Skip to content

Back to the catalog

Data Exfiltration and Threat Actor Infrastructure Exposed
huntress.comwriteup

Data Exfiltration and Threat Actor Infrastructure Exposed

Huntress SOC details two related incidents where threat actors used PsExec for privilege escalation, a scheduled task ("Recovery Diagnostics") to run base64-encoded PowerShell that configured a renamed copy of restic (winupdate.exe) pointed at a Wasabi S3 bucket, then disabled/removed VIPRE Business Agent and Windows Defender before deploying INC ransomware. A second, near-identical prior incident on 9 February reused the same AWS access keys and used HRSword to disable Acronis security tooling, and the same TTPs were independently documented by the Cyber Centaurs team on 22 January 2026. The post highlights detection gaps (incomplete agent deployment, no SIEM) and notes RestartManager API telemetry (also seen with Akira) as a ransomware-encryption indicator.

TL;DR Huntress DFIR writeup on an INC ransomware intrusion using PsExec, scheduled-task persistence, a renamed restic binary for S3 exfiltration, and AV/EDR tampering before encryption.
Open original ↗
Document

What it is

A Huntress SOC writeup of two INC ransomware intrusions (25 February 2026 and a near-twin on 9 February 2026) that reuse the same AWS access keys and the same Wasabi S3 repository pattern for data exfiltration via restic. The value here over the summary is the concrete hunt material: exact command lines, file paths, and Windows Event Log signatures a defender can pivot on.

How it works

On 24 February the actor mapped a share as F:\, ran PsExec to elevate, then created a scheduled task Recovery Diagnostics pointing at new.ps1:

"C:\Windows\system32\schtasks.exe" /create /sc once /tn "Recovery Diagnostics" /tr "powershell.exe -file C:\Users\Public\Documents\new.ps1" /st 02:30 /ru system

Base64-encoded PowerShell then set restic environment variables and ran winupdate.exe (a renamed restic.exe) from C:\windows\system32\. Notable specifics: RESTIC_PASSWORD is literally 'password', and the redacted RESTIC_REPOSITORY portion is the victim's environment/domain name. Exfil used --files-from C:\Users\Public\Documents\new.txt, implying prior recon to build that file list.

Then on 25 February: C:\123\edr.exe ran, VIPRE was removed via VIPRE Business AgentAgentUninstallPassword.exe, Defender real-time protection was snoozed, and INC was launched:

c:\perflogs\win.exe --sup --hide --mode medium

Preconditions / Affected

The intrusion escalated undetected because the Huntress agent was not fully deployed and the customer ran no SIEM — which is also why the initial access vector was never determined. The technique needs local admin (obtained via PsExec) and outbound access to s3.wasabisys.com.

What to do

Hunt for these specific artifacts named in the post:

  • Scheduled task Recovery Diagnostics; scripts/lists under C:\Users\Public\Documents\ (new.ps1, new.txt).
  • winupdate.exe anywhere, especially in system32 (renamed restic); outbound connections to s3.wasabisys.com.
  • Base64 PowerShell in PowerShell Event Log event ID 600 — but see caveat.
  • Security-product-off events:
  • SecurityCenter/15;VIPRE Business Agent,SECURITY_PRODUCT_STATE_OFF
  • Microsoft-Windows-Windows Defender/5001;Microsoft Defender Antivirus
  • SecurityCenter/15;Windows Defender,SECURITY_PRODUCT_STATE_SNOOZED
  • INC ransom notes INC-README.txt; a spike of Microsoft-Windows-RestartManager/10000 (also seen with Akira).

Beyond restic, the post flags finger.exe, BackBlaze, and s5cmd as exfil vectors, and WinZip/7Zip/tar.exe for staging.

Caveats

Event ID 600 base64 PowerShell is not on its own a reliable signal — legitimate RMM and security tools produce the same records. Analysts never recovered new.txt (contents inferred, not confirmed) and could not establish initial access because visibility was incomplete.

Organisations named here

  • Cyber Centaurs

Technologies named here

  • WinZip
  • Windows PowerShell Event Log
  • 7-Zip
  • Windows Event Log
  • tar.exe
  • VIPRE Business Agent
  • Microsoft Defender Antivirus
  • finger.exe
  • Acronis Management Agent Core Service
  • restic
  • BackBlaze
  • Acronis Active Protection Service
  • s5cmd
  • PsExec
  • schtasks.exe
  • PowerShell
  • Huntress agent
  • SIEM
  • HRSword
  • AgentAgentUninstallPassword.exe
  • Windows
  • Windows Defender
  • VIPRE
  • Wasabi

Techniques named here

  • Data staging via archiving utilities
  • Data exfiltration via native/backup utilities
  • Share mapping
  • Privilege escalation via PSEXEC
  • Scheduled task creation for persistence/execution
  • Base64-encoded PowerShell command execution
  • Binary renaming/masquerading
  • Security tool uninstallation/tampering
  • Disabling Windows Defender Real-Time Protection
  • Ransomware deployment
  • Use of RestartManager API for file encryption
  • Security tooling disablement via third-party utility

Threat actors named here

  • INC ransomware
  • Akira

Related in Blue Team & Detection