Organisation

INC Ransom

Double-extortion ransomware crew, active since 2023, whose leak-site operator also runs Lynx's negotiation panels.

On 8 July, SOCRadar reported that one operator worked the negotiation panels of INC Ransom and the separate Lynx crew, linking the two ransomware brands without showing that they were the same organisation.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Two ransomware brands, one operator: how tied is INC Ransom really to Lynx?

Timeline for INC Ransom

#15 17 Oct

Mentioned in: FirstVDS loses client data via VMmanager

Cybersecurity: Threats and Defences

#11 16 Jul

Mentioned in: CISA's KEV list runs a month late

Cybersecurity: Threats and Defences

#10 8 Jul

Shared a negotiation-panel operator with INC Ransom

Cybersecurity: Threats and Defences: One operator ran both ransomware brands

#9 4 Jul

Mentioned in: BOD 26-04, a fortnight of triage

Cybersecurity: Threats and Defences

#9 1 Jul

Lynx crew cashes in FortiBleed haul

Cybersecurity: Threats and Defences

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

INC Ransom is a double-extortion ransomware crew active since 2023. The model combines disruption with a threat to expose stolen data. The group operates under its own name and leak-site identity. In June 2026, it posted UK manufacturer Stuga Machinery as a victim.

On 8 July 2026, SOCRadar reported that one operator worked negotiation panels for INC Ransom and the separate Lynx crew. The shared operator links the two brands at the point where ransom terms are handled. It does not by itself show that the crews share command, infrastructure, victims or every source of network access. INC Ransom therefore remains a distinct named operation with one confirmed staffing overlap. Further links between the brands would need separate attribution.

Common Questions

Is Lynx ransomware the same group as INC Ransom?

No. Lynx and INC Ransom are separate ransomware brands with their own leak sites, but SOCRadar found they share code lineage and, as of July 2026, one operator running both groups' negotiation panels.Source: SOCRadar

How many organisations has the FortiBleed access chain reached so far?

SOCRadar confirmed admin-level access on 409 targets, completed a full attack chain on 354, and counted at least 12 resulting ransomware deployments.Source: SOCRadar

How did the Lynx/INC crew get hold of 86,644 FortiGate passwords?

They cracked the credentials offline on a 45-GPU Hashtopolis cluster, exploiting legacy SHA-256 FortiOS hashes never re-hashed to PBKDF2.Source: SOCRadar

What should a company do if INC_RANSOM posts it on their leak site?

A leak-site posting means INC_RANSOM is asserting it has stolen data and is using the threat of publication as leverage. Affected organisations should immediately engage a specialist Incident Response firm, notify the ICO within 72 hours under UK GDPR Article 33, preserve all forensic evidence, and seek specialist legal advice before any ransom payment consideration. Payment does not guarantee data deletion.Source: NCSC incident response guidance, ICO breach notification requirements

What is INC_RANSOM and which organisations has it attacked?

INC_RANSOM is a double-extortion ransomware group active since mid-2023. It encrypts victim systems and threatens to publish stolen data on a dark-web leak site. Notable victims include NHS Scotland in early 2024 and UK manufacturer Stuga Machinery posted in June 2026. The group targets healthcare, manufacturing and professional services in North America and Europe.Source: NCSC guidance, NHS Scotland incident reporting, BlackFog ransomware report

What did SOCRadar find about INC Ransom and Lynx sharing an operator?

On 8 July 2026, SOCRadar reported a single operator running the negotiation panels for both INC Ransom and Lynx, the first confirmed link tying the FortiBleed credential haul to live ransomware deployment across both brands.Source: SOCRadar

Did INC_RANSOM attack the NHS?

Yes. In early 2024, INC_RANSOM attacked NHS Scotland, specifically Dumfries and Galloway NHS Board and NHS Lanarkshire, encrypting systems and stealing patient data. The group threatened to publish the stolen data. The incidents prompted NCSC guidance and ICO scrutiny. INC_RANSOM continued UK targeting in June 2026 with the posting of manufacturer Stuga Machinery.Source: NHS Scotland incident reports, NCSC advisory

Source Material

FortiBleed credential-theft campaign linked to Lynx ransomware SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations NCSC: Ransomware guidance