{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The encryption phase represents the point of maximum business impact; identifying the specific BYOVD tools and RAT precursors allows for rapid containment of the incident before the full impact of the second ransom wave." }, "name": "INC Ransomware Wave 2: BYOVD and RAT Deployment", "type": "investigation", "labels": [ "hunt", "attack.t1059.001", "attack.t1053.005", "attack.t1486", "attack.t1021.001" ], "series": { "slug": "the-tale-of-two-inc-ransom-notes-a-ransomware-timeline-huntress", "index": 2, "title": "The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress", "total": 2 }, "related": [ { "hunt": "inc-ransomware-wave-1-persistence", "reason": "Wave 1 focuses on initial access brokers and their use of nonsense-named scheduled tasks for persistence.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule might fire on a ransom note filename, but it provides no context on the evasion method used. This hunt pivots between process staging, kernel module prevalence, and impact files to reconstruct the attack timeline, allowing the analyst to verify if the defense-evasion (BYOVD) phase was successful before encryption occurred.", "coverage": [ { "stage": "remote-access-deployment", "steps": [ "staging-and-rat-scoping" ], "status": "covered" }, { "stage": "defense-evasion-byovd", "steps": [ "rare-modules-in-staging" ], "status": "covered" }, { "stage": "ransomware-encryption-impact", "steps": [ "inc-ransom-note-detection" ], "status": "covered" }, { "stage": "persistence-via-nonsense-scheduled-task", "reason": "Belongs to another part of the 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' series.", "status": "out_of_scope" }, { "stage": "obfuscated-powershell-c2", "reason": "Belongs to another part of the 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' series.", "status": "out_of_scope" }, { "stage": "rdp-lateral-movement", "reason": "Belongs to another part of the 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Persistence via Randomised Scheduled Task", "slug": "persistence-via-nonsense-scheduled-task", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "Nonweighise\\Cancellationizing\\Illuminateers", "nationhood kinestheticization preironish fictionallyes", "C:\\ProgramData\\Vendettister\\jocularities.ps1" ] }, { "name": "Obfuscated PowerShell C2", "slug": "obfuscated-powershell-c2", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "throughoutes.net", "jocularities.ps1", "heavily obfuscated PowerShell" ] }, { "name": "RDP Lateral Movement", "slug": "rdp-lateral-movement", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "Compromised user account moving between endpoints via RDP" ] }, { "name": "Remote Access Tool Deployment", "slug": "remote-access-deployment", "tactic": "command-and-control", "techniques": [ "T1059.001" ], "observables": [ "AnyDesk installation", "213.111.185.108" ] }, { "name": "Defense Evasion via BYOVD", "slug": "defense-evasion-byovd", "tactic": "defense-evasion", "techniques": [ "T1053.005" ], "observables": [ "hwau.exe", "HWAuidoOs2Ec.sys", "HwAudio kernel-driver service", "HealthUpdater.exe", "C:\\Program Files\\7-Zip\\HealthUpdater.exe", "netscan.exe", "atexec.py temporary scheduled tasks" ] }, { "name": "Ransomware Encryption and Impact", "slug": "ransomware-encryption-impact", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "INC-README.txt", "DATALEAK_PRESS_RELEASE.txt" ] } ], "summary": "An INC ransomware campaign featuring a 17-day lull between early persistence and final impact, likely indicating a hand-off from an access broker to an affiliate. The attackers utilized obfuscated PowerShell implants via scheduled tasks and RDP for movement, eventually deploying AnyDesk and a vulnerable driver (BYOVD) to disable security software before encrypting over 175 endpoints." }, "severity": "high", "rationale": "The hunt scopes hosts based on Remote Access Tool (RAT) names and common ransomware staging paths (Public, PerfLogs, ProgramData). This lead focuses on the second wave beachhead before pivoting to driver and encryption artifacts.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has deployed remote access tools and Bring Your Own Vulnerable Driver (BYOVD) loaders to neutralize security products before executing INC ransomware.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts to narrow the hunt; leave empty to run fleet-wide." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine; the reported 17-day lull may require extension for earlier persistence." }, "rat_process_names": { "from": { "ref": "huntress-inc-ransomware", "kind": "article", "observed": "2026-09-21" }, "type": "list[string]", "default": [ "anydesk.exe", "anydesk", "screenconnect.exe", "teamviewer.exe", "rustdesk.exe" ], "description": "Common Remote Access Tool (RAT) process names observed in the second wave." }, "byovd_module_names": { "from": { "ref": "huntress-inc-ransomware", "kind": "article", "observed": "2026-09-21" }, "type": "list[string]", "default": [ "hwauidoos2ec.sys", "hwau.exe", "healthupdater.exe", "netscan.exe" ], "description": "Filenames associated with the BYOVD loader and the vulnerable kernel driver." }, "ransom_note_filenames": { "from": { "ref": "huntress-inc-ransomware", "kind": "article", "observed": "2026-09-21" }, "type": "list[string]", "default": [ "inc-readme.txt", "dataleak_press_release.txt" ], "description": "Filenames of the INC ransomware notes used for impact confirmation." