Ransomware Group intelligence
IMNCrew
InactiveTrack IMNCrew with 12 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
IMNCrew is tracked by Breach House as a ransomware group with 12 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 16m ago | imncrewwfkbjkhr2oylerfm5qtbzfphhmpcfag43xc2kfgvluqtlgoid.onion |
Top Activity Sectors (7)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue IMNCrew, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: IMNCrew executes malicious commands via PowerShell to stage payloads, disable defenses, and propagate across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: IMNCrew modifies Registry Run Keys and startup folders to maintain persistence across reboots on compromised endpoints.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: IMNCrew disables or modifies security tools such as antivirus and monitoring agents to evade detection during ransomware deployment.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: IMNCrew deletes Volume Shadow Copies and backup artifacts via system commands to prevent file recovery and strengthen impact.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: IMNCrew accesses and potentially dumps LSASS memory to harvest credentials for persistence or privilege escalation on other systems.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1049 System Network Connections Discovery Discovery
What they do: IMNCrew queries system network connections to identify active services and map the victim environment before impact actions.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1135 Network Share Discovery Discovery
What they do: IMNCrew uses network share discovery to locate victim file shares and identify high-value data for exfiltration or encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: IMNCrew moves laterally through SMB/Windows Admin Shares to compromise additional hosts within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: IMNCrew encrypts critical files and data stores using its ransomware payload to maximize operational disruption and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: IMNCrew performs internal defacement by replacing or corrupting victim files with ransom notes to reinforce pressure and impact.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (2)
▼Software IMNCrew has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
LaZagne
Exfiltration
Restic
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Victims (12)
Search, filter and paginate the victim timeline for IMNCrew. Showing 1–12 of 12.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Jansenfurniture.com id22426 View details | Canada | Communication / Marketing | ||
|
Jansen Furniture is a brand and producer of luxury furniture. It has been family owned since it was founded in 1982 by Peter Andries Jansen. Jansen Furniture sells B2B and has a worldwide network of dealers ready to serve customers at any place and time. Jansen Furniture’s luxury furniture pieces and decorative accessories are inspired by history. Classic, contemporary and mid-century modern furniture and interior styles will provide you with a sophisticated living experience amidst quality furniture and decorations. Well-skilled artisans and craftsmen and –women fabricate the most beautiful wooden and upholstered furniture using a wide selection of the finest high-quality materials. These materials consist of lots of exotic yet permitted materials such as veneers and woods. Simultaneously many materials originate from Europe’s most excellent leather and upholstery material manufacturers to ensure a premium product quality. |
|||||
| Ransomware | Onegolditalia.it id21501 View details | Italy | Communication / Marketing | ||
|
One Gold Srl was founded in 2000 from twenty years of experience in the gold and silver sector. The company, specialized in the processing of precious and non-precious metals, produces accessories on commission for the customer metals and costume jewellery for the luxury sector, paying meticulous attention attention to all phases of production of semi-finished and finished products and ensuring integration of the entire production chain. |
|||||
| Ransomware | Apntelecom.com id20962 View details | United States | Telecommunications | ||
|
Asia Pacific Network is a Texas-based, Premier Provider of VoIP services to the US and all major continents around the globe. We utilize Tier-1 Carriers and a top-of-the-line, carrier-grade setup to provide consistent and reliable service to our customers connecting through our facility in One Wilshire Building, in the high-tech heart of downtown Los Angeles, CA, where over 220 carriers are similarly housed. We also have offices and representatives in the Philippines to better cater to the booming Call Center industry in the country. |
|||||
| Ransomware | Repremundo.com.co id20650 View details | Colombia | Communication / Marketing | ||
|
RepreMundo is a company that operates in the Management Consulting industry. It employs 500to999 people and has 10Mto25M of revenue. The company is headquartered in Bogota, Bogota D.C. |
|||||
| Ransomware | Stiga.com id20144 View details | Sweden | Communication / Marketing | ||
|
Founded in 1934, Stiga is a gardening brand focusing on innovation and designing effective gardening tools, machinery and equipment. Stiga's products are produced in Sweden, Italy, Slovakia and China. |
|||||
| Ransomware | Synthesia.com id19763 View details | Czechia | IT | ||
|
