--- title: Investigating New INC Ransom Group Activity description: The Huntress team investigated a ransomware attack of a new INC Ransom threat actor group. Here is the activity we observed. image: https://www.huntress.com/hubfs/INC%20Ransomware-%20Blog%20Thumbnail.jpg --- [Skip to content](https://3911692.hs-sites.com/blog/investigating-new-inc-ransom-group-activity#main-content) [Close ](https://3911692.hs-sites.com/blog/investigating-new-inc-ransom-group-activity#) [![Huntress Logo Wide Teal](https://3911692.hs-sites.com/hs-fs/hubfs/Huntress%20Logo%20Wide%20Teal.png?width=193&height=41&name=Huntress%20Logo%20Wide%20Teal.png)](https://www.huntress.com) [Team Huntress](https://3911692.hs-sites.com/blog/author/team-huntress) 08.11.2023 7 min read # Investigating New INC Ransom Group Activity [Previous Post ](https://3911692.hs-sites.com/blog/identity-the-third-phase-of-security-operations) [Next Post ](https://3911692.hs-sites.com/blog/traditional-antivirus-vs-managed-antivirus) Share on Twitter Share on LinkedIn Share on Facebook Share on Reddit The Huntress team is always keeping our eye on the evolving threat landscape. Now, it seems that a new contender, referred to as “INC” has entered the ransomware fight. 🥊 This new ransomware group began gaining notoriety very recently, with several impacted organizations publicly identified through their leak site, as illustrated in the tweets below. > Looks there is another new ransomware gang: "INC Ransom". > 🤔 [pic.twitter.com/5Plv8bqyL5](https://t.co/5Plv8bqyL5) > > — MalwareHunterTeam (@malwrhunterteam) [August 8, 2023](https://twitter.com/malwrhunterteam/status/1689029459255373826?ref_src=twsrc%5Etfw) > A new [#ransomware](https://twitter.com/hashtag/ransomware?src=hash&ref_src=twsrc%5Etfw) group has been found on the [#DarkWeb](https://twitter.com/hashtag/DarkWeb?src=hash&ref_src=twsrc%5Etfw). > > They call themselves INC RANSOM and have listed the Austrian hotel Thermenhotel Stoiser ([https://t.co/S9gKp8uAQK](https://t.co/S9gKp8uAQK)) as their first victim on their blog. > > [#Cybersecurity](https://twitter.com/hashtag/Cybersecurity?src=hash&ref_src=twsrc%5Etfw) [#Databreach](https://twitter.com/hashtag/Databreach?src=hash&ref_src=twsrc%5Etfw) [#Dataleak](https://twitter.com/hashtag/Dataleak?src=hash&ref_src=twsrc%5Etfw) [#infosec](https://twitter.com/hashtag/infosec?src=hash&ref_src=twsrc%5Etfw) [#cyberattack](https://twitter.com/hashtag/cyberattack?src=hash&ref_src=twsrc%5Etfw)… [pic.twitter.com/4fPIPyZtid](https://t.co/4fPIPyZtid) > > — Stefano Favarato (@StefanoFavarato) [August 9, 2023](https://twitter.com/StefanoFavarato/status/1689272674021781504?ref_src=twsrc%5Etfw) The Huntress team recently investigated a ransomware attack indicative of the ‘INC’ threat actor. While the file encryption process brought the attack to the attention of the impacted organization immediately, an investigation into what led to the attack indicated that the initial phases of the attack began a week prior to the file encryption event, if not sooner.  Three server systems were the primary focus of the Huntress investigation. Huntress did not have complete visibility across the entire impacted infrastructure, and a number of systems were taken offline before log data could be collected from the endpoint. However, the Huntress team was able to assemble a day-by-day accounting of the threat actor’s observable activity across the systems to which we had access. ## Ransomware Attack Breakdown ### *Day 1 - Initially Observed Access, Enumeration* Based on the investigation, the first indication of activity likely associated with the ransomware threat actor began with very short (2-3 seconds) connections to Server 1, in quick succession, albeit with three different source system names (`ylqlCXO9VdRiZ5JK`, `aJLXC9TzxgInkqf4`, and `UxUZNZXxMeBN2jox`). All three connections originated from the same IP address and accessed the target system using the same account name. Approximately four and a half hours later, valid account (compromised) credentials were used to access the same system via Remote Desktop