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/two-inc-ransom-notes", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/two-inc-ransom-notes", "name": "Huntress \u2014 The Tale of Two INC Ransom Notes: A Ransomware Timeline" } ], "blind_spots": [ { "id": "telemetry-rollover", "risk": "A 17-day lull between initial access and ransomware deployment may exceed default EDR retention periods on some endpoints.", "owner": "Security Engineering", "stage": "remote-access-deployment", "question": "whether AnyDesk was installed more than 14 days before the encryption wave", "requires": "extended hb_process_activity retention", "remediation": "Extend process and file event retention to at least 30 days." }, { "id": "missing-module-telemetry", "risk": "Hosts without Sysmon Event ID 7 or osquery kernel module auditing will not report the driver load, making the BYOVD phase invisible.", "owner": "IT Infrastructure", "stage": "defense-evasion-byovd", "question": "whether the BYOVD driver was successfully loaded into the kernel", "requires": "hb_module_activity", "remediation": "Deploy Sysmon with Event ID 7 enabled or enable osquery kernel_module tables." } ] }, "name": "INC Ransomware Wave 2: BYOVD and RAT Deployment", "description": "This hunt focuses on the second wave of activity observed in INC ransomware attacks, where threat actors move from initial persistence to active defense evasion and encryption. The hunt identifies the deployment of remote access tools like AnyDesk and suspicious staging in public folders, then corroborates this with the loading of rare kernel-level modules and the appearance of specific INC ransom notes. An agent weighs these findings per host to confirm the attack progression and prompt containment." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-tale-of-two-inc-ransom-notes-a-ransomware-timeline-huntress", "index": 2, "title": "The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress", "total": 2 }, "coverage": [ { "stage": "remote-access-deployment", "steps": [ "staging-and-rat-scoping" ], "status": "covered" }, { "stage": "defense-evasion-byovd", "steps": [ "rare-modules-in-staging" ], "status": "covered" }, { "stage": "ransomware-encryption-impact", "steps": [ "inc-ransom-note-detection" ], "status": "covered" }, { "stage": "persistence-via-nonsense-scheduled-task", "reason": "Belongs to another part of the 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' series.", "status": "out_of_scope" }, { "stage": "obfuscated-powershell-c2", "reason": "Belongs to another part of the 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' series.", "status": "out_of_scope" }, { "stage": "rdp-lateral-movement", "reason": "Belongs to another part of the 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' series.", "status": "out_of_scope" } ], "rationale": "An adversary has deployed remote access tools and Bring Your Own Vulnerable Driver (BYOVD) loaders to neutralize security products before executing INC ransomware.", "blind_spots": [ { "id": "telemetry-rollover", "risk": "A 17-day lull between initial access and ransomware deployment may exceed default EDR retention periods on some endpoints.", "owner": "Security Engineering", "stage": "remote-access-deployment", "question": "whether AnyDesk was installed more than 14 days before the encryption wave", "requires": "extended hb_process_activity retention", "remediation": "Extend process and file event retention to at least 30 days." }, { "id": "missing-module-telemetry", "risk": "Hosts without Sysmon Event ID 7 or osquery kernel module auditing will not report the driver load, making the BYOVD phase invisible.", "owner": "IT Infrastructure", "stage": "defense-evasion-byovd", "question": "whether the BYOVD driver was successfully loaded into the kernel", "requires": "hb_module_activity", "remediation": "Deploy Sysmon with Event ID 7 enabled or enable osquery kernel_module tables." } ], "scoping_notes": "The hunt scopes hosts based on Remote Access Tool (RAT) names and common ransomware staging paths (Public, PerfLogs, ProgramData). This lead focuses on the second wave beachhead before pivoting to driver and encryption artifacts.", "beyond_detection": "A single detection rule might fire on a ransom note filename, but it provides no context on the evasion method used. This hunt pivots between process staging, kernel module prevalence, and impact files to reconstruct the attack timeline, allowing the analyst to verify if the defense-evasion (BYOVD) phase was successful before encryption occurred." } }, { "id": "staging-and-rat-scoping", "type": "query", "label": "Lead Scoping: RATs and Staging Paths", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{rat_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\perflogs\\%' OR LOWER(process_path) LIKE '%\\programdata\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify potential beachhead hosts where remote access tools were installed or suspicious staging occurred.", "expected_signal": "Rows identify hosts with AnyDesk or binaries running from unusual paths. Silence proves absence only for these specific names and directories." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Lead Scoping: RATs and Staging Paths", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{rat_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\perflogs\\%' OR LOWER(process_path) LIKE '%\\programdata\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows identify hosts with AnyDesk or binaries running from unusual paths. Silence proves absence only for these specific names and directories.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "rare-modules-in-staging", "type": "query", "label": "Rare Modules and Driver Loading", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT module_name, module_path, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(module_path) LIKE '%\\users\\public\\%' OR instr(',' || '{{byovd_module_names}}' || ',', ',' || LOWER(module_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_name, module_path, process_name HAVING host_count <= 2", "surface": "hb_module_activity", "description": "Identify the loading of the vulnerable HwAudio driver or renamed tools by looking for rare modules in the estate.", "expected_signal": "A module seen on only one or two hosts, specifically the HwAudio driver or tools in public paths." }, "parents": [ { "id": "staging-and-rat-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Modules and Driver Loading", "reads": [ "module_name", "module_path", "process_name", "device_hostname", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT module_name, module_path, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(module_path) LIKE '%\\users\\public\\%' OR instr(',' || '{{byovd_module_names}}' || ',', ',' || LOWER(module_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_name, module_path, process_name HAVING host_count <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A module seen on only one or two hosts, specifically the HwAudio driver or tools in public paths.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "module_name", "module_path" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "inc-ransom-note-detection", "type": "query", "label": "INC Ransom Note Discovery", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Detect the final stage of the attack by identifying the creation of INC ransom notes on the endpoints.", "expected_signal": "Presence of INC-README.txt or DATALEAK_PRESS_RELEASE.txt files on any host." }, "parents": [ { "id": "staging-and-rat-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "INC Ransom Note Discovery", "reads": [ "device_hostname", "file_name", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Presence of INC-README.txt or DATALEAK_PRESS_RELEASE.txt files on any host.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "wave-2-triage", "type": "analytic", "label": "Wave 2 Attack Triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "staging-and-rat-scoping", "rare-modules-in-staging", "inc-ransom-note-detection" ], "objective": "Review the process staging, module loading, and file creation events to determine if a host is undergoing an active INC ransomware infection.", "description": "Analyze the chronological link between RAT deployment, defense evasion, and encryption.", "max_iterations": 4, "expected_signal": "A malicious verdict for hosts showing a sequence of AnyDesk installation, rare driver loading, and ransom note creation.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing the specific timestamps of RAT deployment and ransomware notes." }, "parents": [ { "id": "rare-modules-in-staging", "kind": "merge" }, { "id": "inc-ransom-note-detection", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route Based on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent determines at least one host is malicious due to a progression from AnyDesk to ransom notes", "condition": "the agent determines at least one host is malicious due to a progression from AnyDesk to ransom notes", "blind_spot": "missing-module-telemetry", "confidence": "high", "description": "Route malicious hosts to immediate isolation.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "wave-2-triage" } ] }, { "id": "isolate-infected-host", "type": "action", "label": "Isolate Endpoint", "config": { "target": "endpoint", "description": "Prevent further encryption or data exfiltration.", "instructions": "Isolate the host immediately. Do not reboot if encryption is in progress; preserve volatile memory for driver analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "forensic-task", "type": "task", "label": "Forensic Investigation", "config": { "assignee": "analyst", "description": "Verify the agent's findings and look for additional tools dropped via AnyDesk.", "instructions": "Review the cited rows for AnyDesk. Search specifically for the creation of temporary scheduled tasks (atexec) and the presence of netscan.exe. Collect the HWAuidoOs2Ec.sys file from C:\\Users\\Public if present." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-infected-host" } ] }, { "id": "remediation-task", "type": "task", "label": "Remediation and Closeout", "config": { "assignee": "analyst", "description": "Document findings and hand off for rule promotion.", "instructions": "Document the ransomware wave timeline. Promote the ransom note detection query to a standing rule and record any new malicious C2 IPs found in AnyDesk logs." }, "parents": [ { "id": "forensic-task" } ] } ] }