Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
Icarus Ransomware Group
Ransomware group profile
10Victims
United KingdomSource country
65Impact score
Description
Icarus is a newly emergent ransomware group first encountered in April 2026, distinguished from the earlier Icarus Stealer malware. The group's operations revolve around financial gain through the exploitation of sensitive data, positioning itself as a data broker engaged in extortion tactics.
Key insights
- •Icarus engages in double extortion and free data leaks to pressure victims into compliance.
- •The group's primary goal is financial profit from the sale or leakage of stolen data.
- •Targets include sensitive data such as personally identifiable information, source code, and KYC documents.
- •Icarus utilizes bespoke malware for ransomware deployment, with detailed attack vectors not yet disclosed.
Threat Level & Status Breakdown
For Icarus · Based on incidents in selected period
Status Breakdown
Data Leaked20.0%2
Claimed80.0%8
First seenMay 2026
Last seenJun 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 22, 2026
Recent activity
Monthly attack count for Icarus in the selected period
10Total attacks
9peak in Jun
5avg / month
↑ 8 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for Icarus
- 40ab50289f7ef5fae60801f88d4541fc
- af7ae505a9eed503f8b8e6982036873e
- d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
- 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
- 87e8230a9ca3f0c5ccfa56f70276e2f2
- eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
- 3ddf9be5c28fe27dad143a5dc76eea25222ad1dd68934a047064e56ed2fa40c5
- 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- ee002cb9e51bb8dfa89640a406a1090a
- 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- 3cedfb74d44f2e84198d23075aef16c34a668ceb
- 8d285430e8bda6d5c9b683579adcb180
- 619dbbcff06c659e3fc48f03917a4dadbfc1c275
- 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
- d414dd4f9db345fa8003e32adc81b362
- e93c7f013493b12ad40229b19db02ce6
- ef878bfbfd2f8328bbb8cff1aa29a39e624a8503
- 17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819
- 8f8eb9cb9e78e3a611bc8acaec4399cb
- 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
- 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
- 9f45a47ebfd9d0629f4935764243dd5a
- 86a4a0ea205e31fb73f3bfcce24945bd6bea06c7
- 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
- 639b1fb35cb61ba633eb1791b750631f
- 392a6925009f5fb02a4c122c9ce31d82b9059628
- 25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40
- fc9fc5f308ffc2d2d71814df8e2ae107
- 24d7477f2a7dc2610eb701ed683108cd57eca966
- 286b308df8012a5dfc4276fb16dd9ccc
- 43d8d2fb8801c5bd90d9482ddf3ea356
- 416aa8314222db6cbb3760856be13d46
- d229da563da18fe5d58cd95a6467d584
- b65bf5ef316880fd8d21e1b34eb5c8a9
- 3ab4674cb5c76e261fe042d6d0da8a20bfcbcbae
- b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
- 3560176d0cdbe2f5d33f543348e0a027
- 1e35a1f7793fc3899927835491f28fe5b903edcd
- 09796dab12cbbd920f632aeb89820193
- 7d81c0e5537b6d8b79af0c28cd102e064027c78d
- 708a5bc205384633a7b6674eecc7f0f0
- 01603a7826029293236c67fce02ace8d392a0514
- 050a30a687e7a2fa6f086a0db89aa131
- 0c1cc0a54d4b38885e1b250b40a34a84
- 226a5983ae2cbbf0c1bda85d65948abc
- 28005b20fbef6e1db10912d0fdd6471c
- 344a09b4be069f86356a89482c156647
- 385f562bdc391ccd4f81aca3719f3236
- 3c58a804b90a0782e80bbbf6c6b6f167
- 3c5c7a3130b075b2def5c413c127173f
- 436ea0237ed040513ec887046418faaa
- 47555752931cecf90e796499b62ec729
- 4a28ca64f44b91f43945ee3971e0996a
- 5241df2e95e31e73ccfd6357ad309df0
- 527bbbfded529ea77ee798d94ce0f243
- 5794b8e183eb547aadd5faf30a8c4dd2
- 5ec3ae03796fb3d461690cf679964b1f
- 5fbcb20d99e463259b4f15429010b9cd
- 6fcebd8391875127d03b4ea336b9b36b
- 7a629293eeb0bca5f9bdee8ade477c54
- 7e4a457babea8ae2a1bc06c33fc769db
- 7fd4a71085783ccfe9c289c07bcf9b04
- 86023497fa48ca2c7705d3f90b76ebc5
- 8f107a7bc018227b181a0e7e76e9ca39
- 9d6925407136753e8eb8234d59fa3f1f
- 9f746f4f7d845f063fea3c37dcebc27c
- aa9624cb27cc50a3fbbd3b223a617b1c
- b5e2760c5a46dbeb8ae18c75f335707e
- bbaa58e9e1abdf7d8c4c69652d29d789
- c123f2c161884fbff4f00ef1e1391266