Protocol (RDP). During this brief (~30 min) connection, there was some light enumeration activity (`net group domain admins /domain`, `nltest.exe`). ### ***Day 2*** On the next day, the Huntress team observed a brief RDP login to Server 2, via previously observed credentials. ### ***Day 3 - Collection, Data Staging, Data Exfiltration*** ![INC01](https://www.huntress.com/hubfs/INC01.jpg)On day three, the Huntress team observed an RDP login to Server 2, via previously observed credentials, during which there are numerous 7-Zip archival commands to collect and stage data for exfiltration. The 7-Zip commands all followed the same format: `7.exe  a -mx3 -xr!*.exe -xr!*.mp4 -xr!*.wmv -xr!*.mov -xr!*.avi -xr!*.MXF -xr!*.MTS -xr!*.vhd ` During this time, the Huntress team also observed the threat actor’s use of native tools such as `Wordpad.exe`, `Notepad.exe`, and `MSPaint` to view the contents of documents and image/JPEG files. Finally, the threat actor installed [MEGASync](https://mega.io/desktop) on Server 2, presumably to facilitate data exfiltration. ### ***Day 4 - Collection, Data Staging, Data Exfiltration*** The threat actor again accessed Server 2 via RDP and continued issuing collection and data staging commands, identical to those observed the previous day. ### ***Day 5***** ** The Huntress team observed the threat actor accessing Server 3 via RDP, using previously observed credentials. This logon session was brief, approximately six minutes, with little activity observed via EDR telemetry. ### ***Day 6*** No activity was observed. ### ***Day 7 - File Encryption*** The seventh day began with the threat actor accessing Server 3 via RDP, installing the [Advanced IP Scanner](https://www.advanced-ip-scanner.com/), and shortly thereafter, moving laterally to Server 2 via RDP. During the logon session to Server 3, the threat actor was observed using Internet Explorer (`iexplore.exe`) to view folders on other systems, as well as using `mstsc.exe` to (attempt to) move laterally to other systems. The threat actor also installed [PuTTY](https://www.putty.org/). Approximately three hours after the initial logon to Server 3, the threat actor was observed running credential access commands on all three servers, all of which were indicative of the use of [lsassy.py](https://github.com/Hackndo/lsassy/blob/master/lsassy/dumpmethod/comsvcs.py). Approximately four hours after the initial logon to Server 3, the Huntress team observed the threat actor issuing a number of `copy` commands in rapid succession, indicative of a batch file or script, to push what was determined to be the file encryption executable to multiple endpoints within the infrastructure. These `copy` commands were followed in rapid succession by a similar series of `wmic.exe` commands to launch the file encryption executable on each of those endpoints. All of these commands were of the same format, illustrated by the following: `wmic  /node:"" /user:"" /password:"!Secure4u123!" process call create "cmd.exe /c copy \\\c$\windows\temp\.exe c:\windows\temp\"` The Huntress team also observed the use of [PSExec](https://learn.microsoft.com/en-us/sysinternals/downloads/psexec) to launch the file encryption executable, illustrated as follows: `psexec.exe  \\ -u -p "!Secure4u123!" -d -h -r winupd -s -accepteula -nobanner c:\windows\temp\.exe` Note that in the above command, the PSExec executable was renamed to `winupd` when launched on the remote node. This resulted in a System Event Log record on each endpoint where the command successfully launched the Windows service that appeared as follows: `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem` Finally, there were indications on Server 3 that the threat actor had difficulty running the file encryption executable, as there was no indication of encrypted files, nor ransom notes, on that server. The Huntress team observed multiple instances of the threat actor running `.exe –debug` commands, indicating the threat actor attempting to troubleshoot the file encryption executable. ## Conclusion ![INC03](https://www.huntress.com/hubfs/INC03.jpg)When a successful ransomware attack occurs, it is immediately impactful and disruptive to the impacted organization. However, there is often considerable activity that leads to deployment of the file encryption executable, such as initial access, credential access and privilege escalation, and enumeration and mapping of the infrastructure. Where data theft (staging and exfiltration) occurs, this can very often be seen well prior to the deployment of the file encryption executable.  