# A large food business in Vietnam was posted on a data leak site by the INC Ransom ransomware group ## Overview Appearing since July 2023, the INC Ransom hacker group (also tracked under the identifier GOLD IONIC) has quickly become one of the most dangerous Ransomware-as-a-Service (RaaS) threats to critical information infrastructures. Unlike some ransomware groups that claim to be "immune" from attacking medical or educational facilities, INC Ransom shows an unfounded attack attitude when continuously targeting public hospitals, local governments, and most recently, large manufacturing and processing enterprises in Vietnam. This group operates according to a double extortion strategy: both stealing sensitive data to threaten to publish it on the Data Leak Site on the Dark Web, and performing cross-platform encryption (Windows, Linux, VMware ESXi). INC Ransom prioritizes exploiting vulnerabilities on Internet-connected devices (Edge Devices/VPN) combined with legal tool abuse techniques (Living-off-the-Land) to bypass traditional EDR solutions. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/32919a5b-196f-4503-8412-d4aece14b8e1.png align="center") ## Hacker Profile ### Brief biography Appearing since July 2023, the INC Ransom hacker group (also tracked under the identifier GOLD IONIC) has quickly become one of the most dangerous Ransomware-as-a-Service (RaaS) threats to critical information infrastructures. Unlike some ransomware groups that claim "immunity" to attack medical or educational facilities, INC Ransom shows a baseless attack attitude when continuously targeting public hospitals, local governments and large manufacturing corporations. This group operates according to a double extortion strategy: both stealing sensitive data to threaten to publish it on the Data Leak Site on the Dark Web, and performing cross-platform encryption (Windows, Linux, VMware ESXi). INC Ransom prioritizes exploiting vulnerabilities on Internet-connected devices (Edge Devices/VPN) combined with legal tool abuse techniques (Living-off-the-Land) to bypass traditional EDR solutions. | **Metric / Characteristic** | **Analysis Details** | | --- | --- | | **Operating Model** | Ransomware-as-a-Service (RaaS) & Double Extortion | | **Target Operating Systems** | Microsoft Windows, Linux (Debian/RHEL), VMware ESXi | | **Primary Initial Access Vectors** | Exploitation of Public-Facing Applications (Citrix, RMM), Credential Abuse via IABs | | **Risk Level** | **CRITICAL** — Directly targets healthcare infrastructure and public-sector/government agencies | | **Priority Actions** | Immediately patch VPN/edge devices, block unauthorized RMM tools (e.g., AnyDesk), enable Credential Guard | ### Identification & Origin Information INC Ransom is an independent ransomware operation that provides malware and ransomware consoles to affiliates. These branch groups are solely responsible for probing and penetrating the victim's internal network and performing the encryption process. * Aliases: INC Ransom, Inc. Ransom, GOLD IONIC. * Time of operation: First recorded in July 2023 and maintaining a high frequency of attacks until now. * Attribution: There is no evidence to confirm sponsorship from the government (State-sponsored). The motive works 100% for financial gain. * Communication characteristics: On the extortion notice and Data Leak Site page, INC Ransom often uses "sarcastic" style when claiming the attack is a "cyber security testing service" to help victims realize their vulnerabilities. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/70e43b3b-5ef5-4f06-94a0-d4fbfd5b4c1f.png align="center") ### Target & Motive of Attack Health & Healthcare: Hospitals, regional health services (stolen millions of medical records and medical history). Local Government & Public Utilities: City councils, residential services management agencies (causing delays from emergency switchboards to infrastructure licensing). Education & Universities: Major universities in North America and Europe. Production & Logistics: Corporations manufacturing industrial equipment and electronic components. ## Outstanding Offensive Campaign ### Case Study Vietnam: Attack on Large Agricultural & Food Processing Corporation (July 2026) * Victim industry: