Acknowledgements: A special "thank you" goes to Michael Tigges for his extraordinary contributions in unraveling this incident.
Background
In August, Huntress onboarded an organization post-incident, following the successful deployment of INC ransomware. The organization was widely impacted (across at least 175 endpoints) and traces of the attackers' activity was found on its domain controllers.
As we've detailed before, post-incident investigations limit our visibility into what happened, because EDR telemetry from during the attack itself—which gives valuable insight into the malicious behavior that triggered detections—is not available. That was the case for this incident: we couldn't see the full picture, because portions of the environment were already impacted before the investigation started. However, Huntress researchers were able to piece together several parts of the attack that gave an indication of what attackers did after gaining initial access. That included fragments of a BYOVD tool found on a domain controller and several scheduled tasks with randomized names.
The observed activity included several notable elements. It spanned from early to late August, with a 17-day lull in the middle. This raises the possibility that the activity was the result of different threat actors or groups, one possibly being an initial access broker (IAB), and the other clearly being a ransomware affiliate. Additionally, while investigating the organization, we found not one, but two ransom notes that the attackers had dropped.
Ransom notes
The initial ransom note (INC-README.txt
) was indicative of a typical ransom note we often find in such incidents. The attackers threatened to publish the victim organization's data if they didn't pay, and included other sections, such as one where they stated: "We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data."
Figure 1: Excerpt from first ransom note
Huntress analysts also found a second ransom note that had been dropped about 53 minutes later called DATALEAK_PRESS_RELEASE.txt
. Here, threat actors threatened to publish a "press release" about the victim if they didn't hear from them within 48 hours. The note appeared to be a further attempt at pressuring victims into paying, with attackers also warning that they would start notifying media, employees, partners, and clients.
Figure 2: Excerpt from second ransom note
Note that multiple copies of the second ransom note were found, and they were all found to be identical, based on file hashes. The rest of the second ransom note contained a detailed listing of file paths searched, files stolen, with detailed descriptions of their content. If we assume that the statements in the second ransom note regarding the file content are true, then this likely means that the threat actor had considerable time to not only find and retrieve the data, but also develop a fairly comprehensive and detailed understanding of what they stole.
Both ransom notes put continued pressure on the victim. In addition to trying to lend credibility to the ransomware group or affiliate, ransom notes typically threaten escalation, through rising prices, permanent data loss, public leaks of stolen data, or even reaching out to customers or partners.
Back to the beginning
Timeline mysteries
Much of the data on various endpoints had faded or "oxidized" due to the passage of time, as some logs "rolled over" and the endpoint continued to operate and be used at a normal, operational rate. Because of this, Huntress researchers were not able to uncover the initial access vector used in this attack.
However, there were still various fragments of the attack researchers were able to glean while looking at Huntress EDR telemetry and the available Windows Event Logs. We were able to track malicious activity on impacted endpoints back to at least early August. This included the creation of various scheduled tasks and observable traces of lateral movement. Then, a second "wave" of activity was identified occurring two weeks later, when AnyDesk was installed as a way to deploy netscan.exe
, a vulnerable driver, and various tools. Shortly after, INC ransom notes were dropped on the organizations' domain controller.
Given the timing and differences in activity between what occurred earlier in the month, and then later in the month, it is possible that the activity was the result of different threat actors or groups, one possibly being an IAB, and the other clearly being a ransomware affiliate.
The first attack phase: Scheduled tasks and lateral movement
During the course of the investigation, we discovered several scheduled tasks with random names, which were likely intended to help the threat actor achieve persistence and enable other parts of their attack. One of the earliest traces of activity we found occurred in early August, when the scheduled task Nonweighise\Cancellationizing\Illuminateers
, with the description "nationhood kinestheticization preironish fictionallyes
", was originally registered. This scheduled task pointed to the following PowerShell implant:
C:\ProgramData\Vendettister\jocularities.ps1
This PowerShell script was heavily obfuscated and communicated with the domain throughoutes[.]net
.
