THE TALE OF TWO INC RANSOM NOTES

Summary from the TLDR InfoSec newsletter

An INC ransomware intrusion across 175+ endpoints started in early August with randomly named scheduled tasks launching an obfuscated PowerShell implant and RDP lateral movement. After 17 quiet days, AnyDesk delivered netscan.exe and a BYOVD EDR killer (hwau.exe loading the HwAudio driver), and Impacket's atexec.py deployed the payload. Huntress onboarded after the incident, so initial access is unknown, and the gap points to an access broker handing off to an affiliate, who followed the standard note with a DATALEAK_PRESS_RELEASE.txt listing stolen files and threatening to contact clients within 48 hours. Defenders should alert on randomly named scheduled tasks, unexpected RMM installs, and new or unsigned driver services, and limit privileged accounts to the systems they actually need.