Loading story…
Huntress reconstructed an INC ransomware intrusion affecting at least 175 endpoints, including domain controllers. Although the initial-access method could not be established because relevant EDR telemetry and logs had expired, surviving evidence showed persistence and RDP-based lateral movement before a 17-day pause in activity.
Attackers later installed AnyDesk, deployed a bring-your-own-vulnerable-driver (BYOVD) toolkit and an EDR/antivirus-killer driver, and used Impacket atexec.py to distribute tools and launch INC ransomware across the environment. Two ransom notes were left; the second claimed data exfiltration and threatened to notify the victim's media contacts, employees, partners, and clients if no response was received within 48 hours. Huntress said the separated phases may indicate an initial-access broker handing off to an INC affiliate, though attribution remains unconfirmed.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
In late August, the same compromised user account registered additional scheduled tasks on several endpoints, including one that invoked HealthUpdater.exe, a renamed Vicarius vRx executable.
In early August, attackers registered a scheduled task named "Nonweighise\Cancellationizing\Illuminateers" that executed an obfuscated PowerShell implant at C:\ProgramData\Vendettister\jocularities.ps1. The implant communicated with throughoutes[.]net, and a compromised account conducted RDP-based lateral movement between endpoints.
About 53 minutes after the initial ransom note, attackers dropped DATALEAK_PRESS_RELEASE.txt, which listed alleged exfiltrated files and threatened to contact media, employees, partners, and clients if the victim did not respond within 48 hours.
The attackers dropped an INC-README.txt ransom note threatening to publish stolen victim data unless a ransom was paid.
Attackers used Impacket atexec.py to create temporary scheduled tasks on multiple endpoints, installing the EDR/AV-killer driver and launching INC ransomware. The deployment affected at least 175 endpoints and included activity on domain controllers.
Attackers installed AnyDesk, associated with C2 address 213.111.185[.]108, and used it to distribute netscan.exe, a vulnerable driver, and other tools. They deployed hwau.exe and the HWAuidoOs2Ec.sys driver on a domain controller to gain kernel-level access and disable security controls using a BYOVD technique.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
INC ransomware has grown into one of the most active **ransomware-as-a-service** operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than **800 claimed victims**, uses **double extortion** by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations. Researchers said INC has upgraded both its **Windows** and **Linux/ESXi** encryptors by rewriting them in **Rust**, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including **Citrix Bleed 2**, **Citrix NetScaler**, **SimpleHelp RMM**, and **Fortinet EMS** vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from **Veeam** environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as **rclone**; analysts also linked INC code to related strains including **Lynx**, **Sinobi**, and **Knoba** after the group’s source code was reportedly sold to multiple parties.
Jul 23, 2026
A reported operational security failure by the **INC ransomware** group enabled incident responders to identify attacker infrastructure and recover data stolen from **12 U.S. organizations**. A forensic review of artifacts from an intrusion—initially detected when ransomware encryption activity hit a production **SQL Server**—revealed infrastructure that stored exfiltrated victim data beyond the single investigated case, allowing broader recovery efforts. Cyber Centaurs (DFIR) traced the intrusion to a *RainINC* ransomware variant staged and executed from the Windows `PerfLogs` directory, a location increasingly abused by threat actors for staging. Investigators found renamed binaries (e.g., `winupdate.exe`) and PowerShell tooling, including a script (`new.ps1`) containing Base64-encoded *Restic* commands and hardcoded environment variables (e.g., access keys, repository paths, and S3 passwords) tied to encrypted repositories; although *Restic* was not used in the specific attack, these remnants shifted the work from incident response to infrastructure analysis and ultimately exposed reusable attacker storage repositories linked to multiple victims.
Jun 29, 2026
The ransomware group **INC Ransom** has been linked to an attack on `takethehop.com`, the website of **The HOP**, a regional public transit system operated by the Hill Country Transit District in Texas. The incident was reported as a data breach and ransomware event, adding a public-sector transportation victim to the group’s growing list of targets as double-extortion campaigns continue to hit North American organizations. MITRE ATT&CK describes **INC Ransom** as an intrusion set that commonly gains access through phishing, compromised valid accounts, and exploitation of public-facing applications including `CVE-2023-3519` in Citrix NetScaler, then conducts discovery, lateral movement, data staging, exfiltration, and encryption. The group has been observed using tools such as **AnyDesk**, **PuTTY**, **PsExec**, **MegaSync**, **Advanced IP Scanner**, **WMIC**, **7-Zip**, and **WinRAR**, while disguising activity and disabling defenses before deploying ransomware. A recent Cyble global threat report also identified **INC Ransom** among the major ransomware actors active in 2026, underscoring the continued scale of double-extortion operations worldwide.
Jul 27, 2026