From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware

Reported 17 Jun 2026 by otx · Severity: medium

INC has evolved from an emerging ransomware-as-a-service operation into one of the most active groups in 2026, claiming over 800 victims since 2023. The disruption of LockBit and BlackCat's shutdown created opportunities for INC to expand as affiliates migrated. Both Windows and