Image: cdn.builder.io · rights & removal

The Tale of Two INC Ransom Notes: A Ransomware Timeline

Reporting by Huntress LabsRead the original at huntress.com

Executive Summary

Post-incident investigation revealed activity spanning from early to late August involving an organization that onboarded after the deployment of INC ransomware, impacting at least 175 endpoints with traces found on domain controllers. Initial findings indicated potential involvement from different threat actors, possibly an Initial Access Broker (IAB) and a ransomware affiliate, given a 17-day lull in activity. Ransom notes were discovered: an initial note demanding payment for decryption software and a subsequent press release note threatening data leaks if demands were not met within 48 hours. The second ransom note contained detailed information about files allegedly stolen and prompted further pressure. Investigative traces included the registration of scheduled tasks, lateral movement via Remote Desktop Protocol (RDP), deployment of AnyDesk, and the use of a BYOVD tool to gain kernel-level access, which was followed by the deployment of tools like netscan.exe and subsequent ransomware execution.

Facts Only

* Huntress onboarded an organization post-incident following INC ransomware deployment.
* At least 175 endpoints were widely impacted.
* Traces of attacker activity were found on domain controllers.
* Activity spanned early to late August, including a 17-day lull in the middle.
* Two ransom notes were found: INC-README.txt and DATALEAKPRESSRELEASE.txt.
* The first ransom note threatened to provide decryption software and destroy stolen data if paid.
* The second ransom note threatened to publish a press release regarding stolen files within 48 hours.
* Scheduled tasks with randomized names were discovered, including one referencing the PowerShell implant C:\ProgramData\Vendettister\jocularities.ps1.
* Lateral movement was observed via Remote Desktop Protocol (RDP) between endpoints.
* A second wave of activity included installing AnyDesk to deploy netscan.exe and BYOVD tools.
* The sequence involved scheduled tasks executing tools to install an EDR/AV killer driver and launch INC ransomware.
* Fragments of BYOVD tooling, including hwau.exe, were found on a domain controller.
* A command-and-control IP address associated with AnyDesk installation was 213.111.185[.]108.

Full Take

The investigation revealed a fragmented timeline suggesting the presence of at least two distinct phases or threat actors operating within the same environment, indicated by the temporal separation between early-month activity involving scheduled tasks and lateral movement, and later activity involving BYOVD deployment and subsequent ransomware deployment. The persistence mechanism utilized an obfuscated PowerShell script to establish initial footholds and facilitate lateral movement through RDP. This suggests a sophisticated actor capable of operating across different engagement strategies, from reconnaissance to final extortion. The discovery of the second ransom note, with its detailed cataloging of stolen data, indicates that the threat was not merely about encryption but involved active data exfiltration and subsequent leverage against the victim's stakeholders, demonstrating an escalation tactic beyond simple ransomware demands. The juxtaposition of seemingly disparate tools—such as a scheduled task executing a PowerShell implant alongside kernel-level manipulation via BYOVD—highlights that modern intrusion chains often blend low-level system compromise with high-level extortion goals. The focus on preserving residual artifacts like scheduled tasks and ransom notes underscores that full visibility into the initial access vector is often lost, emphasizing the necessity of continuous artifact preservation for reconstructing attacker methodology.
Bridge Questions: What methods exist for better correlating time-stamped activity across disparate endpoint logs to reconstruct multi-stage attacks when EDR telemetry is absent? How can organizations design detection strategies that focus on behavioral sequences rather than isolated events when initial access vectors remain obscured? What responsibility do defenders hold in securing the entire forensic artifact lifecycle, from initial compromise to final response?

From the original · Huntress Labs

Acknowledgements: A special "thank you" goes to Michael Tigges for his extraordinary contributions in unraveling this incident. Background In August, Huntress onboarded an organization post-incident, following the successful deployment of INC ransomware.

Read the full story at huntress.com

Sentinel — Human

Confidence

The text reads like a detailed post-mortem derived from a forensic investigation, exhibiting strong analytical structure and grounded specificity, suggesting human authorship by an analyst or technical writer.

Signals Detected

Moderate sentence length variance; shifts between dense technical description and narrative synthesis.

High coherence, maintaining a consistent forensic narrative flow despite complex technical jumps. Lacks the overly polished, emotionally neutral tone of pure AI summarization.

Evidence of specific, concrete artifact citation (e.g., specific file paths, task names) suggests grounded reporting rather than general assertion.

The inclusion and precise linking of specific findings (like the exact names of scheduled tasks and executable paths) suggests either direct reporting from a forensic team or highly accurate synthesis thereof, increasing plausibility for human origin.

Human Indicators

Use of complex, layered causal reasoning to hypothesize about threat actor progression (IAB vs. ransomware affiliate).

The transition between abstract investigation findings and the highly specific IoC table structure suggests an analytical framework applied by a human investigator.

The inclusion of direct, raw evidence citations (even implied via the IOc Table) anchors the narrative in specific discovery rather than pure theoretical speculation.