Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2023-3519 | 9.8 | 99.8% | ✅ listed | available | 89.5 (Critical) |
| CVE-2023-48788 | 9.8 | 98.5% | ✅ listed | available | 89.9 (Critical) |
| CVE-2024-57727 | 9.1 | 95.2% | ✅ listed | available | 89.76 (Critical) |
| CVE-2025-5777 | 7.5 | 100.0% | ✅ listed | available | 81.18 (High) |
| CVE-2024-57726 | 9.9 | 66.6% | ✅ listed | available | 89.78 (Critical) |
Acronis breaks down INC Ransomware's full attack chain
Acronis Threat Research Unit has published a detailed analysis of INC Ransomware, tracing the group’s evolution from an emerging RaaS operation to a top-tier actor with more than 800 victims since 2023. The report breaks down the full attack chain from initial access through encryption and exfiltration, and ships with YARA rules and IOCs for defenders to deploy immediately.
The analysis covers the complete kill chain: initial access via a known vulnerability, credential dumping with Lsassy and HackTool.PS1.VeeamCreds, lateral movement with NETSCAN.EXE, and final-stage encryption and exfiltration. Acronis includes YARA rules for each stage and a full set of IOCs, giving defenders a ready-to-deploy package rather than a write-up with a few hashes.
The CVE-2023-3519 exploit that made INC Ransomware
CVE-2023-3519 is the unauthenticated remote code execution flaw in Citrix NetScaler ADC and Gateway that gave INC Ransomware its primary initial access vector. The bug scores CVSS 9.8, sits at the 100th percentile on EPSS with a 99.8% score, and made it into CISA’s Known Exploited Vulnerabilities catalog. A public PoC has been circulating since July 2023, and the PRS risk score lands at 89.5, putting it in the Critical band.
INC Ransomware affiliates leaned on this CVE heavily through late 2023, using it against internet-facing NetScaler instances as their go-to entry point. The unauthenticated RCE profile made it ideal for RaaS affiliates: no login required, so they could drop their full toolset—Lsassy, HackTool.PS1.VeeamCreds, and NETSCAN.EXE—straight into the target environment. The group targeted education, government, and healthcare organizations, all of which tend to leave NetScaler exposed to the internet.
The full toolset: from VeeamCreds to Lsassy
INC Ransomware’s post-exploitation toolkit is a compact, purpose-built set. The group drops HackTool.PS1.VeeamCreds for Veeam credential extraction, Lsassy for LSASS memory dumping, and NETSCAN.EXE for lateral movement and network scanning. These three cover the credential-dumping and lateral-movement phases after the initial RCE lands.
For file operations and exfiltration, the group deploys HackTool.Win32.ProcTerminator.A to kill target processes, ProcessHacker for interactive process manipulation, 7-Zip or WinRAR for archive creation, and Rclone for the actual data transfer. ESENTUTL.EXE handles database access when the group needs to pull Exchange or other ESENT-backed stores. The full set is small enough to run in a single batch script, which is typical for RaaS affiliates who want to keep their footprint tight.
The group also maintains a historical email address, gansbronz[at]gmail[.]com, that has been seen in the wild with the Lynx ransomware family. That overlap suggests shared infrastructure or a common affiliate pool between the two groups, a pattern that has shown up in several other RaaS operations where the same Gmail handle appears across multiple ransomware families.
Who got hit: 800+ victims across Education, Government, Healthcare
INC Ransomware has confirmed 800-plus victims since 2023, spanning Education, Government, and Healthcare sectors. The group’s target profile skews toward school districts, universities, and charitable organizations, with a consistent preference for internet-facing systems that are left exposed to the public internet.
Victims are typically hit through the NetScaler RCE, after which the full toolset runs for credential dumping, lateral movement, and encryption. The unauthenticated RCE profile makes it ideal for RaaS affiliates who need a no-login entry point to drop their payload stack into the target environment.
The other CVEs in INC's rotation
Beyond the headline NetScaler RCE, INC Ransom runs a tight rotation of four additional CVEs that have all landed in CISA’s Known Exploited Vulnerabilities catalog. The first is CVE-2023-48788, a SQL injection in Fortinet FortiClientEMS 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10 that scores 9.8 on CVSS 3.1. It sits at 98.5% EPSS and carries a PRS risk of 89.9, making it the group’s second-most-used entry point after the NetScaler flaw.
The second is CVE-2024-57727, a path traversal in SimpleHelp RMM v5.5.7 that lets an unauthenticated attacker pull arbitrary files off the host over HTTP. The server configuration file is the prize here. It scores 9.1, sits at 95.2% EPSS, and carries a PRS risk of 89.76. The group has been using it since mid-2024 to grab the SimpleHelp config before they run their full toolset.
The third is CVE-2025-5777, the second round of the Citrix Bleed memory overread in NetScaler Gateway and AAA virtual servers. It scores 7.5, but the EPSS is pegged at 100% and the PRS risk lands at 81.18. This is the same NetScaler stack as the main RCE, just a different primitive. The group uses it when they need the memory overread to read out secrets the RCE doesn’t touch.
The fourth is CVE-2024-57726, a SimpleHelp API key privilege escalation that lets a low-priv technician mint an API key with admin-level permissions. It scores 9.9, sits at 66.6% EPSS, and carries a PRS risk of 89.78. The group uses it to escalate from the SimpleHelp technician role to server admin before they drop the full payload stack.
Key points
- INC ransomware has 800+ confirmed victims since 2023, making it a top-tier RaaS operation.
- Primary initial access is CVE-2023-3519: unauthenticated RCE in Citrix NetScaler ADC/Gateway, CVSS 9.8, EPSS 99.8%, CISA KEV, PoC available.
- Full attack chain includes p64.EXE, ESENTUTL.EXE, ProcTerminator, VeeamCreds, ProcessHacker, lsassy, 7-Zip/WinRAR, and Rclone.
- Historical email gansbronz[at]gmail[.]com is shared with Lynx ransomware.
- Acronis provides YARA rules and IOCs for detection and triage.