When Huntress was called in to an organization where INC ransomware had already run across at least 175 machines, its responders found something they don't usually see: a second ransom note, dropped about 53 minutes after the first.
The first was routine. INC-README.txt threatened to publish the company's data if it did not pay, with the usual reassurance that the crew is "not a politically motivated group and we want nothing more than money." The second, DATALEAK_PRESS_RELEASE.txt, was an escalation with a clock on it: make contact within 48 hours, or we start telling the media, your employees, your partners and your clients what happened. Copies were scattered through the environment, identical down to the file hash.
The note that doubles as an inventory
What makes the second note unusual is the rest of it. In its write-up of the incident, Huntress describes a detailed listing of the file paths the attackers searched and the files they took, each with a description of the contents. If they're accurate, the crew didn't simply sweep up folders on the way out. It had time to read what it stole and work out which parts would hurt most in a press release. IntelFusions has tracked INC Ransom escalating on victims before, including its claim against quantum computing firm Quantinuum in August.
Seventeen days of nothing in the middle
The timeline is the other oddity. Huntress arrived after the encryption, so the EDR telemetry from the attack itself was gone and logs on many machines had rolled over. The initial access route couldn't be recovered. What survived still sketched two phases.
In early August somebody registered a scheduled task with a nonsense name, Nonweighise\Cancellationizing\Illuminateers, pointing at a heavily obfuscated PowerShell script at C:\ProgramData\Vendettister\jocularities.ps1 that called home to throughoutes[.]net. The same window shows a compromised user account moving between machines over Remote Desktop. Then, for 17 days, nothing.
Late in the month the same account came back and the tradecraft changed character. AnyDesk was installed and pointed at 213[.]111[.]185[.]108, the netscan.exe network scanner was pushed out through it, and a renamed Vicarius vRx binary was parked as HealthUpdater.exe inside C:\Program Files\7-Zip. Huntress says the gap and the shift raise the possibility that two sets of hands were involved, one possibly an initial access broker selling on to the other, which was clearly a ransomware affiliate.
A borrowed driver to switch off the alarms
The second phase also brought a bring-your-own-vulnerable-driver attack, the trick where an intruder loads a legitimate but flawed driver to reach kernel level and switch the security software off from underneath it. Fragments landed on a domain controller: hwau.exe in C:\Users\Public, used to register a kernel driver service called HwAudio that loaded C:\Users\Public\HWAuidoOs2Ec.sys. To run tooling everywhere at once, the attackers used Impacket's atexec.py, which creates throwaway scheduled tasks on remote machines. The same mechanism launched the ransomware itself.
Limit remote access, then watch for new driver services
There's no patch to apply here, because this is a tradecraft story rather than a vulnerability. Huntress recommends limiting and monitoring remote access, enforcing multi-factor authentication, and restricting privileged accounts to the systems they need. For detection, it points to scheduled tasks nobody recognises, remote-management tools that arrived without a ticket, new or unsigned driver services, and anything trying to disable a security product. Keep backups offline and tested, because the 17-day lull here was also 17 days in which somebody could have caught it.
Indicators
- throughoutes[.]net, contacted by the obfuscated PowerShell implant
- 213[.]111[.]185[.]108, command and control for the AnyDesk installation
- C:\ProgramData\Vendettister\jocularities.ps1, the PowerShell implant
- hwau.exe and HWAuidoOs2Ec.sys in C:\Users\Public, the vulnerable-driver components
- HealthUpdater.exe, a renamed Vicarius vRx executable in C:\Program Files\7-Zip
Huntress credits analyst Michael Tigges with unravelling the incident. A ransom note has always been a sales document. This one arrived with a contents page.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.