Enterprise deeply processing agricultural products, producing consumer foods (spices, starch, MSG), combined with operating cold storage chains and auxiliary seaports in Vietnam. * Type of attack: In mid-July 2026, the INC Ransom hacker group announced that they had successfully penetrated the IT system of this enterprise, stealing a large amount of operating data, business contracts and internal documents, and threatened to make all data public on the * Data Leak Site. Real-life lessons: This is a typical case showing that large-scale manufacturing and processing enterprises in Vietnam (using many factories, warehouses, ERP/SCADA systems with inter-provincial connection and import-export infrastructure) are becoming the top targets of international RaaS groups. IT system downtime not only causes damage to information assets but also directly threatens the food supply chain and cold chain transportation. ### NHS Hospital Scotland (NHS Dumfries and Galloway - March 2024) * Scale of damage: Stolen 3 Terabytes of medical data. When the organization refused to negotiate, INC Ransom released a "proof pack" containing patient identification information, test records and medical correspondence on the Dark Web. ### Leicester City Council (UK - March 2024) * Scale of damage: Intruded into the public utility operating system, taking more than 3 Terabytes of residential data. Paralysis of the entire public service system and administrative switchboard for weeks. ## Detailed Analysis of Attack Flows ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f8d2d005-febb-4baa-8713-1c4ad37d45c7.png align="center") ### Phase 1: Initial Penetration INC Ransom does not depend on a single method but deploys flexibly in the following directions: * Exploiting Edge Appliances vulnerabilities: The group thoroughly exploited serious vulnerabilities on unpatched edge devices, notably Session Hijacking vulnerabilities Citrix Bleed (CVE-2023-4966), Citrix NetScaler (CVE-2023-3519), as well as ConnectWise ScreenConnect (CVE-2024-1708 / CVE-2024-1709). * Abuse of Credentials purchased from IABs: Affiliate groups purchase valid VPN/RDP accounts from Brokers on the Dark Web to log directly into the system without generating unusual warnings. ### Phase 2: Reconnaissance & Account Collection As soon as you set foot on a workstation on the network: * Network Mapping: Use legal tools such as NETSCAN.EXE (SoftPerfect Network Scanner) or PowerShell scripts to build an internal network map, identify Active Directory (DC) servers and IP ranges containing important resources. * Active Directory reconnaissance: Run AdFind.exe or PowerView to list Domain Admin users, vCenter/ESXi server lists, and SMB (Net Share) shared folders. * Memory Credential Dump: Use lsassy (remote credential collection tool via SMB/WMI) or ProcDump / Mimikatz to extract NTLM hashes and text passwords from the lsass.exe process. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/84a33d5a-0219-4708-900f-53e1ecea134a.png align="center") ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/cd246133-6cb9-45c9-bc1d-387fdabefc21.png align="center") ### Phase 3: **Persistence & Lateral Movement** To ensure connection is not lost if the original access point is disconnected: * Install Legitimate RMM (AnyDesk / ScreenConnect): INC Ransom pushes AnyDesk remote control software to critical workstations, turning it into a second backdoor channel. * LotL lateral movement: Attackers abuse WMI and PsExec commands to remotely execute commands on each computer in the network: ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/ff9cefef-a6e3-4803-af92-c4575c9a6b13.png align="center") * RDP Session Hijacking: Using the appropriated Domain Admin account to RDP directly to the main management server. ### **Phase 4: Defense Evasion & Going Dark** Before pushing the encrypted malicious file, INC Ransom actively "blinds" the monitoring system: * Disable EDR/AV: Use PowerShell to disable Windows Defender Real-time Monitoring and stop security services: ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/4ab76821-27cd-43c5-999b-133f78bd6f70.png align="center") Clear Event Logs: Delete all migration traces with the wevtutil command: * `wevtutil cl System` * `wevtutil cl Security` * `wevtutil