INC Ransomware Rust Rewrite Adds Salted-DPAPI Veeam Credential Dumper Targeting Modern Backup Deployments Across Windows and ESXi

INC ransomware, now the fourth most active RaaS globally with 830+ victims since 2023, has completed a full Rust-based rewrite of both Windows and Linux/ESXi encryptors and deployed a modified Veeam-Get-Creds.ps1 variant with hardcoded SQL parameters specifically engineered to defeat Veeam's newer salted DPAPI credential encryption — effectively neutralizing a defense that organizations commonly rely upon for backup security. The group exfiltrates data via rclone to attacker-controlled storage before encrypting, and Linux/ESXi variants enumerate VMware volumes to maximize encryption speed and impact. With LockBit and BlackCat disrupted, INC has absorbed former affiliates and now concentrates fire on healthcare, legal, and manufacturing targets where downtime translates directly into ransom leverage.

With LockBit and BlackCat disrupted, INC has absorbed former affiliates and now concentrates fire on healthcare, legal, and manufacturing targets where downtime translates directly into ransom leverage.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.