Huntress Details Restic Data Staging and INC Ransomware Activity
Summary
Huntress traced an incident involving Restic backup commands, security-tool removal, and INC ransomware. Analysts could not determine initial access or recover the file list, and report similar Restic activity in a separate incident.
Key points
- In a customer incident, the actor accessed an endpoint on February 24, mapped a share, used PsExec to elevate privileges, and created a scheduled task to run a PowerShell script.
- Base64-encoded PowerShell commands configured a renamed Restic executable with AWS credentials and a Wasabi repository, then ran a backup command using a file list analysts could not recover.
- The actor removed the VIPRE agent, disabled Windows Defender real-time protection, and launched INC ransomware on February 25.
- Huntress could not establish the initial access vector; incomplete agent deployment and the absence of SIEM limited visibility.
- A February 9 incident showed similar Restic use and matching AWS access-key variables; Huntress intervention stopped further activity before possible ransomware deployment.
- Huntress says Cyber Centaurs had documented remarkably similar activity in January 2026.
Article Details
- Attack Vectors
- The initial access vector was not determined.
- The threat actor mapped a network share to the endpoint, used PsExec to elevate privileges, and created a scheduled task to run a PowerShell script.
- Base64-encoded PowerShell commands configured a renamed copy of Restic to back up files to a Wasabi S3 repository.
- The actor removed the VIPRE Business Agent, disabled Windows Defender Real-Time Protection, and deployed INC ransomware.
- Defensive Notes
- Ensure endpoint detection agents are fully deployed across the environment; incomplete coverage limited visibility and delayed detection in this incident.
- Use SIEM monitoring to help detect threat actor activity and initial access attempts.
- Monitor PowerShell Event Log event ID 600 for encoded commands, while accounting for legitimate RMM and security tools that may also generate them.
- Monitor for unauthorized security-tool removal or disabling, scheduled-task creation, and use of backup utilities to transfer data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1d15b57db62c079fc6274f8ea02ce7ec3d6b158834b142f5345db14f16134f0d | SHA-256 hash identified for the executable C:\123\edr.exe run by the threat actor. |
| SHA256 | e034a4c00f168134900bfe235ff2f78daf8bfcfa8b594cd2dd563d43f5de1b13 | SHA-256 hash identified for the INC ransomware executable c:\perflogs\win.exe. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe actor created the Recovery Diagnostics scheduled task to run a PowerShell script.T1059.001 · PowerShellThe actor used PowerShell commands, including base64-encoded commands to configure and run Restic.T1486 · Data Encrypted for ImpactThe actor launched the INC ransomware executable, and the article reports creation of ransom notes.T1562.001 · Disable or Modify ToolsThe actor removed the VIPRE Business Agent and disabled Windows Defender Real-Time Protection.T1567.002 · Exfiltration to Cloud StorageThe actor used Restic to back up files to a Wasabi S3 repository.T1569.002 · Service ExecutionThe actor launched PsExec to elevate privileges.
People
Malware
Products
ResticWe have, however, observed data exfiltration via the native Windows utility finger.exe, as well as via backup utilities such as restic, BackBlaze, and s5cmd.VIPRE Business AgentSecurityCenter/15;VIPRE Business Agent,SECURITY_PRODUCT_STATE_OFFWindows DefenderThe threat actor then disabled Windows Defender by disabling Real-Time Protection, as evidenced by the following two Windows Event Log messages:
Tools
HRSwordIn that prior incident, the threat actor had run the HRSword utility to disable security tooling on the endpoint, specifically the Acronis Management Agent Core Service and the Acronis Active Protection Service.PsExecduring which they mapped a share to the endpoint (as the F:\ volume), launched the MS-provided utility PSEXEC to elevate their privileges, and then created the Recovery Diagnostics scheduled task to run