INC Ransom in Panama: how the group behind the Metales Panamericanos attack operates

On September 2, 2026, the ransomware group INC Ransom listed Metales Panamericanos, a Panamanian steel and construction-materials supplier, on its leak site, claiming to have stolen internal company data.

This isn’t an isolated case. In September 2025, the same group claimed an attack against Panama’s Ministry of Economy and Finance (MEF), with reports of more than 1.5 TB of data exfiltrated. In under a year, INC Ransom has hit both the public and private sectors in the country. The message for any Panamanian business is clear: this group already operates here, and it doesn’t discriminate by size or industry.

This article covers who INC Ransom is, how it runs its attacks, and, most importantly, what concrete steps an SMB can take to reduce the risk.

At the time of publishing, the only confirmed information about the Metales Panamericanos case is its appearance on the group’s leak site. Technical details of the specific attack aren’t public yet. The tactics described below reflect INC Ransom’s documented mode of operation in prior incidents.

Who is INC Ransom

INC Ransom emerged in July 2023 and has since established itself as one of the most active double-extortion groups, averaging eleven victim organizations a month. Its targets include large companies with mature security programs; healthcare, government, and education entities across the United States, Canada, and Europe. Its recent activity confirms an expansion into Latin America.

The double-extortion model works like this: the group steals the victim’s data before encrypting it, then threatens to publish it on its leak site if the ransom isn’t paid. That way, even a company with solid backups, able to recover its systems, still faces the threat of its confidential data and its customers’ data being exposed publicly.

How INC Ransom operates: its TTPs

INC Ransom’s attacks follow a recognizable pattern. These are the tactics, techniques, and procedures (TTPs) observed in real incident investigations:

1. Initial access. The group typically gets in by exploiting unpatched vulnerabilities in perimeter devices like firewalls, VPNs, or through targeted spear-phishing emails. In prior campaigns they leveraged known flaws such as CVE-2023-3519 in Citrix NetScaler.
2. Reconnaissance. Once inside, they use native Windows tools (LOLBins) such as net.exe and utilities like netscan to map the network, identify other hosts and shares. Their goal: locate the database servers where the valuable data sits.
3. Credential theft. With Impacket’s secretsdump module they dump the Windows SAM database to obtain usernames and passwords. They target service accounts in particular, especially the ones managing backups and databases, because they tend to carry broad privileges and little oversight.
4. Lateral movement. They move through the network with Impacket’s wmiexec module, which runs commands on remote hosts over WMI without leaving obvious traces, and with pass-the-hash techniques, which let them use a compromised account without ever knowing its password.
5. Data collection and exfiltration. They locate SQL servers and stage copies of the data for theft. Then they exfiltrate it with Rclone, a legitimate cloud-sync tool, splitting the data into small chunks to slip past network controls.
6. Defense evasion. To cover their tracks they clear Windows event logs with wevtutil, run base64-encoded commands to dodge detection, and, when encrypting, delete Volume Shadow Copies to make recovery harder.
7. Extortion. Once exfiltration and encryption finished successfully, the group applies heavy pressure: publishing the victim on their leak site, threatening to disclose the data, and in some cases even printing ransom notes from printers on the victim organization’s own network.

One key point: almost all of these tools: net.exe, PowerShell, WMI, Rclone, etc. are legitimate and used every day. INC Ransom blends into normal network traffic, which is why traditional antivirus solutions are not enough to defend against modern attackers.

MITRE ATT&CK

INC Ransom’s documented mode of operation, mapped to ATT&CK. These come from prior incidents, not from the Metales Panamericanos case, whose technical details are not public.

Tactic	Technique	ID
Initial Access	Exploit Public-Facing Application	T1190
Initial Access	Phishing: Spearphishing Attachment	T1566.001
Discovery	Remote System Discovery	T1018
Discovery	Network Share Discovery	T1135
Credential Access	OS Credential Dumping: Security Account Manager	T1003.002
Execution	Windows Management Instrumentation	T1047
Lateral Movement	Use Alternate Authentication Material: Pass the Hash	T1550.002
Collection	Data from Local System	T1005
Exfiltration	Exfiltration Over Web Service: Exfiltration to Cloud Storage	T1567.002
Defense Evasion	Indicator Removal: Clear Windows Event Logs	T1070.001
Defense Evasion	Obfuscated Files or Information: Command Obfuscation	T1027.010
Impact	Inhibit System Recovery	T1490
Impact	Data Encrypted for Impact	T1486
Impact	Financial Theft	T1657

Why SMBs are a target

There’s a dangerous myth: “we’re too small to be attacked.” The reality is the opposite. Many ransomware attacks are opportunistic: groups scan the internet for vulnerable devices and walk through whatever door they find open, regardless of company size. SMBs typically have fewer defenses, smaller IT teams, and no dedicated security monitoring, which makes them easier and more profitable targets.

How to protect yourself: recommendations for SMBs

No single measure stops an attack on its own. Effective defense is layered. Here are the priorities, ordered by impact:

1. Patch your perimeter devices. The firewall, VPN, and any internet-facing service are the number-one entry point. Keeping them updated closes off INC Ransom’s most common route in.
2. Enable multi-factor authentication (MFA). On email, remote access, and every critical service. It’s the most cost-effective barrier against stolen credentials.
3. Control service accounts. Grant them only the permissions they strictly need, avoid letting a single account reach the entire network, and monitor their behavior. Over-privileged service accounts are one of the group’s favorite paths in.
4. Keep offline, immutable backups, and test them. A backup the attacker can’t reach or encrypt is your best insurance against extortion. Periodically verify that restoration actually works.
5. Centralize logs off the host. Forward logs to an external server (Windows Event Forwarding or Syslog). If the attacker wipes local logs, you still hold the evidence needed to investigate and respond.
6. Deploy managed detection and response (EDR/MDR). Since the attacker is using legitimate tools, traditional antivirus has less to work with. EDR can spot the unusual behavior around those tools, but someone still needs to investigate what they’re seeing and act on it. With 24/7 monitoring by cybersecurity specialists, that gives you a chance to catch the attacker before the attack gets to the point where files are being encrypted.
7. Block unauthorized tools. If your business doesn’t use Rclone, Impacket, or other transfer or remote-administration utilities, block them via application control. It takes the attacker’s preferred tools off the table.
8. Have an incident response plan. Knowing what to do, who to call, and in what order during the first hours is the difference between a scare and a crisis.

If your business has already been hit

Stay calm and don’t pay impulsively: paying doesn’t guarantee recovery or prevent a second extortion attempt. Preserve the evidence, don’t power off or “clean” affected machines without guidance, isolate the compromised systems, and get support from an incident response specialist. Also keep in mind that a data breach can trigger notification and other regulatory obligations depending on where your business operates and whose data is involved. E.g. for businesses operating in Panama, Panama’s Law 81 on personal data protection is part of the regulatory landscape we work with, but the same incident may also involve requirements in other jurisdictions.

The Bottom Line

INC Ransom already operates in Panama and attacks organizations of every size. Its method rely on legitimate tools and common oversights: unpatched devices, over-privileged service accounts, and a lack of monitoring. The good news is that the same measures that stop this group protect against the vast majority of ransomware attacks.