INC Ransomware
Software · ATTACK:enterprise:S1139
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1139",
"title": "INC Ransomware",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1139",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f25d4207-25b2-4bb0-a17a-403943c670ad",
"external_id": "S1139",
"domain": "enterprise",
"created": "2024-06-06T18:28:58.878Z",
"modified": "2024-10-28T19:03:40.175Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Secureworks GOLD IONIC April 2024",
"url": "https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"
},
{
"source_name": "SentinelOne INC Ransomware",
"url": "https://www.sentinelone.com/anthology/inc-ransom/"
},
{
"source_name": "Huntress INC Ransom Group August 2023",
"url": "https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0225c7c8-db18-469d-a1aa-566900e297a7
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0788ef6e-c65f-481b-9d33-9ae7945bbc0e
Huntress INC Ransom Group August 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1566
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1787ebc1-29a3-4d93-ba24-baf11a4a7d19
SentinelOne INC RansomwareATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32285265-97d8-4d93-b601-ade0155b2a9e
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1652
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c540022-c6f3-4ca1-a3fa-f3f8fc3e0060
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46a953d5-132d-4748-aa5d-7950103e684d
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e0bb60b-21e7-4913-862b-61f8831c1732
Secureworks GOLD IONIC April 2024 · Huntress INC Ransom Group August 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68f0f623-b5f2-47a8-8206-eabfb472d7aa
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c62f14a-0c1a-4dea-82eb-8c352d0c5f70
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d8dcd8d-3ca4-4464-b8ab-9dee24f93c70
Cybereason INC Ransomware November 2023 · SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--821c06ba-1cdc-40a7-bd4a-97e996bb973e
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ca67039-be32-4fed-a40a-5ddfe4d6fff2
Cybereason INC Ransomware November 2023 · SentinelOne INC RansomwareATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2a696d7-b929-4307-9f2b-df558a7762cb
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f507e65e-735e-40af-bb77-cd9f0b14f8f1
Cybereason INC Ransomware November 2023ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:S1139
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa1a6124-f244-4509-9326-f3ff9eb62ab8
Secureworks GOLD IONIC April 2024 · Cybereason INC Ransomware November 2023ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffe4e161-2ebc-41da-b6e6-227cc6ead76c
Secureworks GOLD IONIC April 2024 · Cybereason INC Ransomware November 2023