INC ransomware has consolidated significant market share in the RaaS ecosystem following the takedown of competing operations. Since launching in August 2023, the group claims over 830 victims across multiple sectors and geographies.

The group emerged during a pivotal window. Law enforcement operations dismantled LockBit, historically the largest ransomware-as-a-service platform, and disrupted BlackCat operations. These enforcement actions displaced affiliates seeking new platforms. INC filled that vacuum by offering competitive terms and operational infrastructure to displaced threat actors.

INC operates a traditional RaaS model where administrators maintain infrastructure and provide tools while recruiting affiliates who conduct intrusions and negotiate ransom demands. Revenue splits incentivize affiliate recruitment. The group maintains a darknet leak site publishing victim data, applying pressure on targets to pay.

The 830-victim figure spans roughly three years of operation, indicating consistent activity rather than sporadic campaigns. This volume places INC among the top-tier ransomware operations tracked by security researchers. Sectors targeted typically include healthcare, finance, manufacturing, and critical infrastructure, where organizations face operational pressure to restore systems quickly.

Organizations face direct financial risk from encryption attacks. INC typically demands ransoms ranging from tens of thousands to millions of dollars depending on target size and data sensitivity. Beyond direct extortion, victims face secondary exposure through data theft and publication. Regulatory penalties and reputational damage follow breach disclosure in most jurisdictions.

The RaaS consolidation pattern matters for defender strategy. As platforms like INC absorb more affiliates, they standardize attack tooling, malware variants, and negotiation tactics. This reduces variation defenders must track but increases the sophistication available to individual affiliates. Smaller groups gain access to enterprise-grade infrastructure they couldn't build independently.

INC's growth reflects rational market dynamics. Affiliates gravitate toward platforms offering better profit splits