cl Application` ### Phase 5: **Data Staging & Exfiltration** According to SentinelOne, the group spends from a few days to a few weeks carrying out this stage to serve the double extortion tactic: * Data compression: Collect accounting files, contracts, designs, and personnel records into .rar / .zip archives using WinRAR, often setting a password to avoid content detection by DLP solutions. * Extract to Cloud Storage: Use the command line tool MegaSync (mega-cmd), Rclone or FileZilla to push data to the attacker's cloud storage accounts via HTTPS protocol (Port 443). ### Phase 6: **Actions on Objectives - Encryption** Once the data has been successfully pushed, the encryption malware is activated all at once: * Multi-threaded encryption by CPU Core: SentinelOne recorded that the INC Ransom malware automatically calculates the optimal number of encryption threads using the formula Threads = Processors x 4 to exhaust the server hardware, completing encryption in the shortest time. * Delete recovery infrastructure: Execute the command to destroy the backup: * Handling VMware ESXi virtualization infrastructure: Linux/ESXi version malware sends the esxcli vm process kill command to terminate virtual machines, then directly encrypts the .vmdk virtual disk file. * Force printing Ransom Note: The malicious code pushes the INC\_README.txt file to the Windows Print Spooler service so that printers on the network continuously print out the blackmail notice. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/37d3d004-35de-45df-b0be-4e36d9ad2dde.png align="center") ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/06a0c87c-651c-4038-b8a2-cde4c72dcdd2.png align="center") ## SOC Expert Comments From the attack on agricultural and food processing enterprises in July 2026, combining data from SentinelOne & SOCRadar, the SOC team recorded specific risk factors of the manufacturing sector in Vietnam: * Distributed technology infrastructure (Multi-site infrastructure): Large processing enterprises often have executive offices, many processing plants in provinces, cold chain logistics zones and seaports. Using VPN/Edge lines connecting branches, if not thoroughly patched, will become a bridge for malicious code to spread throughout the network. * IT/OT intersection in processing plants: Production control systems (SCADA/PLC), automatic warehouse management and electronic scales are increasingly connected to the IT network. When INC Ransom encrypts ERP or Active Directory servers, the entire packaging, shipping and cold storage management process is stopped. ## Defense in Depth Recommendations For corporations operating under the closed Feed - Farm - Food model (3F Chain) including: Feed Mills ➔ Smart Farm System (Smart Farms) ➔ Clinics/Meat & Food Processing Plants (Processing Plants & Food Ops) ➔ Cold Storage & Transportation Chain (Cold Chain Logistics), the risk of supply chain disruption when infected with ransomware is infinite. equally serious. ### Network Architecture Partitioning & Production Network Isolation * **Applying the Purdue Model to Feed & Food Factory:** * Absolute separation between the IT office network (containing ERP/SAP/Active Directory servers) and the OT production line control network (PLC/SCADA for mixing animal feed, boiler control system, automatic weighing, cold processing line). * Set an intermediate OT DMZ zone with new generation firewall (NGFW), apply Zero-Trust policy: Prohibit all direct query connections from the office network to the factory PLC/SCADA without going through Jump-Host with MFA. * **Smart Farm Network Isolation:** * Large-scale livestock farms connected to the Operations Center via VPN/SD-WAN channel must be zoned separately (VLAN Farm). * Completely isolate farm IoT systems (temperature sensors, automatic ventilation systems, automatic feeders) from the common Active Directory. IoT devices are not allowed to join the internal Domain. ### **Cold Chain Continuity** * **Building a Manual Recovery Scenario (Offline Contingency Plan):** * Ransomware attacks cause the Warehouse Management System (WMS) and Transportation Management System (TMS) to be disconnected, causing fresh meat/frozen food to be damaged in transit. * Enterprises must have in place warehouse