SYNTHESIA TECHNOLOGY was founded in 1964 with private capital. It started operations in the chemical industry, manufacturing facade pains, plastisols and urea-formaldehyde insulations. In the late 60's started its activity in the field of polyurethane, one of which has had the greatest development within the business group. SYNTHESIA TECHNOLOGY is currently one of the leading manufacturers in Europe and the SYNTHESIA brand represents a benchmark in the residential and industrial insulation markets. In order to consolidate its presence and leadership in the market, SYNTHESIA has committed from the beginning to strongly encourage research and development, being nowadays one of the few independent companies in the industry with its in-house technology. |
|||||
| Ransomware | Grupo Herradura Occidente id19762 View details | Mexico | Transportation / Travel / Logistics | ||
|
Grupo Herradura Occidente is a Mexican transportation company formed in 2007 through the merger of two long-established companies: Autotransportes Herradura de Plata (founded in 1945) and Grupo Occidente (founded in 1956). This fusion aimed to create a more profitable, productive, and efficient organization capable of facing financial and global changes at that time. The company operates a modern fleet of over 780 buses, including brands like Volvo, Mercedes Benz, and MAN, and transports more than 20 million passengers annually. It offers three service modalities: Plus, economic, and suburban.The company is based in Mexico City and is active in the truck transportation industry .Grupo Herradura Occidente is known for its significant presence in the Mexican transportation sector, particularly in passenger bus services, and it has a substantial vehicle fleet and passenger volume. However, some employee reviews mention challenges related to workplace environment and management practices .In summary, Grupo Herradura Occidente is a key player in Mexico’s passenger and truck transportation industry, with a history rooted in two legacy companies and a large, modern fleet serving millions of passengers yearly. |
|||||
| Ransomware | Croatianmint.hr id19761 View details | Croatia | Communication / Marketing | ||
|
Hrvatska kovnica novca specializes in the production of circulating and commemorative coins, as well as gold and silver medals and medals made from base metals. The company offers a wide range of products available for purchase through its webshop, catering both to retail and wholesale customers. Their products are particularly suited for special occasions such as weddings, graduations, and religious ceremonies, making them ideal gifts. As a respected institution, they contribute to the national identity and economy of Croatia. |
|||||
| Ransomware | Derp.org id19760 View details | United States | Public Sector | ||
|
We’re the Denver Employees Retirement Plan (DERP). Your partner in building, planning, and living a secure retirement future while serving the city you love. DERP was established January 1, 1963, to provide a defined benefit plan for eligible City and County of Denver employees in the Career Service, certain employees of the Denver Health and Hospital Authority, and DERP staff. We provide a monthly DERP Pension Benefit payment to more than 10,800 retirees and beneficiaries, and are an essential element of the future financial security for almost 10,000 active members. |
|||||
| Ransomware | Abdainsurance.co.id id19759 View details | Indonesia | Finance / Legal / Insurance | ||
|
ABDA Insurance focuses on providing protection against any losses or damages, such as Fire, Vehicles, Engineering, Liability, Transportation, Heavy Equipment & Machinery, Health Protection and many more. The Company has undergone a number of name changes, as follows : 1982 : PT Asuransi Bina Dharma Arta 1994 : PT Dharmala Insurance 1999 - Present : PT Asuransi Bina Dana Arta Tbk., or known as ABDA Insurance or Asuransi ABDA. The head office is located on the 27th floor of Plaza ABDA, Jl |
|||||
| Ransomware | Vnakc.org id19758 View details | United States | Healthcare / Pharma | ||
|
Established in 1891, Visiting Nurse Association (VNA Home Health) is a nonprofit home health agency. We offer a wide range of in-home services for people in and around Kansas City. Our legacy of more than 125 years of excellence in home health comes from our belief that people not only need someone to care for them, they also need someone to care about them. That’s what we do at VNA, and our patients say it’s one of many things that set us apart. As the oldest home health agency in Kansas City and the sixth oldest in the United States, we have history and experience patients can trust. We are governed by a volunteer board of directors that includes many of Kansas City’s most influential business and civic leaders. VNA nurses and therapists average more than ten years of patient care experience, with three to five years experience in home health care. Through our dedication to the health and wellness of this community, we deliver positive clinical outcomes that exceed national averages. We use the latest technology available to meet the changing needs of our community.What we do for our patients may be complex, but our mission is simple: to bring exceptional health care into the homes of everyone we serve. |
|||||
| Ransomware | Goodson.com id19757 View details | United States | Communication / Marketing | ||
|
Goodson is the premier supplier to engine rebuilders around the world . Founded in 1945, Goodson has been providing the finest quality tools, supplies and technical information to the automotive aftermarket ever since. Today, Goodson is 100% Employee-Owned. |
|||||