Huntress Reconstructs INC Ransomware Attack Using Surviving Evidence
Summary
Huntress reconstructed parts of an INC ransomware attack from post-incident evidence, finding scheduled-task persistence, RDP lateral movement, AnyDesk deployment, and a BYOVD tool used to disable security controls. The initial access vector remains unknown.
Key points
- The ransomware affected at least 175 endpoints, with traces of attacker activity found on domain controllers.
- Investigators could not determine the initial access vector because the incident response began after the attack and some telemetry had expired.
- Early-August activity included obfuscated PowerShell persistence through a scheduled task and lateral movement over RDP using a compromised account.
- After a 17-day lull, AnyDesk was used to deploy tools, including a vulnerable driver used to disable security controls.
- Attackers used Impacket's atexec.py to run tools through temporary scheduled tasks and launch INC ransomware.
- A second ransom note threatened a public announcement and contact with the victim's stakeholders, and listed allegedly stolen files.
- Huntress recommends monitoring unusual scheduled tasks, remote-management tools, and driver services, alongside MFA, least privilege, offline backups, and rapid isolation plans.
Article Details
- Attack Vectors
- The initial access vector could not be determined.
- A compromised user account was used for lateral movement between endpoints via Remote Desktop Protocol.
- AnyDesk was installed and used to deploy netscan.exe and a vulnerable-driver tool to multiple endpoints.
- Impacket's atexec.py was used to execute tools remotely by creating and running temporary scheduled tasks.
- A PowerShell implant referenced by a scheduled task communicated with throughoutes[.]net.
- Defensive Notes
- Limit and monitor remote access, enforce multi-factor authentication, and restrict privileged accounts to the systems they need.
- Monitor for unusual scheduled tasks, unexpected remote-management tools, new or unsigned driver services, and activity designed to disable security products.
- Maintain tested offline backups and an incident response plan that includes rapid isolation procedures.
- Preserve and review available artifacts, including scheduled tasks, remote-access tooling, driver services, event logs, and ransom notes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | throughoutes[.]net | Domain contacted by the obfuscated PowerShell implant. |
| IPV4 | 213[.]111[.]185[.]108 | Command-and-control IP associated with the observed AnyDesk installation. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolA compromised user account was observed moving between endpoints via RDP.T1053.005 · Scheduled TaskScheduled tasks with randomized names were used for persistence and to run tools, including ransomware deployment.T1059.001 · PowerShellAn obfuscated PowerShell implant was referenced by an early scheduled task.T1219 · Remote Access ToolsAnyDesk was installed and used to deploy tools to several endpoints.T1486 · Data Encrypted for ImpactINC ransomware was deployed on impacted systems.T1562.001 · Disable or Modify ToolsA BYOVD tool loaded a vulnerable driver as part of activity intended to disable security controls.
People
Malware
Vendors
HuntressIn late August, the Huntress agent was installed on an organization after an incident involving the INC ransomware. Typically, this would limit our visibility into certain aspects of the attack, such as the initialVicariustask pointed to C:\Program Files\7-Zip\HealthUpdater.exe, which was a renamed vRx executable from Vicarius Inc. The vRX tooling is described as "a remediation-first cybersecurity platform that helps IT and
Products
AnyDeskof lateral movement. Then, a second "wave" of activity was identified occurring two weeks later, when AnyDesk was installed as a way to deploy netscan.exe, a vulnerable driver, and various tools. Shortly after, INCvRxOn one endpoint, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, which was a renamed vRx executable from Vicarius Inc. The vRX tooling is described as "a remediation-first cybersecurity platform
Tools
ImpacketThe attackers used Impacket's atexec.py remote execution utility to execute tools on multiple endpoints by creating and running temporary scheduled tasks. The tasks were used to install the EDR/AV killer driver andnetscan.exeof activity was identified occurring two weeks later, when AnyDesk was installed as a way to deploy netscan.exe, a vulnerable driver, and various tools. Shortly after, INC ransom notes were dropped on the