Security 1 publisher2 min readPublished September 22, 2026 at 1:02 AM PDT

Huntress rebuilt a 175-endpoint INC ransomware case from scheduled tasks and a driver fragment

Huntress reconstructed an INC intrusion from the logs that had survived. The tradecraft it found was ordinary operator work, the kind a name-based indicator list misses, and how the attackers first got in is still an open question.

The Watch · Security desk

Photograph accompanying Huntress rebuilt a 175-endpoint INC ransomware case from scheduled tasks and a driver fragment — Photo: huntress.com

What happened

Huntress was brought in during August after INC ransomware had already run, with at least 175 endpoints impacted and attacker traces sitting on the organization's domain controllers.
The observed activity ran from early to late August with a 17-day lull in the middle, which Huntress says may mean an initial access broker handed off to a ransomware affiliate.
Two weeks into the intrusion the attackers installed AnyDesk and used it to deploy netscan.exe, a vulnerable driver and various other tools.
Two notes turned up: INC-README.txt, then DATALEAK_PRESS_RELEASE.txt about 53 minutes later, giving 48 hours before the group said it would start notifying media, employees, partners and clients.
Logs on many endpoints had rolled over during continued normal use, and Huntress ended the case without an initial access vector.

Compiled by The WatchSomething wrong?How this is made

Why it matters

constraint Randomized task names take name matching off the table for this case, so the money that closes the gap buys a rule that fires on task creation and driver loads on a domain controller.
exposure If the second note's file listing is accurate, the victim's notification scope is set by the documents the attackers read and described, which is a wider set than whatever encryption touched.
decision Organizations that deploy EDR after the fact inherit the blind spot Huntress worked in: the detections that would have fired during the attack were never recorded, and log retention decides what can be proven.
precedent A quiet fortnight in the middle of an intrusion can sit between the first foothold and the encryption wave, so hunts have to reach back weeks past the last alert to find the tasks that were planted first.

The fragments that outlasted the incident on the domain controller were a BYOVD tool and several scheduled tasks with randomized names ^[3]. Randomized names defeat list matching, so the detectable event is a scheduled task being created on a domain controller. The driver goes unnamed in the Huntress blog, and the event to write the rule against is a third-party driver loading on the machine that holds the domain. On a domain controller the baseline volume of both events is low enough to make the rule affordable. The early-August activity also left observable traces of lateral movement ^[14].

The first note kept to the usual template, threatening publication of the victim's data if it did not pay ^[6]. "We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data," the attackers wrote ^[7].

Most of the second note was an inventory: the file paths searched, the files taken, and descriptions of what was in them ^[10]. Multiple copies were dropped, all identical by file hash ^[9]. Huntress says the inventory indicates dwell time, saying that if the descriptions are accurate, the attacker had considerable time to find and retrieve the data and to build a detailed understanding of what it had stolen ^[11].

The interval between the two waves appears twice in the account, once as a 17-day lull and once as a second wave "two weeks later", and the blog leaves the three days between the two figures unexplained ^[17]. That interval matters, because Huntress rests the suggestion of separate actors on the timing and on the differences in activity between early and late August ^[19].

An indicator list assembled from this case would hold AnyDesk, netscan.exe, two file names and one driver ^[15]^[6]^[8]. The artifact with a confirmed hash match is the second ransom note, and the notes were dropped at the end of the second wave ^[18].

