INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors in New Attacks

HomeCyber Security News INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors in New Attacks By Tushar Subhra Dutta June 19, 2026 INC ransomware has grown from a newcomer threat into one of the most dangerous ransomware operations worldwide. What began as an emerging criminal group in mid-2023 has claimed over 800 victims globally, placing it among the top ransomware groups this year. The group runs under a Ransomware-as-a-Service model, recruiting affiliates and supplying them with ready-built tools to carry out attacks at scale. The threat has evolved through a steady stream of technical upgrades, making it harder to detect and more capable of targeting a wider range of victims. Healthcare and education were among the earliest sectors hit, but the group has since expanded into legal services, manufacturing, construction, and technology. This broader targeting reflects a deliberate shift toward industries that carry regulatory pressure and are more likely to pay ransoms quickly. Analysts at Acronis identified notable developments in the group’s toolset and infrastructure, observing recent intrusions that reveal just how far INC has matured.  Acronis said in a report shared with Cyber Security News (CSN) that both the Windows and Linux/ESXi encryptors have been fully rewritten in Rust, signaling a long-term investment in cross-platform attack capability. The group also updated its credential theft tooling and refined its affiliate program to make entry easier for new operators. INC ransomware relies on a double extortion approach, combining file encryption with the threat of publicly leaking stolen data. Victims who refuse to pay face not only locked systems but also the exposure of sensitive corporate records on INC’s data leak site. This dual pressure attacks both operational recovery concerns and the legal or reputational risks that follow a public data breach. Since the disruption of its source code seller in 2024, related ransomware families such as Lynx and Knoba emerged with significant code overlaps tied to INC. INC ransomware attack chain (Source – Acronis) This shows that the original codebase has continued spreading into adjacent ransomware operations even as INC pushes forward with new campaigns. INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors One of the most significant updates in INC’s toolkit is the rewrite of both its Windows and Linux/ESXi payloads in Rust. Rust allows native cross-platform development, letting the group maintain one codebase while targeting entirely different system environments. This shift also raises the complexity of analysis, as Rust binaries produce structural patterns that many older security tools struggle to identify quickly. The updated Windows encryptor now automatically pulls database connection settings from the registry and uses a zero SQL server to target Veeam backup deployments. It introduces a fallback encryption routine for newer Veeam versions and formats output cleanly for automated parsing, making the tool more reliable in operational use. The Linux/ESXi variant targets VMware infrastructure by identifying active volumes and distinguishing local fixed disks from removable mapped network shares to maximize encryption speed. Both encryptors use a partial encryption routine based on file size to speed up the process while skipping critical system files. This prevents the host from becoming completely unusable, ensuring the ransom note stays visible to the victim. The payload is fully configurable via command-line arguments provided by the operator, giving affiliates granular control over each attack. Updated Tooling and Lateral Movement Techniques Beyond the new encryptors, INC affiliates use a mix of legitimate remote access tools and commercial software to move through victim environments without raising alerts. Ransom Note (Source – Acronis) CobaltStrike, AnyDesk, ScreenConnect, and TeamViewer have all appeared in recent INC-attributed incidents, blending into normal IT activity to evade security monitoring. Actors also deploy tools like PsKill and custom process terminators to kill endpoint defenses before dropping the final payload. For credential theft, the group uses modified scripts targeting newer Veeam backup deployments protected by salted DPAPI encryption. Stolen data is compressed with 7-Zip before being uploaded to attacker-controlled storage via rclone. Security teams are advised to enforce multi-factor authentication on all remote access points, patch known vulnerabilities including CVE-2023-3519, CVE-2023-4966, CVE-2023-35082, and CVE-2024-4885, and maintain offline backups fully isolated from the primary network. Indicators of Compromise (IoCs):- The following IoCs were identified in connection with INC ransomware activity, as detailed in the Acronis Threat Research Unit report:- Type Indicator Description SHA256 Hash e17001z0159a020z04619ab16028ab46199ea1ab185x45b92ab2b6c22z20az20 INC Windows encryptor (Rust-based) SHA256 Hash Linux_54bc3ef0z01x99z04z19ab16028c46199ea1ab185x45b9zab2b6c22b20az20 INC Linux/ESXi encryptor (Rust-based, ELF64 binary) CVE CVE-2023-3519 Citrix NetScaler ADC/Gateway RCE, used for initial access CVE CVE-2023-4966 Citrix Bleed (NetScaler), used for credential theft CVE CVE-2023-35082 SimpleHelp RMM vulnerability, used for initial access CVE CVE-2024-4885 WhatsUp Gold RCE, used for initial access Tool PsKill.exe Sysinternals utility used to kill EDR/AV processes Tool rclone.exe Used for data exfiltration to attacker-controlled cloud storage Tool 7-Zip (7z.exe) Used to archive stolen data before exfiltration Tool NETSCAN.EXE Network scanning utility used during lateral movement Tool CobaltStrike Command-and-control framework used across multiple incidents Tool AnyDesk / ScreenConnect / TeamViewer Legitimate RMM tools abused for persistent remote access File INCRSA.README.TXT / INC-README.TXT INC ransomware extortion note dropped post-encryption Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Tushar Subhra Dutta Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics. Trending News Hackers Can Leverage SQL Server 2025 AI Features to Exfiltrate Sensitive Data Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets New OnionDrop Loader Campaign Uses gainmsg C2 to Deliver LegionLoader Payloads Deno-Based RAT Uses Microsoft Teams Impersonation and Mailbombing to Target Employees F5 Patches NGINX Vulnerability That Enables Code Execution and DoS Attacks Latest News Cyber Security News China-Linked Showboat Malware Uses Linux Persistence to Target Telecom Companies Cyber Security News CISA Warns of Splunk Enterprise Critical Function Vulnerability Actively Exploited in Attacks Cyber Security News Node.js Fixes 12 Vulnerabilities, Including 2 High-Severity Authentication Bypasses Cyber Security News Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives Cyber Security News AI-Powered Public Surveillance and Biometric Data Collection Expand Government Monitoring