IMNCrew is a cybercriminal group known for data extortion and ransomware attacks targeting the financial sector.
IMNCrew is a financially motivated cybercriminal group conducting data extortion and ransomware attacks, first observed in late March 2025. They primarily target financial services organizations in the US, Croatia, and Indonesia. Their initial access relies on exploiting exposed perimeter services such as firewalls and VPNs, claiming at least five victims so far. Defenders should prioritize patching perimeter devices and enforcing multi-factor authentication on all remote access services.
IMN Crew is a data extortion and ransomware group that emerged in late March 2025, primarily targeting financial services organizations in the US, Croatia, and Indonesia by exploiting exposed perimeter services such as firewalls and VPNs, claiming at least five victims.
IMNCrew primarily exploits exposed perimeter services such as firewalls and VPNs to gain initial access.
Defenders are advised to keep security patches for remote access services up to date and enforce multi-factor authentication (MFA).
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.