THREAT WATCH · September 25, 2026 · RANSOMWARE LISTING

Moroccan Pharma Company Listed by INCRANSOM Ransomware Group

A mid-size Moroccan pharmaceutical company has been recorded on the INCRANSOM ransomware tracker. The listing, dated September 25, 2026, identifies pharma5.ma as the affected domain. The organization operates in the healthcare and pharma sector and employs between 51 and 100 people. As of the listing date, no public disclosure has been made by the company regarding the incident.

Key takeaways

• pharma5.ma was recorded on the INCRANSOM ransomware tracker on September 25, 2026.
• The company operates in Morocco's healthcare and pharma sector with 51 to 100 employees.
• No public disclosure from the company has been made as of the listing date.
• INCRANSOM is the ransomware group behind the listing.

What the listing tells us

The INCRANSOM group added pharma5.ma to its public tracker on September 25, 2026. A listing on an attacker-side tracker is strong signal that a ransomware operation targeted the organization. It is not, on its own, a confirmed data breach. Attackers sometimes list organizations to apply pressure, even when the underlying compromise is limited or unverified.

Key facts from the listing:

• Domain: pharma5.ma
• Ransomware group: INCRANSOM
• Listing date: September 25, 2026
• Country: Morocco
• Sector: Healthcare / Pharma
• Company size: 51-100 employees
• Disclosure status: Not disclosed yet

Context on the sector

Healthcare and pharmaceutical companies remain high-value targets for ransomware operators. The sector handles sensitive patient data, proprietary research, and regulated information. Mid-size firms with 51 to 100 employees often lack the dedicated security teams that larger enterprises maintain, making them attractive targets for groups seeking quick ransom payments.

Morocco's healthcare and pharma sector has been growing, and digital transformation across the region has expanded the attack surface for organizations of this size. Companies in this range may have compliance obligations but limited resources to meet them, creating gaps that ransomware groups actively exploit.

What to watch next

• Whether pharma5.ma issues a public statement or breach notification in the coming days.
• Whether INCRANSOM publishes data samples or additional details about the listing.
• Whether other organizations in Morocco's pharma sector appear on similar trackers in the coming weeks.
• Whether the listing is removed, which could indicate a resolution or a withdrawal by the group.

What this means for your organization

If you operate in healthcare, pharma, or any regulated sector, this listing is a reminder that mid-size companies are actively targeted. Ransomware groups do not limit their campaigns to large enterprises. A listing like this one, even without confirmed data exfiltration, should prompt a review of your own exposure.

Recommended actions:

• Confirm that your incident response plan covers ransomware scenarios specifically, not just generic cyber incidents.
• Verify that backups are tested regularly and isolated from production networks.
• Review third-party and vendor access, especially for partners in the healthcare supply chain.
• Monitor attacker-side trackers for any mention of your own domain or brand.
• Ensure your legal and compliance teams are prepared to handle disclosure obligations if a listing turns into a confirmed incident.

Intel128 will update this post if additional information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.