While the Huntress team was unable to discern the threat actor’s means of initial access, the investigation clearly demonstrated considerable activity, across several key systems, over the course of a week.  ### Indicators - Ransomware Executable File Name: named for the impacted organization - Ransomware Executable SHA256 hash:  accd8bc0d0c2675c15c169688b882ded17e78aed0d914793098337afc57c289c - Ransomware Executable PDB string: C:\source\INC Encryptor\Release\INC Encryptor.pdb - Ransom Note file name: *.inc-readme.txt, *.inc-readme.html - Encrypted File Extension: *.inc - Use of compromised valid accounts - Use of native tools (net.exe, nltest.exe, Wordpad/Notepad/MSPaint, Internet Explorer, Windows Explorer, mstsc.exe, msdt.exe) - Use of additional tools (7-Zip, MEGASync, Advanced IP Scanner, Putty, lsassy.py, PSExec) ### **MITRE ATT&CK** - Initial Access - Valid Accounts/T1078.002 - Execution - Command and Scripting Interpreter/T1059.001, T1059.003; Windows Management Instrumentation/T1047 - Persistence - Valid Accounts/T1078.002 - Privilege Escalation - Valid Accounts/T1078.002 - Defense Evasion - Not Observed - Credential Access - OS Credential Dumping/T1003.001 - Discovery - Domain Trust Discovery/T1482 - Lateral Movement - Remote Services/T1021.001, T1021.002 - Collection - Archive Collected Data/T1560.001 - Command and Control - Not Observed - Exfiltration - Exfiltration Over Web Service/T1567.002 - Impact - Data Encrypted For Impact/T186 *Special thanks to Josh Allman (**[@xorJosh](https://twitter.com/xorJosh)**), Matt Anderson (*[@nosecurething](https://twitter.com/nosecurething)*), Harlan Carvey (*[@keydet89](https://twitter.com/keydet89)*), and Anthony Smith (*[@KingCrtz](https://twitter.com/KingCrtz)*) for their contributions to this blog post and investigation.* Want to dive into more threat actor tradecraft? Join us for Tradecraft Tuesday! [![Join us for Tradecraft Tuesday](https://no-cache.hubspot.com/cta/default/3911692/a24b26ba-2f4f-4a59-a723-dca189dbe0ee.png)](https://cta-redirect.hubspot.com/cta/redirect/3911692/a24b26ba-2f4f-4a59-a723-dca189dbe0ee) ![avatar](https://3911692.hs-sites.com/hs-fs/hubfs/Team-Huntress-Blog.png?width=290&height=290&name=Team-Huntress-Blog.png) #### [Team Huntress](https://3911692.hs-sites.com/blog/author/team-huntress) ## You May Also Like [ Matt Kiely 12.27.2023 15 min read ## Combating Emerging Microsoft 365 Tradecraft: Initial Access Threats evolve, and so does Huntress. Let’s talk about evolving our approach to hitting ... Start Reading ](https://3911692.hs-sites.com/blog/combating-emerging-microsoft-365-tradecraft-initial-access) [ Harlan Carvey 12.14.2023 4 min read ## Curling for Data: A Dive into a Threat Actor's Malicious TTPs Huntress analysts recently observed a novel set of tactics, techniques, and procedures ... Start Reading ](https://3911692.hs-sites.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps) [ Team Huntress 11.29.2023 5 min read ## MFT Exploitation and Adversary Operations Dive into our analysis of the CVE-2023-43117 threat in CrushFTP and the growing ... Start Reading ](https://3911692.hs-sites.com/blog/mft-exploitation-and-adversary-operations) [![Huntress](https://3911692.hs-sites.com/hubfs/Huntress-1.svg)](https://www.huntress.com) Deploy managed detection and response for endpoints and identities in minutes. [LinkedIn ](https://www.linkedin.com/company/huntress-labs/) [Twitter ](https://twitter.com/huntresslabs) [Facebook ](https://www.facebook.com/huntresslabs) [YouTube ](https://www.youtube.com/c/Huntress/featured) © 2026 Huntress - All rights reserved