Ransomware Group: INCRANSOM

VICTIM NAME: Universal Group For Engineering and Consulting

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the INCRANSOM Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

On August 20, 2025 at 14:14, a ransomware leak page associated with the Incransom group identifies Universal Group For Engineering and Consulting as the victim. The company operates in the Business Services sector and is based in the Palestinian territories (PS). The page frames the incident as a data-leak event, asserting that attackers breached the organization’s network and exfiltrated data. It notes a claim URL on the page, consistent with ransomware operators’ practice of threatening public release or sale of stolen information. The page includes eight image attachments intended as evidence, described only in general terms as screenshots or documents, with no detailed description of their contents.

The page also presents a contact snippet that lists a numeric office reference and an email address, both of which have been redacted for privacy in this report. The content centers on Universal Group For Engineering and Consulting, aligning with the stated Business Services focus. The eight image attachments are provided as onion-based download links (defanged in this summary) to illustrate the claimed data exfiltration, though the exact nature of the documents shown in the images is not disclosed. The post does not publicly disclose a ransom figure within the available data, but the presence of a claim URL indicates a ransom-related channel or negotiation posture typically associated with this threat activity.