import/export processes and manual cold chain tracking using paper documents/distributed backup systems independent of the main Active Directory network when a disaster occurs. * **Protecting Cold Storage Monitoring Servers:** * The server that monitors cold and freezer temperatures must have a configuration image backed up (System Image) in Offline format so that it can be rebuilt within 30 minutes if deleted/encrypted. ### Edge Device Control & Remote Administration Tools (Edge & RMM Hardening) * **Patch emergency vulnerabilities on VPN devices connecting to Farms/Factories:** * Review and apply patches immediately for VPN/Citrix/Fortinet gateways connecting from the office to the factory and farm (especially the Citrix Bleed vulnerability CVE-2023-4966). * Enforce 2-factor authentication (Phishing-resistant MFA) for 100% of remote VPN connection accounts, including OT equipment vendor machine maintenance engineers. * **Completely ban unmanaged RMM tools (Unmanaged RMM):**Deploy * AppLocker / EDR Enforcement to completely block tools such as AnyDesk.exe, TeamViewer.exe, Rclone.exe, MegaSync.exe from running on all factory and farm computers. * Only standardized enterprise RMM tools (with centralized access logging and MFA required) are allowed. ## Hunting Queries & Specialized Monitoring Logic **Sigma Rule: Detect unauthorized RMM AnyDesk connection in Factory/Farm network** ## **MITRE ATT&CK** | **Tactic** | **Technique ID** | **Technique Name** | **INC Ransom Implementation Details** | | --- | --- | --- | --- | | **Initial Access** | T1190 | Exploitation of Public-Facing Application | Exploitation of vulnerabilities in edge-facing applications (Citrix NetScaler, ConnectWise ScreenConnect CVE-2024-1708/1709). | | | T1078 | Valid Accounts | Use of accounts purchased from Initial Access Brokers (IABs) or obtained through phishing. | | **Execution** | T1059.001 | PowerShell | Execution of encryption/system reconnaissance scripts and termination of security-related processes. | | | T1047 | Windows Management Instrumentation (WMI) | Abuse of `wmic.exe` to remotely execute malicious commands on workstations within the same domain. | | **Persistence** | T1219 | Remote Access Software | Installation of **AnyDesk** as a backup channel for maintaining remote access. | | **Privilege Escalation** | T1068 | Exploitation for Privilege Escalation | Exploitation of internal privilege-escalation vulnerabilities to obtain `NT AUTHORITY\SYSTEM` privileges. | | **Credential Access** | T1003.001 | LSASS Memory Dump | Abuse of **ProcDump** or **Mimikatz** to extract NTLM hashes and clear-text passwords from the `lsass.exe` process. | | **Discovery** | T1018 | Remote System Discovery | Use of **NetScan** to scan entire IP subnets for Active Directory servers and SMB shares. | | **Lateral Movement** | T1021.001 | Remote Desktop Protocol (RDP) | Lateral movement between servers using RDP with compromised domain accounts. | | | T1021.002 | SMB/Windows Admin Shares | Use of **PsExec** to deploy and execute ransomware payloads across multiple workstations. | | **Defense Evasion** | T1490 | Inhibit System Recovery | Execution of commands such as `vssadmin delete shadows /all /quiet` and `wmic shadowcopy delete` to prevent data recovery. | | | T1562.001 | Impair Defenses | Disabling Windows Defender services and terminating existing EDR/AV processes on affected systems. | | **Exfiltration** | T1567.002 | Exfiltration to Cloud Storage | Use of **MegaSync**, **Rclone**, or **FileZilla** to transfer compressed data archives created with WinRAR to attacker-controlled infrastructure. | | **Impact** | T1486 | Data Encrypted for Impact | Execution of a multi-threaded encryption payload targeting personal data, documents, and VMware ESXi virtual disk images (`.vmdk`). | ## IOCs [IOC/INC-Lynx Ransomware at main · TheRavenFile/IOC · GitHub](https://github.com/TheRavenFile/IOC/blob/main/INC-Lynx%20Ransomware) ## References [INC Ransom Ransomware - Blackpoint Cyber](https://blackpointcyber.com/threat-profile/inc-ransom-ransomware/) [Inc. Ransomware Ransomware: Analysis, Detection, and Mitigation](https://www.sentinelone.com/anthology/inc-ransom/) [Dark Web Profile: INC Ransom](https://socradar.io/blog/dark-web-profile-inc-ransom/)