INC Ransom Claims Attack on OrthoNY Orthopedic Care

INC Ransom claimed a ransomware attack on OrthoNY Orthopedic Care. The group did not disclose any further information about the attack. OrthoNY focuses on assessing, managing, and helping patients recover from orthopedic issues, sports injuries, and work-related injuries.

Background on INC Ransom

INC Ransom was first observed in the summer of 2023, and it is unclear if they maintain a RaaS (Ransomware-as-a-Service) affiliate operation or are a closed group. INC uses common Tactics, Techniques, and Procedures (TTPs) such as leveraging compromised RDP (Remote Desktop Protocol) credentials to gain access and move laterally in a targeted environment.

INC has been observed delivering ransomware using legitimate tools like WMIC and PSEXEC and uses other Living-off-the-Land (LOTL) techniques, abusing applications including MSPaint, WordPad, NotePad, MS Internet Explorer, MS Windows Explorer, and AnyDesk for lateral movement. INC has also been observed abusing tools like Esentutl for reconnaissance and MegaSync for data exfiltration.

INC is written in C++ and uses AES-128 in CTR mode to encrypt files, and it also has a Linux version. It is unclear if INC employs any advanced security tool evasion techniques, and there are indications that they may attempt to delete Volume Shadow Copies (VSS) to hinder encryption rollback attempts.

Target Industries and Extortion Practices

INC targets a wide array of industries, including manufacturing, retail, IT, hospitality, pharma, construction, and the public sector. INC practices double extortion and maintains a leaks site for double extortion, threatening to expose victim data. INC has made good on threats to expose sensitive data if a target does not pay the ransom demand.