Threat Actor Index: Knowledge is Power

INC Ransom emerged as a ransomware-as-a-service operation in July 2023. The group operates with a business-like approach, framing their attacks as security services while conducting financially motivated operations. Following the sale of their source code for approximately $300,000 in March 2024, INC Ransom evolved through derivative operations, most notably Lynx ransomware, which shares over 70% code similarity.

Emerging as a new ransomware variant in May 2024, Fog established itself as a significant threat actor in the ransomware ecosystem, particularly targeting educational institutions and business services. Operating with an independent affiliate model, the group implements double extortion tactics while conducting financially motivated operations. Following emergence as a STOP/DJVU variant, evolution through technical capabilities resulted in the first ransomware group to deploy legitimate employee monitoring software and publish victim IP addresses.

BianLian emerged in June 2022 and, at one time, was one of the most active ransomware groups targeting US and European targets. After its code leaked in 2023, the group abandoned file encryption to focus exclusively on data theft and extortion. Recognized for aggressive tactics including printing ransom notes on compromised network printers and issuing direct threats to employees and stakeholders, the group demonstrated adaptability through custom Go-coded backdoors and evasion techniques.

Arcus Media emerged as a ransomware-as-a-service operation in May 2024, establishing itself as a significant threat actor in the ransomware ecosystem, particularly targeting manufacturing and healthcare organizations.

The group operates with a selective affiliate approach, implementing referral-based recruitment requiring vetting processes while conducting financially motivated operations. Following emergence during disruption of major groups like LockBit and ALPHV/BlackCat, Arcus Media evolved their technical capabilities, most notably implementing selective encryption strategies that balance speed with effectiveness.