INCRANSOM Adds U.S. Victims

INCRANSOM published 11 new victims in five days, according to Security Arsenal, with cases spread across eight countries and seven sectors. Among the U.S. victims are a public school district and manufacturing companies. The same coverage also placed the group in Mexico and South Africa, while detailing a strong presence in manufacturing, health care, education, transportation and technology.

What sectors are seeing the most INCRANSOM activity?

Most of the victims attributed to INCRANSOM remain concentrated in manufacturing and industrial/construction, according to Security Arsenal. The report also cites isolated cases in financial services, health care, education, transportation and technology. In the United States, Security Arsenal’s publication included manufacturing and education, and later Kalir.io recorded a technology victim from the group in that country.

Security Arsenal also said INCRANSOM had published five new victims in 72 hours, with cases in Mexico, the United States and South Africa. For the United States, that update mentioned victims in energy and utilities, professional services and technology. The pattern points to targeting that is not limited to a single vertical.

What do the trackers say about INCRANSOM’s reach?

Trackers broaden the picture with higher totals than any single publication reports. TheSolutioners.ca places INCRANSOM at an ELEVATED risk level, with 6 victims disclosed in the last 120 days and 17 victims in the United States. That same panel lists sectors including Business Services, Construction and the Public Sector.

Dragons Eye Ransomware Tracker records 1,022 tracked victim claims and active activity, with the latest observation on August 29, 2026. Invaders Cybersecurity, meanwhile, reports 423 victims across 50 countries and 21 sectors between January 12, 2025 and August 31, 2026, with manufacturing as the hardest-hit sector.

How does Mexico fit into the victim map?

Mexico appears in several of the sources as one of the countries hit by these groups, although the figures vary by tracker. TheSolutioners.ca includes 168 victims in Mexico in its combined global ransomware archive, while Kalir.io records 25 victims for the country in its general panel. In parallel, the regional analysis cited by RadioUno911, based on SCILabs data, attributes 12 cases in Latin America to KryBit, within a 25.5% increase in ransomware activity in the region.

What is known about KRYBIT in the region?

KRYBIT also remains active and present in Latin America, according to several sources. Ransomnews documents 136 total victims in its index and mentions organizations in Mexico and the region, including TUM Transportistas Unidos Mexicanos División Norte, in transportation, and the Instituto de Cancerología y Hospital Dr. Bernardo del Valle in Guatemala, in health care. The list also includes the Union for International Cancer Control, showing the group is not limited to regional targets.

Bitdefender, in its Ransomware Threat Debrief | September 2026 report, says KRYBIT continues to claim victims month after month. In Kalir.io’s panel, the group appears with 38 victims, just above INCRANSOM, which shows 37 in that dataset.

What do the combined records show?

Taken together, the trackers suggest sustained activity from both groups, with INCRANSOM still closely tied to manufacturing but now visible in education, energy, professional services, technology and the public sector. For KRYBIT, the records show a notable footprint in health care and transportation, with victims spread across Mexico, Guatemala and international organizations. The different panels do not use the same methodology or time frame, but they agree that both actors remain active and geographically broad.