The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress

What it is

The INC ransomware intrusion Huntress reconstructed (details in the catalog summary) carries a concrete set of host- and network-level indicators the summary doesn't list. This document exists to surface those artifacts for hunting, plus one detail the summary omits: a renamed legitimate vulnerability-remediation tool used as attacker tooling.

Indicators

Network:

• AnyDesk C2 IP: 213.111.185[.]108
• Obfuscated PowerShell implant beacon domain: throughoutes[.]net

Host / persistence:

• PowerShell implant: C:\ProgramData\Vendettister\jocularities.ps1 (heavily obfuscated)
• Example scheduled task with randomized name: Nonweighise\Cancellationizing\Illuminateers, description "nationhood kinestheticization preironish fictionallyes" — the campaign used multiple such random-named tasks for persistence and, later, for atexec.py execution
• BYOVD dropper: hwau.exe in C:\Users\Public (on a domain controller)
• Vulnerable kernel driver / service: HWAuidoOs2Ec.sys in C:\Users\Public, loaded as service HwAudio
• Recon tool netscan.exe deployed via the AnyDesk instance alongside the BYOVD

The renamed vRx binary (not in the summary)

On one endpoint a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe — a renamed vRx executable from Vicarius Inc., a legitimate remediation platform. Two tells: it sat in an unusual folder (under 7-Zip) and was renamed, though its embedded file-version metadata did not carry the original filename. Worth noting because the file-version string won't betray it — detection has to key on path/hash, not internal name.

What to do

The page's stated hardening measures:

• Limit and monitor remote access; enforce MFA; restrict privileged accounts to only the systems they need.
• Monitor for unusual scheduled tasks, unexpected remote-management tools (AnyDesk here), and new or unsigned driver services — the HwAudio service load is the pivot point where security controls get disabled.
• Maintain tested offline backups and an IR plan with rapid isolation, to contain before lateral movement and exfiltration complete.

Caveats

This is a post-incident reconstruction from surviving EDR telemetry and Windows Event Logs; logs had "rolled over," so the initial access vector was never determined. The two-actor / IAB hypothesis rests on the 17-day gap and the shift in tooling, not on direct attribution evidence. The random task names shown are per-incident and unlikely to recur verbatim — hunt on the pattern (random-named tasks pointing to ProgramData scripts), not the literal strings.