The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
Huntress reconstructed an INC ransomware attack hitting 175 endpoints and domain controllers, with two ransom notes dropped 53 minutes apart.
Huntress detailed a post-incident investigation of an INC ransomware deployment that impacted at least 175 endpoints and left attacker traces on the victim's domain controllers. Attackers dropped two distinct ransom notes 53 minutes apart: a typical INC-README.txt and a second DATALEAK_PRESS_RELEASE.txt that itemized stolen file paths and threatened media, employee, and customer notification within 48 hours. Activity spanned early to late August with a 17-day lull, suggesting an initial access broker handed off to a ransomware affiliate. Recovered evidence included an obfuscated PowerShell implant persisted via randomly named scheduled tasks, RDP lateral movement using a compromised account, AnyDesk deployment used to push netscan.exe and a BYOVD tool.
- INC ransomware impacted at least 175 endpoints and domain controllers
- Second ransom note listed stolen files in detail and threatened press escalation
- 17-day lull suggests initial access broker followed by ransomware affiliate
- Obfuscated PowerShell implant persisted via randomly named scheduled tasks
- AnyDesk, netscan.exe, and BYOVD evidence found on domain controller
- ATT&CK
- T1053.005 Scheduled TaskT1059.001 PowerShellT1021.001 Remote Desktop ProtocolT1486 Data Encrypted for ImpactT1219 Remote Access Software
- Malware
- INC Ransomware
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | throughoutes.net | ipt was heavily obfuscated and communicated with the domain throughoutes[.]net . During this early-August time period, we also observed |
| ipv4 | 213.111.185.108 | application, with a command-and-control (C2) IP address of 213.111.185[.]108 , was observed being installed on one of the endpoints. T |
From the original article
7 min read at huntress.comHuntress analysts reconstructed a three-week INC ransomware attack from endpoint data, uncovering a 17-day lull despite missing process telemetry.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.