INC Ransomware Leverages Rust Encryptors for Windows, Linux, and ESXi Attacks

Key Takeaways

• The INC ransomware operation has significantly upgraded its attack capabilities by rewriting its Windows and Linux/ESXi encryptors in Rust.
• This shift enables cross-platform attacks, complicates analysis for traditional security tools, and targets critical infrastructure like VMware and Veeam backups.
• INC continues to operate under a Ransomware-as-a-Service (RaaS) model, employing double extortion tactics and refining its affiliate program.
• The group leverages legitimate remote access tools and exploits known vulnerabilities, including CVE-2023-3519, CVE-2023-4966, CVE-2023-35082, and CVE-2024-4885, for initial access and lateral movement.

The INC ransomware group, which emerged in mid-2023, has rapidly evolved into a major threat within the cybercrime landscape. Operating as a Ransomware-as-a-Service (RaaS) provider, INC equips its affiliates with sophisticated tools to execute widespread attacks. Initially targeting sectors such as healthcare and education, the group has expanded its focus to include legal services, manufacturing, construction, and technology, specifically choosing industries more likely to yield quick ransom payments due to regulatory pressures.

Recent analysis by security researchers at Acronis has uncovered significant enhancements to INC’s operational infrastructure and toolset. These updates underscore the group’s long-term investment in expanding its attack surface and increasing its stealth. Acronis detailed in a report that both the Windows and Linux/ESXi encryptors have been completely rewritten in Rust, a modern programming language known for its performance and cross-platform compatibility. Furthermore, the group has upgraded its credential theft capabilities and streamlined its affiliate program to attract new operators more easily.

INC employs a dual-extortion strategy, encrypting victims’ files and threatening to publish stolen sensitive data on its dedicated leak site. This tactic creates immense pressure on victims, forcing them to consider both operational disruption and severe reputational or legal consequences if they refuse to pay.

Despite the disruption of a related source code seller in 2024, the original INC codebase continues to influence other ransomware families, such as Lynx and Knoba, which exhibit significant code similarities. This indicates that while INC innovates, its foundational components persist within the broader ransomware ecosystem.

INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors

A critical upgrade in INC’s arsenal is the complete rewrite of its Windows and Linux/ESXi payloads using Rust. This strategic move allows the group to develop and maintain a single codebase capable of targeting diverse operating systems and virtual environments. The adoption of Rust also introduces a new layer of complexity for security analysts, as the resulting binaries often present unique structural patterns that older detection tools may struggle to identify effectively.

The enhanced Windows encryptor now possesses the ability to automatically extract database connection settings from the registry. It also integrates a zero SQL server to specifically target Veeam backup deployments. This variant includes a fallback encryption mechanism for newer Veeam versions and formats its output in a standardized way, making it more efficient and reliable in real-world operations. The Linux/ESXi encryptor is designed to attack VMware infrastructure by intelligently identifying active volumes and differentiating between local fixed disks and network-mapped shares, optimizing encryption speed and impact.

Both encryptor variants utilize a partial encryption method, focusing on specific file sizes while intentionally bypassing critical system files. This ensures that the compromised system remains operational enough to display the ransom note, guaranteeing visibility for the victim. The payload is highly customizable, allowing affiliates to fine-tune attack parameters via command-line arguments, providing granular control over each intrusion.

Updated Tooling and Lateral Movement Techniques

Beyond its advanced encryptors, INC affiliates employ a range of legitimate remote access tools and commercial software to navigate victim networks discreetly. Tools like CobaltStrike, AnyDesk, ScreenConnect, and TeamViewer have been observed in recent INC incidents. By leveraging these commonly used applications, the attackers can blend their activities with normal IT operations, making detection more challenging. Additionally, threat actors deploy utilities such as PsKill and custom process terminators to disable endpoint security solutions before deploying the final ransomware payload.

For credential harvesting, INC utilizes specialized scripts designed to target newer Veeam backup installations, circumventing salted DPAPI encryption. Stolen data is then compressed using 7-Zip before being exfiltrated to attacker-controlled cloud storage via rclone.

Indicators of Compromise (IoCs)

The following Indicators of Compromise were identified in relation to INC ransomware activity, as detailed in the Acronis Threat Research Unit report:

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Enforce Multi-Factor Authentication (MFA): Implement MFA across all remote access points and critical systems to prevent unauthorized access, even if credentials are compromised.
• Patch Vulnerabilities Promptly: Regularly update and patch all software and systems, paying close attention to known vulnerabilities like CVE-2023-3519, CVE-2023-4966, CVE-2023-35082, and CVE-2024-4885, which INC is known to exploit.
• Maintain Robust Backups: Ensure comprehensive, regular backups of all critical data. Crucially, these backups must be isolated from the primary network and stored offline or in immutable cloud storage to prevent them from being encrypted or deleted during an attack.
• Monitor for Legitimate Tool Abuse: Implement enhanced monitoring for the suspicious use of legitimate remote access and administration tools (e.g., AnyDesk, ScreenConnect, TeamViewer, CobaltStrike, PsKill, rclone, 7-Zip) within your environment.
• Strengthen Endpoint Security: Deploy and maintain advanced endpoint detection and response (EDR) solutions capable of identifying and blocking novel threats and behaviors associated with Rust-based malware.
• Conduct Employee Training: Educate employees on phishing, social engineering tactics, and the importance of strong password hygiene, as initial access often relies on human error.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.