LOLBin to INC Ransomware | Huntress

Huntress analysts observed an INC ransomware operation where attackers—demonstrating prior knowledge of target environments—used native Windows utilities and custom binaries to disable endpoint defenses, collect and exfiltrate data (rclone, MEGAsync), and stage file encryption; the report provides IOCs, ATT&CK mappings, and detection recommendations to help defenders identify and respond before encryption occurs.