INC Ransomware affiliate targets ESXi & NAS Devices in AD environment

Researchers exposed an INC Ransom affiliate's operator working directory that documents a sophisticated intrusion against a Chinese technology company combining compromised Microsoft 365 and VPN credentials, WinRM-driven Active Directory compromise, vCenter/ESXi and storage management-plane attacks, exfiltration of NTDS/registry hives, and deployment of a multi-platform INC encryptor to map and encrypt NAS shares; the collection includes scripts, tooling, IOCs (IP 213.176.114.6, domain names, file hashes), and evidence the affiliate leveraged LLM-generated code to operationalize the attack.