The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
ID: 00a1767b-8cfc-5ba8-afa7-7980a34a62da
STIX ID: report--00a1767b-8cfc-5ba8-afa7-7980a34a62da
Feed Name: Huntress Blog
Threat Score
Huntress investigated an INC ransomware incident where attackers gained access to an environment, used scheduled tasks and RDP for lateral movement, and later deployed AnyDesk, a BYOVD EDR/AV-killer driver, and INC ransomware; investigators recovered two ransom notes (one detailing alleged stolen files) and multiple IoCs (domains, IPs, file paths, and service/driver names) while noting evidence gaps due to log rollover and post-incident onboarding.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.