6 minhigh
The Tale of Two INC Ransom Notes
INC ransomware hit 175+ endpoints via BYOVD defense evasion and Impacket remote execution, with two distinct ransom notes indicating possible IAB-to-affiliate handoff. Attackers compromised a Windows environment in two phases separated by 17 days. Phase one used obfuscated PowerShell implants via scheduled tasks and RDP lateral movement. Phase two deployed AnyDesk, a BYOVD EDR killer, and Impacket atexec.py to push INC ransomware across 175+ endpoints from domain controllers.
Sens:LowConf:medium
IOCs10
4filename4file path1domain1ip
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block C2 IP 213.111.185.108 and domain throughoutes.net at perimeter.
- Isolate affected endpoints and domain controllers from the network.
- Remove malicious scheduled tasks and AnyDesk installations from all endpoints.
- Rotate credentials for all compromised user accounts.
Key Takeaways
- Two ransom notes dropped 53 minutes apart: INC-README.txt and DATALEAK_PRESS_RELEASE.txt
- Second ransom note contained detailed inventory of stolen files and their contents
- 17-day lull between phases suggests IAB handoff to ransomware affiliate
- Renamed Vicarius vRx executable placed in 7-Zip folder as HealthUpdater.exe
- Impacket atexec.py used to create temporary scheduled tasks for ransomware deployment
Attack Chain
- Initial Access: Unknown vector; compromised user account used for RDP lateral movement across endpoints.
- Persistence: Scheduled tasks with randomized names created pointing to obfuscated PowerShell implant communicating with throughoutes.net.
- Second Wave: AnyDesk installed with C2 IP; netscan.exe and BYOVD tooling deployed after 17-day lull.
- Defense Evasion: BYOVD tool hwau.exe loads kernel driver HWAuidoOs2Ec.sys via HwAudio service to disable security products.
- Execution: Impacket atexec.py creates temporary scheduled tasks to install EDR killer and launch INC ransomware.
- Impact: INC ransomware encrypts 175+ endpoints; two ransom notes dropped with detailed stolen data inventory.
Affected Systems
- Windows endpoints (175+ impacted)
- Windows domain controllers
- Systems with AnyDesk installed
- Endpoints with scheduled task capabilities
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Post-incident analysis with degraded telemetry; some artifacts oxidized over time. |
| Network Visibility | Low | Only C2 IP and domain identified; limited network telemetry available post-incident. |
| Detection Difficulty | Hard | BYOVD, renamed legitimate tools, and obfuscated scripts complicate signature-based detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Scheduled tasks with nonsensical randomized names executing PowerShell from ProgramData indicate persistence (T1053.005, T1059.001). | Scheduled task creation events and process command lines. | Persistence | Low — randomized nonsensical names are rare in legitimate admin activity. |
| Driver files loaded from C:\Users\Public via newly created kernel services indicate BYOVD defense evasion (T1547.006, T1562.001). | Driver load events and service installation logs. | Defense Evasion | Low — legitimate drivers rarely load from user-writable paths. |
| Impacket atexec.py creating temporary scheduled tasks across multiple endpoints signals lateral ransomware deployment (T1021.002, T1053.005). | SMB session logs and rapid scheduled task creation across hosts. | Execution | Medium — admin tools may create scheduled tasks remotely. |
Required Log Sources
- Windows Event Logs
- Scheduled Task creation logs
- Process creation events (Sysmon EID 1)
- Driver/service installation logs
- RDP connection logs (EID 4624/4625)
- EDR telemetry
Key Behavioral Indicators
- Scheduled tasks with randomized nonsensical names and descriptions
- PowerShell scripts executing from C:\ProgramData\ subdirectories
- Kernel driver files loaded from C:\Users\Public
- Renamed executables placed in 7-Zip installation directory
- AnyDesk installed on domain controllers or servers
- New kernel-driver services with unusual names like HwAudio
Control Gaps
- Application allowlisting for C:\Users\Public executable content
- Driver signature enforcement on domain controllers
- Monitoring for renamed legitimate executables in unusual paths
- Detection of AnyDesk installation on critical infrastructure
- Alerting on rapid scheduled task creation across multiple endpoints
False Positive Assessment
Medium — AnyDesk, netscan.exe, and 7-Zip are legitimate tools; scheduled tasks are common admin activity. Context of installation path, naming, and timing distinguishes malicious use.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce MFA on all remote access and privileged accounts.
- Restrict RDP access to specific jump boxes or VPN-only connections.
- Enable driver signature enforcement to block unsigned kernel drivers.
- Alert on new scheduled task creation across domain-joined systems.
User Protection
- Deploy EDR with BYOVD detection and driver load monitoring.
- Block unauthorized remote management tools on domain controllers.
- Monitor C:\Users\Public for executable or driver file creation.
Security Awareness
- Maintain tested offline backups and an incident response plan with rapid isolation procedures.
- Restrict privileged accounts to only the systems they require.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Tactic
Impact
Plain-Language Summary
Attackers broke into an organization's computer network and deployed ransomware called INC across more than 175 computers. They used legitimate remote-access tools and a technique to disable security software before encrypting files. The attackers left two separate ransom notes, with the second one listing detailed descriptions of stolen files and threatening to contact the victim's employees, partners, and media. Organizations should enforce multi-factor authentication, monitor for unusual scheduled tasks, and maintain offline backups.
Additional IOCs
- File Paths:
C:\ProgramData\Vendettister\jocularities.ps1- Obfuscated PowerShell implant referenced by scheduled taskC:\Program Files\7-Zip\HealthUpdater.exe- Renamed Vicarius vRx executable in unusual pathC:\Users\Public\hwau.exe- EDR/AV killer component on domain controllerC:\Users\Public\HWAuidoOs2Ec.sys- Malicious kernel driver file on domain controller
- Command Lines:
- Purpose: Remote execution on multiple endpoints via temporary scheduled tasks | Tools:
atexec.py,Impacket| Stage: Execution |atexec.py - Purpose: Persistence via scheduled tasks with randomized names | Tools:
schtasks,PowerShell| Stage: Persistence |schtasks /create /tn <taskname> /tr
- Purpose: Remote execution on multiple endpoints via temporary scheduled tasks | Tools:
- Other:
HwAudio- Kernel-driver service name used to load EDR killer drivernetscan.exe- Network scanner tool deployed via AnyDesk by attackersHealthUpdater.exe- Renamed vRx executable used as disguised tooling
Showing defanged values
- domainthroughoutes[.]netC2 domain contacted by obfuscated PowerShell implant
- filenameDATALEAK_PRESS_RELEASE.txtSecond ransom note with detailed stolen data inventory
- filenamehwau.exeEDR/AV killer component dropped in C:\Users\Public
- filenameHWAuidoOs2Ec.sysMalicious kernel driver loaded via HwAudio service
- filenameINC-README.txtFirst INC ransom note dropped on endpoints
- file_pathC:\ProgramData\Vendettister\jocularities.ps1Obfuscated PowerShell implant referenced by scheduled task
- file_pathC:\ProgramFiles\7-Zip\HealthUpdater.exeRenamed Vicarius vRx executable in unusual path
- file_pathC:\Users\Public\hwau.exeEDR/AV killer component on domain controller
- file_pathC:\Users\Public\HWAuidoOs2Ec.sysMalicious kernel driver file on domain controller
- ip213[.]111[.]185[.]108C2 IP associated with attacker AnyDesk installation