What to watch

Whether Huntress names the vulnerable driver or publishes the task-creation and driver-load detections from this case.
Whether the victim's data shows up on INC's leak site, the test of the second note's itemized file claims.
Whether other INC cases show the same multi-week pause between a quiet first wave and the affiliate's tooling.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
In August, Huntress onboarded an organization post-incident, following the successful deployment of INC ransomware.
ReportedSupportedView cited source
[2]
The victim organization was impacted across at least 175 endpoints, and traces of the attackers' activity were found on its domain controllers.
ReportedSupportedView cited source
[3]
Huntress recovered fragments of a BYOVD tool on a domain controller and several scheduled tasks with randomized names.
ReportedSupportedView cited source
[4]
The observed activity spanned early to late August with a 17-day lull in the middle.
ReportedSupportedView cited source
[6]
The initial ransom note, INC-README.txt, threatened to publish the victim organization's data if it did not pay.
ReportedSupportedView cited source
[7]
"We are not a politically motivated group and we want nothing more than money. If you pay, we will provide you with decryption software and destroy the stolen data."
ReportedSupportedSource: excerpt from the first ransom note, quoted by HuntressView cited source
[8]
A second ransom note, DATALEAK_PRESS_RELEASE.txt, was dropped about 53 minutes later; it threatened to publish a press release about the victim if the attackers did not hear from them within 48 hours, and warned they would start notifying media, employees, partners and clients.
ReportedSupportedView cited source
[9]
Multiple copies of the second ransom note were found, and all were identical based on file hashes.
ReportedSupportedView cited source
[10]
The rest of the second ransom note contained a detailed listing of file paths searched and files stolen, with detailed descriptions of their content.
ReportedSupportedView cited source
[12]
Data on various endpoints had faded as logs rolled over while the endpoints continued in normal operational use, and Huntress was not able to uncover the initial access vector used in the attack.
ReportedSupportedView cited source
[13]
Because the investigation was post-incident, EDR telemetry from during the attack was not available, and portions of the environment were already impacted before the investigation started.
ReportedSupportedView cited source
[14]
Malicious activity was tracked back to at least early August and included the creation of various scheduled tasks and observable traces of lateral movement.
ReportedSupportedView cited source
[15]
A second wave of activity two weeks later saw AnyDesk installed as a way to deploy netscan.exe, a vulnerable driver, and various tools.
ReportedSupportedView cited source
[16]
Shortly after the second wave tooling, INC ransom notes were dropped on the organization's domain controller.
ReportedSupportedView cited source
[17]
The account describes the same interval between waves as both a 17-day lull and a second wave "two weeks later", a three-day difference.
DerivedSupported1 source— sign in to open
[18]
The artifact reported with a confirmed hash match is the second ransom note, and the notes were dropped at the end of the second wave, so a hash-based rule for this case fires only after the tooling wave has run.
DerivedSupported1 source— sign in to open
[5]
Huntress says the lull raises the possibility that the activity was the result of different threat actors or groups, one possibly an initial access broker and the other clearly a ransomware affiliate.
ReportedInsufficientSource: HuntressView cited source
[11]
Huntress says that if the second note's statements about file content are true, the threat actor likely had considerable time to find and retrieve the data and to develop a fairly comprehensive and detailed understanding of what it stole.
ReportedInsufficientSource: HuntressView cited source
[19]
Huntress says that given the timing and the differences in activity between what occurred earlier in the month and later in the month, it is possible the activity was the result of separate actors.
ReportedInsufficientSource: HuntressView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

huntress.com
1 article · September 21, 2026
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The artifacts Huntress names are the interesting part for anyone writing rules. Persistence came from a scheduled task called Nonweighise\Cancellationizing\Illuminateers, with the description "nationhood kinestheticization preironish fictionallyes", pointing at an obfuscated PowerShell script at C:\ProgramData\Vendettister\jocularities.ps1 that talked to throughoutes[.]net. All of that is generated per victim, so an indicator list built from names would have matched none of it. The one artifact Huntress confirms by hash is the second ransom note, and the notes landed after AnyDesk, netscan.exe and a vulnerable driver were already on the machines. A rule keyed to that hash would have fired once the tooling wave was over.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence62

0100

Primary forensics, degraded logs

Huntress had hands on the environment, the strongest kind of access for this sort of story, and it had that access too late. The post names specific things: a scheduled task, an obfuscated PowerShell implant, the domain throughoutes[.]net, AnyDesk, netscan.exe, a hash match across copies of the second note. Against that, the first access route is unknown, exfiltration rests on the attackers' own inventory, and the same post gives two different lengths for the gap between waves.

Adoption28

0100

One documented engagement

What is actually measured is one victim: at least 175 endpoints, notes on the domain controller, tooling that is unremarkable and in live use. Huntress does not say how often it sees this pattern across its customer base, so there is no basis for reading prevalence out of one case.

Hype gap

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
Settra ransomware operators ran two intrusions through the open-source MeshAgent RMM
2 publishers
security
Akira Reboots Into Safe Mode to Blind EDR, and Starves Its Own Encryptor
3 publishers
security
Manufacturing ransomware victims rose 40% in seven months as European counts grew 85%
2 publishers
product
Berlin published the staffing plan for refusing a ransom
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources