A rare operational security (OpSec) failure by the INC ransomware gang allowed researchers to recover data stolen from 12 U.S. organizations, marking a significant win for defenders in the ongoing ransomware battle.
What Happened
- Incident origin: A U.S. client detected RainINC ransomware activity on a production SQL Server.
- Artifacts found:
- Payload executed from the PerfLogs directory (commonly abused for staging).
- Renamed binaries (e.g.,
winupdate.exe). - PowerShell scripts (
new.ps1) with Base64-encoded Restic commands. - Hardcoded repository variables (access keys, S3 passwords, paths).
- Restic backup tool: Though not used in the specific attack, remnants revealed attacker infrastructure.
- Key discovery: INC reused Restic-based repositories across campaigns, leaving long-lived storage assets online.
The Breakthrough
- Researchers at Cyber Centaurs shifted focus from incident response to infrastructure analysis.
- Enumeration confirmed encrypted victim data from 12 unrelated U.S. organizations (healthcare, manufacturing, technology, services).
- Data was decrypted and preserved, with law enforcement engaged to validate ownership.
- This recovery was possible because INC failed to dismantle or secure its backup repositories after ransom events.
Tools & Tactics Observed
- Dual-use & attacker tools:
- Restic (backup/exfiltration).
- Cleanup utilities.
- Remote access software.
- Network scanners.
- Detection rules: Cyber Centaurs created YARA and Sigma rules to spot Restic or renamed binaries in suspicious locations.
Context – INC Ransomware
- Type: Ransomware-as-a-Service (RaaS), active since mid-2023.
- High-profile victims: Yamaha Motor, Xerox Business Solutions, Scotland’s NHS, McLaren Health Care, Texas State Bar, Ahold Delhaize, Panama Ministry of Economy, Pennsylvania AG Office, Crisis24.
- Tactics: Data exfiltration + encryption, leveraging dual-use tools and staging directories.
Defensive Recommendations
- Monitor for Restic usage: Especially renamed binaries or execution from unusual directories.
- Apply YARA/Sigma rules shared by Cyber Centaurs.
- Audit staging directories (PerfLogs): Look for ransomware payloads.
- Incident response: Treat backup tool artifacts as potential indicators of exfiltration infrastructure.
- Law enforcement coordination: If suspicious repositories are found, involve authorities for data recovery.
Takeaway
INC’s failure to secure its exfiltration infrastructure gave defenders a rare chance to recover stolen data. This case highlights the importance of forensic infrastructure analysis—sometimes the key to remediation lies not in the victim’s environment, but in the attacker’s own sloppy operational practices.
Leave a Reply