THREAT WATCH · June 05, 2026 · RANSOMWARE LISTING

INCRANSOM Lists US Manufacturing Firm obrieneng.com

The domain obrieneng.com was recorded on an INCRANSOM ransomware tracker on June 05, 2026. The listing places a US-based manufacturing and engineering firm with 51 to 100 employees on the group's public victim page. No disclosure has been made by the organization itself. Intel128 tracks this as a listing event, not a confirmed breach.

Key takeaways

• obrieneng.com was recorded on an INCRANSOM tracker on June 05, 2026
• The firm is a US-based manufacturing and engineering company with 51 to 100 employees
• No public disclosure has been made by the organization
• A listing is strong signal but not a confirmed breach

What the listing tells us

INCRANSOM added obrieneng.com to its tracker on the date noted above. The group publishes victim domains as part of its extortion model, typically after claiming initial access or data theft. The listing itself is the signal. It does not confirm that data was exfiltrated or that systems were encrypted.

Key details from the record:

• Domain listed: obrieneng.com
• Ransomware group: INCRANSOM
• Listing date: June 05, 2026
• Country: United States
• Sector: Manufacturing / Engineering
• Company size: 51 to 100 employees
• Disclosure status: Not disclosed yet

Why this matters for mid-size engineering firms

Companies in the 51 to 100 employee range often operate with lean IT teams. They may lack dedicated security staff or formal incident response plans. Manufacturing and engineering environments frequently run legacy systems, shared credentials, and flat network architectures that are attractive to ransomware operators. These organizations hold intellectual property, design files, and operational data that carry high value to attackers.

The absence of a public disclosure is notable. It may mean the organization is still assessing the situation, negotiating, or has not yet determined whether data was taken. It does not mean the listing is false. Tracker operators sometimes publish entries based on partial information, and some groups list organizations they believe they compromised even when the intrusion was limited or unsuccessful.

What to watch next

• Whether obrieneng.com or its parent entity issues a public statement
• Whether INCRANSOM publishes additional details such as file samples or screenshots
• Whether the listing is removed, which can indicate negotiation or a false positive
• Whether other US manufacturing firms appear on the same tracker in the coming days, which could suggest a broader campaign

Context on INCRANSOM

INCRANSOM is a ransomware group that operates a public leak site. It lists victim domains as a pressure tactic to encourage payment. The group's activity level and targeting patterns are tracked by Intel128 across multiple feeds. This is the first recorded listing for obrieneng.com in our dataset.

Recommended actions for similar organizations

If your organization operates in a comparable sector or size range, consider the following:

• Verify that offline backups are current and tested
• Review whether any anomalous authentication events occurred in the weeks before June 05, 2026
• Confirm that your incident response plan covers ransomware scenarios specifically
• Check whether any third-party vendors or partners in your supply chain have been listed recently

Intel128 will update this entry if new information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED SEP 30, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.