INC RANSOMWARE: THREAT INTELLIGENCE

What it is

A threat-intelligence writeup on the INC Ransomware group (active since 2023, 870+ victims across US, Canada, Germany, UK, Australia) that de-anonymizes the group's victim negotiation panel and reverse-engineers its frontend. The value beyond the summary is a set of concrete indicators and infrastructure fingerprints.

Preconditions / Affected

This is investigative intel, not a vulnerability. It matters to defenders tracking INC infrastructure or hunting for related samples — not to any product owner needing to patch.

What to do

Use these indicators for hunting and blocking:

• Onion negotiation domain: incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion
• Real IP behind the panel: 178.20.41.208, port 1002 (login at http://178.20.41.208:1002/login)
• ASN / hosting: AS48282, Hosting technology LTD, Russia
• Sample MD5 (referencing the panel, ~April 2024): fb14aae2ed93a7ddfa718f433f585735
• Backend fingerprint: nginx 1.27.5 + Yii PHP 8.3.24 — pivotable for finding related hosts
• Frontend fingerprint: bundle index-k5F9oSPw.js, custom font BinancePlex, golden-yellow theme, API base /api/v1/company/

Leak categories the panel tracks (useful for scoping what an INC victim's exfil may include): Encrypted, Proof, AD Dump, Stocks, Contracts, Financial data, Confidential, Customer's data, Incidents, HR. The panel exposes a scheduled-leak countdown (leakAt timestamp), operator ban toggle, and paid/ransom-amount tracking — i.e., negotiators can see when their deadline fires and whether the operator has marked them paid.

The port choice (1002) is flagged as non-standard-port evasion (MITRE ATT&CK T1571); worth including in outbound-traffic detections on unusual high ports to obscure panels.

Caveats

• The author explicitly limits scope: no sample analysis, no MITRE mapping of TTPs, no tooling breakdown — for encryptor/deployment behavior you need another source.
• The WebSocket backend host is only labeled Hs "(likely the backend hostname)" — the author does not resolve it.
• IP-to-onion correlation is presented as an OSINT finding without a reproduction method in the excerpt; treat the real-IP claim as the author's assertion, and note infrastructure at that IP may be moved or taken down by the time you check.