created another spin-off (rebranding) for their project to show the world that the data is being purchased at underground forums, to create a fake notion of Ransomware Panel Sale.
One thing was evident…
The Group had undergone a stable version twice:-
- 162.50KB: Soon after the sale in March 2024, there are 49 samples uncovered with same file size 162.50KB which are exactly generated on same date: 9th April 2024
2. 2.10MB: By May 2025, the group had finished a stable build to infect their targets and also might have on-boarded multiple affiliates, which started to surface too many builds targeting multiple victims. There are 35 builds traced to 24th May 2025 and 14th August 2025
NOTE: From this 2 events, we can understand the group had added additional capabilities to the builds, which is evident from the increase file size in newer builds. This also signals multiple affiliates got onboarded and more samples are generated on the fly.
Another interesting find is: the Group tampered the creation date of 3 builds to 19th June 1992.
So far, the group had targeted 872 Victims (ATTOW), from which 200+ victims are targeted in 2025 and 150+ victims already crossed in 2026 till now.
NOTE: Hence, we can’t say they are out of business because Lynx Group gained 250+ victims added to their list in 2025. Moreover, INC Ransomware is going stronger than ever with other spin-offs like Lynx or Sinobi.
The above trend may get a change with the uncovering of newer samples and tradecrafts. This change would be updated in this blog post.
Leave a Reply