INC ransomware opsec fail allowed data recovery for 12 US orgs

Cyber Centaurs' forensic investigation into the INC ransomware operation uncovered attacker-controlled Restic backup repositories that retained encrypted exfiltrated data from 12 unrelated U.S. organizations; artifacts including renamed binaries, PowerShell scripts with hardcoded credentials, and other tooling were recovered and used to decrypt and preserve victim data, and the researchers produced YARA/Sigma rules to help detect related activity.