Full Report
The Huntress team investigated a ransomware attack of a new INC Ransom threat actor group. Here is the activity we observed.
Analysis Summary
# Incident Report: Investigation of INC Ransom Group Activity
## Executive Summary
The Huntress team investigated a ransomware attack conducted by the newly identified threat actor group "INC Ransom." The attack involved a week-long dwell time characterized by credential abuse, data staging with 7-Zip, and exfiltration via MEGASync before final encryption. Huntress provided a detailed forensic breakdown of the movement across three primary servers, highlighting the group's reliance on native tools and RDP for lateral movement.
## Incident Details
- **Discovery Date:** August 2023
- **Incident Date:** July-August 2023 (Encryption occurred 7 days after initial access)
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed (General threat research)
- **Geography:** Global impact (Austrian hotel noted as early victim)
## Timeline of Events
### Initial Access
- **Date/Time:** Day 1
- **Vector:** Compromised Valid Credentials
- **Details:** The attack began with rapid, short connections to "Server 1" using three distinct source system names: `ylqlCXO9VdRiZ5JK`, `aJLXC9TzxgInkqf4`, and `UxUZNZXxMeBN2jox`.
### Lateral Movement
- **Day 2-5:** The threat actor utilized RDP and compromised credentials to move from Server 1 to Server 2 and eventually Server 3.
### Data Exfiltration/Impact
- **Day 3-4:** Extensive data collection and staging occurred on Server 2. The actors used 7-Zip to archive files while specifically excluding large media formats (e.g., .mp4, .mov, .avi) to streamline exfiltration.
- **Day 7:** Ransomware deployment and file encryption across the environment.
### Detection & Response
- **Discovery:** The organization detected the incident when the encryption process began (Day 7).
- **Response Actions:** Impacted systems were taken offline; Huntress conducted a forensic audit of EDR telemetry to reconstruct the 7-day dwell time.
## Attack Methodology
- **Initial Access:** Valid Accounts (Compromised credentials).
- **Persistence:** RDP sessions via compromised accounts.
- **Privilege Escalation:** Not explicitly detailed, but RDP access suggested high-level account compromise.
- **Defense Evasion:** Use of native binaries (Living off the Land) and exclusion of specific file types in 7-Zip to avoid large traffic spikes.
- **Credential Access:** Likely obtained prior to the observed Day 1 activity.
- **Discovery:** Network and domain enumeration using `net group domain admins /domain` and `nltest.exe`.
- **Lateral Movement:** Remote Desktop Protocol (RDP).
- **Collection:** Manual browsing of documents using `Wordpad.exe`, `Notepad.exe`, and `MSPaint`.
- **Exfiltration:** Installation and use of the MEGASync client to transfer staged 7-Zip archives.
- **Impact:** Data encryption via INC Ransomware.
## Impact Assessment
- **Financial:** High (Ransom demand and recovery costs).
- **Data Breach:** Confirmed; staging and exfiltration observed via MEGASync.
- **Operational:** Significant disruption due to server encryption and systems being taken offline.
- **Reputational:** High (INC Ransom maintains a public leak site to shame victims).
## Indicators of Compromise
- **Network Indicators:**
- External connections to `mega[.]io` / MEGASync infrastructure.
- **File Indicators:**
- `7.exe` (7-Zip renamed or portable version).
- `MEGASync.exe` installer.
- INC Ransomware encryptor files.
- **Behavioral Indicators:**
- Unusual RDP activity between internal servers.
- Execution of `nltest.exe` and `net group` by non-admin users.
- Bulk archiving commands: `7.exe a -mx3 -xr!*.exe -xr!*.mp4 ...`
## Response Actions
- **Containment:** Servers were disconnected from the network to prevent further encryption.
- **Eradication:** Identification and removal of MEGASync and 7-Zip staging tools.
- **Recovery:** Analysis of EDR logs to identify the point of entry and extent of exfiltration.
## Lessons Learned
- **Dwell Time:** Attackers remained in the network for a full week before deploying ransomware, providing a large window for detection if behavioral alerts were monitored.
- **"Living off the Land":** The use of MSPaint and Wordpad to preview data shows that attackers avoid specialized hacking tools to bypass basic security filters.
## Recommendations
- **Multi-Factor Authentication (MFA):** Implement MFA on all RDP and external-facing logins to prevent credential abuse.
- **Software Restriction Policies:** Block or alert on the installation of unauthorized cloud storage tools like MEGASync.
- **Behavioral Monitoring:** Set alerts for common enumeration commands (`nltest`, `net group`) and bulk archival activities (7-Zip) initiated from server systems.