During this early-August time period, we also observed lateral movement activity via a compromised user account. Specifically, the account was observed moving between endpoints via Remote Desktop Protocol (RDP).
Following the scheduled task being registered and lateral movement, there did not appear to be indications of any additional significant activity on the endpoints to which the Huntress agent had been deployed for the next 17 days.
The next attack phase: BYOVD attack evidence, ransom notes
We also discovered activity from the end of August, where additional scheduled tasks were registered on several endpoints, via the same compromised user account observed associated with lateral movement.
On one endpoint, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe
, which was a renamed vRx executable from Vicarius Inc. The vRX tooling is described as "a remediation-first cybersecurity platform that helps IT and security teams find, prioritize, and fix software vulnerabilities." Note, however, that it was deployed in an unusual folder/path, and the executable was renamed, although the file version information in the executable did not contain the original file name.
Finally, the AnyDesk remote desktop application, with a command-and-control (C2) IP address of 213.111.185[.]108
, was observed being installed on one of the endpoints. Through this AnyDesk instance, both netscan.exe
and a BYOVD were deployed to several endpoints. BYOVD is a common tactic where attackers load a legitimate but vulnerable driver to gain kernel-level access, usually to disable security tools before further compromise. In this case, Huntress telemetry picked up fragments of the BYOVD tooling; specifically, hwau.exe
was found in C:\Users\Public
on a domain controller. This was used to load a kernel-driver service (HwAudio
) in C:\Users\Public\HWAuidoOs2Ec.sys
.
The attackers used Impacket's atexec.py remote execution utility to execute tools on multiple endpoints by creating and running temporary scheduled tasks. The tasks were used to install the EDR/AV killer driver and launch INC ransomware.
Following deployment of the ransomware, the INC-README.txt
ransom note that has been observed during similar incidents appeared, as well as the second ransom note, DATALEAK_PRESS_RELEASE.txt
, which contained very detailed information regarding data that had been stolen from the environment.
Surviving evidence and pressure points
Even when responders arrive after ransomware has been deployed, the surviving evidence can still tell an important story. In this incident, Huntress analysts used the telemetry and Windows event data that remained to reconstruct various activities: early persistence and lateral movement, the deployment of AnyDesk, a BYOVD tool designed to disable security controls, and the INC ransomware payload.
The two ransom notes added another layer to the attack. The second note, with its detailed accounting of allegedly stolen files and threats to contact the victim's stakeholders, shows how ransomware operators continue to refine the pressure they place on victims beyond encryption alone.
While the initial access vector could not be determined, the investigation underscores the value of preserving and reviewing every available artifact after an incident. Scheduled tasks, remote-access tooling, driver services, event logs, and even ransom notes can help defenders understand an intrusion's progression, assess the scope of compromise, and strengthen their response for the next attack.
Organizations can make ransomware attacks harder to execute by limiting and monitoring remote access, enforcing mutli-factor authentication (MFA), and restricting privileged accounts to only the systems they need. Teams should also monitor for unusual scheduled tasks, unexpected remote-management tools, new or unsigned driver services, and activity designed to disable security products. Finally, maintain tested, offline backups and an incident response plan that includes rapid isolation procedures, so an intrusion can be contained before attackers have time to move laterally, steal data, and deploy ransomware.
IoC Table
Item | Description |
|---|---|
| First INC ransom note |
| Second INC ransom note |
| Obfuscated PowerShell implant referenced by an early scheduled task |
| Domain contacted by the obfuscated PowerShell implant |
| Command-and-control IP associated with the observed AnyDesk installation |
| EDR/AV killer component found in C:\Users\Public\ on a domain controller |
| Renamed Vicarius vRx executable, observed in C:\Program Files\7-Zip\ |
| Driver loaded by the HwAudio kernel-driver service |
| Kernel-driver service used to load the EDR/AV killer driver |