Agencies Warn of Rising INC Ransom Activity Across Pacific Region
Summary
A joint ACSC, New Zealand NCSC and CERT Tonga advisory describes INC Ransom’s affiliate model, regional activity and intrusion methods, citing incidents in Australia, Tonga and New Zealand and recommending access controls, backups and patching.
Key points
- The joint advisory warns that INC Ransom affiliates have increasingly targeted healthcare and other high-value organizations in Australia, New Zealand and Pacific Island states.
- ACSC attributed 11 incidents to INC Ransom affiliates in Australia from 1 July 2024 to 31 December 2025, primarily affecting professional services and healthcare.
- The advisory says attackers use spear-phishing, unpatched internet-facing systems and purchased credentials for initial access, then may create administrator accounts and move laterally.
- Agencies linked a 15 June 2025 ransomware incident disrupting Tonga’s Ministry of Health services to INC Ransom; the group claimed responsibility on 26 June.
- The NCSC attributed a May 2025 New Zealand health-sector intrusion to INC Ransom and reported that stolen data was published after the organization refused the extortion demand.
- The advisory describes affiliates using tools such as 7-Zip, WinRAR and rclone for data handling and exfiltration before deploying ransomware.
- Recommended measures include tested backups, restricted network traffic, hardened remote access, phishing-resistant MFA, privileged-access controls and timely patching.
Article Details
- Event Type
- Joint cybersecurity advisory warning of rising INC Ransom ransomware activity targeting organizations in Australia, New Zealand, and Pacific Island states.
- Impact
- Reported incidents disrupted healthcare operations, including rendering several core services in Tonga inaccessible. The article reports that attackers encrypted systems and stole data, including personally identifiable information and medical records, before using double-extortion tactics.
MITRE ATT&CK
T1021 · Remote ServicesAffiliates move laterally through internal systems.T1078 · Valid AccountsAffiliates use purchased credentials to access victim environments.T1136 · Create AccountAfter gaining access, affiliates create new administrator-level accounts to escalate privileges.T1190 · Exploit Public-Facing ApplicationAffiliates exploit unpatched internet-facing systems to gain access.T1486 · Data Encrypted for ImpactAffiliates deploy INC Ransom’s encryption component to render systems inaccessible.T1560.001 · Archive via UtilityAffiliates use 7-Zip and WinRAR to compress data before theft.T1566 · PhishingINC Ransom affiliates use spear-phishing campaigns targeting employees for initial access.T1567.002 · Exfiltration to Cloud StorageAffiliates use rclone to transfer stolen data outside victim networks.
Threat Actors
blackodThe article identifies blackod as an alias of Roman Khubov, whom the advisory says controlled infrastructure used to exfiltrate data during the Tonga Ministry of Health breach.GOLD IONICIdentified in the article as another threat-intelligence label for INC Ransom.INC RansomThe ransomware group is linked to attacks in Australia, New Zealand, and Tonga. It publicly claimed responsibility for the 15 June 2025 Tonga Ministry of Health incident, and the NCSC determined it was responsible for a reported May 2025 New Zealand intrusion.Roman KhubovThe advisory identifies him as a cybercriminal who controlled malicious infrastructure used to exfiltrate data during the Tonga Ministry of Health breach.Tarnished ScorpionIdentified in the article as another threat-intelligence label for INC Ransom.
Malware
Tools
7-Zipthen escalate privileges (create admin accounts), move laterally, exfiltrate data using legitimate tools (7-Zip/WinRAR, rclone), and deploy encryption followed by double-extortion.RCloneprivileges (create admin accounts), move laterally, exfiltrate data using legitimate tools (7-Zip/WinRAR, rclone), and deploy encryption followed by double-extortion.WinRARprivileges (create admin accounts), move laterally, exfiltrate data using legitimate tools (7-Zip/WinRAR, rclone), and deploy encryption followed by double-extortion.
Countries
AustraliaRaaS ecosystem is increasingly targeting healthcare and other high-value organizations across Australia, New Zealand, and Pacific Island states, using tactics like spear-phishing, exploitation of unpatchedNew ZealandA joint advisory from the Australian Cyber Security Centre (ACSC), New Zealand NCSC, and CERT Tonga warns that the INC Ransom affiliate-driven RaaS ecosystem is increasingly targeting healthcare and other high-valueTongaA joint advisory from the Australian Cyber Security Centre (ACSC), New Zealand NCSC, and CERT Tonga warns that the INC Ransom affiliate-driven RaaS ecosystem is increasingly targeting healthcare and other high-value
Industries
GovernmentOfficials from the three agencies are urging both government ministries and private organizations to review the mitigation measures outlined in the guidance to strengthen defenses against INC Ransom activity.Healthcareand CERT Tonga warns that the INC Ransom affiliate-driven RaaS ecosystem is increasingly targeting healthcare and other high-value organizations across Australia, New Zealand, and Pacific Island states, usingProfessional ServicesINC Ransom affiliates in Australia between 1 July 2024 and 31 December 2025, primarily affecting professional services and health care; activity shifted toward the Pacific region since early 2025.