AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G1032 · 25 ATT&CK techniques · 0 correlated reports

INC Ransom

Aliases: GOLD IONIC, INC Ransom

[INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the deployment of [INC Ransomware](https://attack.mitre.org/software/S1139) that has been active since at least July 2023. [INC Ransom](https://attack.mitre.org/groups/G1032) has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)

Open interactive actor investigation

ATT&CK techniques

T1021.001T1036.005T1046T1047T1049T1059.003T1069.002T1070.004T1071T1074T1078T1087.002T1105T1135T1190T1219T1486T1537T1560.001T1566T1569.002T1570T1588.002T1657T1685

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
Tor tool reference — Explicit actor uses software relationship in pinned ATT&CK
Nltest tool reference — Explicit actor uses software relationship in pinned ATT&CK
esentutl tool reference — Explicit actor uses software relationship in pinned ATT&CK
AdFind tool reference — Explicit actor uses software relationship in pinned ATT&CK
Rclone tool reference — Explicit actor uses software relationship in pinned ATT&CK
T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1046 Network Service Discovery simulation — Exact active technique ID
T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
T1047 Windows Management Instrumentation simulation — Exact active technique ID
T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
T1049 System Network Connections Discovery simulation — Exact active technique ID
T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.003 Windows Command Shell simulation — Exact active technique ID
T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1069.002 Domain Groups simulation — Exact active technique ID
T1069.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1070.004 File Deletion simulation — Exact active technique ID
T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1071 Application Layer Protocol simulation — Exact active technique ID
T1071 detection rules — Exact active technique ID; not actor-specific detector coverage
T1074 Data Staged simulation — Exact active technique ID
T1074 detection rules — Exact active technique ID; not actor-specific detector coverage
T1078 Valid Accounts simulation — Exact active technique ID
T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
T1087.002 Domain Account simulation — Exact active technique ID
T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1105 Ingress Tool Transfer simulation — Exact active technique ID
T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
T1135 Network Share Discovery simulation — Exact active technique ID
T1135 detection rules — Exact active technique ID; not actor-specific detector coverage
T1190 Exploit Public-Facing Application simulation — Exact active technique ID
T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
T1219 Remote Access Tools simulation — Exact active technique ID
T1219 detection rules — Exact active technique ID; not actor-specific detector coverage
T1486 Data Encrypted for Impact simulation — Exact active technique ID
T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
T1537 Transfer Data to Cloud Account simulation — Exact active technique ID
T1537 detection rules — Exact active technique ID; not actor-specific detector coverage
T1560.001 Archive via Utility simulation — Exact active technique ID
T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1566 Phishing simulation — Exact active technique ID
T1566 detection rules — Exact active technique ID; not actor-specific detector coverage
T1569.002 Service Execution simulation — Exact active technique ID
T1569.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1570 Lateral Tool Transfer simulation — Exact active technique ID
T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
T1588.002 Tool simulation — Exact active technique ID
T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1657 Financial Theft simulation — Exact active technique ID
T1657 detection rules — Exact active technique ID; not actor-specific detector coverage
T1685 Disable or Modify Tools simulation — Exact active technique ID
T1685 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-id Module 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-name Module 12 — Human-layer and physical testing
Red Team & Offensive Security · explicit-name Malware, phishing, ransomware, and behavior extraction
Digital Forensics & Incident Response (DFIR) · explicit-name Human, workload, pipeline, and emergency identity
Cloud Security · explicit-name Scenario-based cyber risk assessment and treatment
Governance, Risk & Compliance (GRC) · explicit-name Weakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-match Data classification, storage, cryptography, keys, backup, and deletion
Cloud Security · topic-match Cloud logging, detection engineering, ATT CK, and response automation
Cloud Security · topic-match Module 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-match Module 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-match Research governance, authorization, and safety
Vulnerability Research & Exploit Development · topic-match