- c2f8c03ecce9941492bfbe4b82f7d2d5
- c830c6447e6de3d6a611702c591831e3
- cc228ff8d86b608e73026b1e9960b2f8
- e368a236f5676a3da44e76870cd691c9
- ef37235fc43157a4c93241d5e49e304b
- fccce207a34c947f01d3f23a7dd09569
- 1484322caaf0d71cbb873a2b87bdd8d456da1a3b
- 217b171764fba5e91190d1f8a36feccb3f6d4585
- 24400f712bbe1dd260ed407d1eb24c35dcb2ecac
- 24d00523770127a5705fcc2a165731723df36312
- 2506ffeb157cb531195dd04d11d07c16e4429530
- 2644cc5e86dfad1ad2140181ab2ca79725f95411
- 2b1977edb9c4d609ee77320464a1514053884851
- 2b5a0a8702c769eeaaf101852456aa3ecf3914e3
- 2f6487e3b4fdf084bfd26786f96abf0409c16659
- 38aef13abc14502354e8c5c3c37b97a8e2e5fdcf
- 44bafbbdb1b97d86505e16b8a5fcb42b2b771f91
- 45b3d8584c58e8d6ae507fdbd772feeb1886c8b0
- 47b83697677e08e4ebcff6fc41eca7ece120cc17
- 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
- f6633e1dac227ba3cd14d004748ef0c1c4135e67
- cef0705aee1e8702589524879a49e859505d6fe0
- bb86e41bb6d5eccad1ff84ab343506f4f5fcd78b0618966edc0ae0e05fcc8683
- 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
- 909c66c6dfea5e0c74d3892d980918251bb08632
- e71db44fc0e0c125de90a9a87ccb1461e72a9030
- a25bf8bac4fbfd9216ea827e71344ba07b1d463b
- a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
- c022afe4cf9e50d49e8ce2b19a158ff0704bcc94b720857b29b6fbe18d7f8475
- 6eb70da269010a7bfadd2a9c35ce31128538661a4c81d3860a9662e32db0081d
- 53b6e5854524cf001c611b3d3474e6dc86a61ae8
- 185105dff99bf9b296366e6b16e9c7321248c190
- 4ec8738fcd63ad2644ae00a7a833aabb
- 4c3b814fc7bcb2cd0b13a88fa7da7101
- 19f88babc16c03cd326666cf8b71557bb3663b954c5f65197257f73dcf738576
- e4f1d2c6f714a47f0dc29021855c632ef98b0a74
- 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
- 835215d7954e57d33d9b34d8850e8dc82f6d09e8
- 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
- 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
- fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2
- f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc
- c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
- bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a
- a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6
- 95f49efbe8107786733fa7c474025cf3fee0ac632f240367b296c736d06572aa
- 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
- 606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f
- ef57e24f29d2b1deeacefd82171873b971a3f606
- 62631b7007d394fb4d406ea686b291fff9e486cd
- 20d9f5ee0859ab3b19ca002ccdb86895ddc328d980448991d460d357c73a656d
- 10ed6274ad62a3f12f29288bb4ecf72038d614d916cd26624f46a260ff596585
- 12f582b92b1fe328dcadce1b320f5dc5722d652b90a85a51da2a2052f5badecb
- 1604c90898db7f24c6f5eae929f47b1b037ae713d6f4fd203f2183e16b010b27
- 7b1a4c2c8cb463015c6cb78fe6c72803ff0d23cb4a842f555743ca322ef5f02e
- c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c
- a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d
- bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4
- 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69
- d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4
- e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31
- 8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604
- 3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826
- ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc
- e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e
- dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94
- 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05
- 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0
- 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17
- 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a
- 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for Icarus
Defense Evasion
T1562
Impair Defenses
T1027
Obfuscated Files or Information
Execution
T1059
Command and Scripting Interpreter
Impact
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
Lateral Movement
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1080
Taint Shared Content
Other
T1203
T1203
Persistence
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Affected countries(9)
Countries where this group has been reported to target or leak victims.