Full Report
Huntress analysts reconstructed a three-week INC ransomware attack from endpoint data, uncovering a 17-day lull despite missing process telemetry.
Analysis Summary
# Incident Report: INC Ransomware Multi-Stage Attack
## Executive Summary
In August, Huntress analysts investigated a successful INC ransomware deployment affecting over 175 endpoints. The attack was characterized by a 17-day lull between initial exploitation and final encryption, suggesting a hand-off between an initial access broker (IAB) and a ransomware affiliate. The threat actors utilized Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security controls and employed a two-stage ransom note strategy to increase psychological pressure on the victim.
## Incident Details
- **Discovery Date:** Late August 2026 (Post-incident onboarding)
- **Incident Date:** Early August to Late August 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Early August
- **Vector:** Unknown (Telemetry missing due to post-incident deployment)
- **Details:** Initial activity was tracked to early August before a significant period of inactivity.
### Lateral Movement
- **Lull Period:** A 17-day gap occurred between initial activity and the final ransomware phase.
- **Persistence/Movement:** Attackers deployed an executable configured to run multiple scheduled tasks with randomized names to maintain presence and move through the network.
### Data Exfiltration/Impact
- **Date/Time:** Late August
- **Impact:** Encryption of at least 175 endpoints, including Domain Controllers.
- **Secondary Impact:** Potential data theft (implied by the "Press Release" ransom note).
### Detection & Response
- **Detection:** The incident was confirmed upon the discovery of encrypted files and ransom notes.
- **Response:** Huntress was onboarded post-incident to perform forensics and reconstruction from remaining endpoint data.
## Attack Methodology
- **Initial Access:** Unknown.
- **Persistence:** Scheduled tasks with randomized names.
- **Defense Evasion:** Bring Your Own Vulnerable Driver (BYOVD) used to disable security software/EDR.
- **Discovery:** Reconnaissance of Domain Controllers.
- **Lateral Movement:** Noted across 175+ endpoints.
- **Impact:** Deployment of INC Ransomware; double extortion via press release threats.
## Impact Assessment
- **Financial:** High (Ransom demand and recovery costs).
- **Data Breach:** Likely; threat actors issued a `DATALEAK_PRESS_RELEASE.txt` note.
- **Operational:** Severe; at least 175 endpoints and Domain Controllers were compromised/encrypted.
- **Reputational:** High; attackers threatened to notify media, partners, and clients.
## Indicators of Compromise
- **File Indicators:**
- `INC-README.txt` (Standard ransom note)
- `DATALEAK_PRESS_RELEASE.txt` (Secondary pressure note)
- **Behavioral Indicators:**
- Deployment of vulnerable drivers to kill security processes (BYOVD).
- Creation of multiple scheduled tasks with randomized naming conventions.
- 17-day period of dormancy between initial breach and encryption.
## Response Actions
- **Containment:** Post-incident installation of Huntress agent to identify remaining threats.
- **Eradication:** Forensic reconstruction of the attack path to identify compromised service accounts and scheduled tasks.
- **Recovery:** Restoration of impacted endpoints (ongoing at time of report).
## Lessons Learned
- **Visibility Gaps:** The absence of EDR/monitoring during the first 17 days allowed the attackers to reside in the network undetected and prepare for full-scale encryption.
- **Segmented Attacks:** The 17-day lull confirms the maturity of the cybercrime ecosystem, where IABs sell access to affiliates who later perform the "loud" encryption phase.
- **Advanced Evasion:** Attackers are increasingly using BYOVD to bypass traditional security tools, necessitating specialized detection for driver loading.
## Recommendations
- **Proactive Monitoring:** Ensure EDR/MDR solutions are deployed across all endpoints, including Domain Controllers, before an incident occurs.
- **Driver Allow-listing:** Implement Microsoft’s vulnerable driver blocklist or similar controls to prevent BYOVD attacks.
- **Log Retention:** Maintain at least 30-90 days of process-level telemetry to allow for reconstruction of "long-tail" attacks.
- **Task Auditing:** Monitor for the creation of new scheduled tasks, particularly those with randomized names or those created by service accounts.