--- analysis: A single detection rule might fire on a ransom note filename, but it provides no context on the evasion method used. This hunt pivots between process staging, kernel module prevalence, and impact files to reconstruct the attack timeline, allowing the analyst to verify if the defense-evasion (BYOVD) phase was successful before encryption occurred. blind_spots: - id: telemetry-rollover owner: Security Engineering question: whether AnyDesk was installed more than 14 days before the encryption wave remediation: Extend process and file event retention to at least 30 days. requires: extended hb_process_activity retention risk: A 17-day lull between initial access and ransomware deployment may exceed default EDR retention periods on some endpoints. stage: remote-access-deployment - id: missing-module-telemetry owner: IT Infrastructure question: whether the BYOVD driver was successfully loaded into the kernel remediation: Deploy Sysmon with Event ID 7 enabled or enable osquery kernel_module tables. requires: hb_module_activity risk: Hosts without Sysmon Event ID 7 or osquery kernel module auditing will not report the driver load, making the BYOVD phase invisible. stage: defense-evasion-byovd coverage: - stage: remote-access-deployment status: covered steps: - staging-and-rat-scoping - stage: defense-evasion-byovd status: covered steps: - rare-modules-in-staging - stage: ransomware-encryption-impact status: covered steps: - inc-ransom-note-detection - reason: 'Belongs to another part of the ''The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress'' series.' stage: persistence-via-nonsense-scheduled-task status: out_of_scope - reason: 'Belongs to another part of the ''The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress'' series.' stage: obfuscated-powershell-c2 status: out_of_scope - reason: 'Belongs to another part of the ''The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress'' series.' stage: rdp-lateral-movement status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: The encryption phase represents the point of maximum business impact; identifying the specific BYOVD tools and RAT precursors allows for rapid containment of the incident before the full impact of the second ransom wave. methodology: model-assisted trigger: intel-report hypothesis: An adversary has deployed remote access tools and Bring Your Own Vulnerable Driver (BYOVD) loaders to neutralize security products before executing INC ransomware. labels: - hunt - attack.t1059.001 - attack.t1053.005 - attack.t1486 - attack.t1021.001 name: 'INC Ransomware Wave 2: BYOVD and RAT Deployment' parameters: byovd_module_names: default: - hwauidoos2ec.sys - hwau.exe - healthupdater.exe - netscan.exe description: Filenames associated with the BYOVD loader and the vulnerable kernel driver. from: kind: article observed: '2026-09-21' ref: huntress-inc-ransomware type: list[string] lookback_days: default: '14' description: Days of history to examine; the reported 17-day lull may require extension for earlier persistence. type: number ransom_note_filenames: default: - inc-readme.txt - dataleak_press_release.txt description: Filenames of the INC ransomware notes used for impact confirmation. from: kind: article observed: '2026-09-21' ref: huntress-inc-ransomware type: list[string] rat_process_names: default: - anydesk.exe - anydesk - screenconnect.exe - teamviewer.exe - rustdesk.exe description: Common Remote Access Tool (RAT) process names observed in the second wave. from: kind: article observed: '2026-09-21' ref: huntress-inc-ransomware type: list[string] scope_hosts: default: [] description: Optional list of hosts to narrow the hunt; leave empty to run fleet-wide. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/two-inc-ransom-notes gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: The hunt scopes hosts based on Remote Access Tool (RAT) names and common ransomware staging paths (Public, PerfLogs, ProgramData). This lead focuses on the second wave beachhead before pivoting to driver and encryption artifacts. references: - name: "Huntress \u2014 The Tale of Two INC Ransom Notes: A Ransomware Timeline" url: https://www.huntress.com/blog/two-inc-ransom-notes related: - hunt: inc-ransomware-wave-1-persistence reason: Wave 1 focuses on initial access brokers and their use of nonsense-named scheduled tasks for persistence. relation: out-of-scope-alternative scenario: stages: - name: Persistence via Randomised Scheduled Task observables: - Nonweighise\Cancellationizing\Illuminateers - nationhood kinestheticization preironish fictionallyes - C:\ProgramData\Vendettister\jocularities.ps1 slug: persistence-via-nonsense-scheduled-task tactic: persistence techniques: - T1053.005 - name: Obfuscated PowerShell C2 observables: - throughoutes.net - jocularities.ps1 - heavily obfuscated PowerShell slug: obfuscated-powershell-c2 tactic: execution techniques: - T1059.001 - name: RDP Lateral Movement observables: - Compromised user account moving between endpoints via RDP slug: rdp-lateral-movement tactic: lateral-movement techniques: - T1021.001 - name: Remote Access Tool Deployment observables: - AnyDesk installation - 213.111.185.108 slug: remote-access-deployment tactic: command-and-control techniques: - T1059.001 - name: Defense Evasion via BYOVD observables: - hwau.exe - HWAuidoOs2Ec.sys - HwAudio kernel-driver service - HealthUpdater.exe - C:\Program Files\7-Zip\HealthUpdater.exe - netscan.exe - atexec.py temporary scheduled tasks slug: defense-evasion-byovd tactic: defense-evasion techniques: - T1053.005 - name: Ransomware Encryption and Impact observables: - INC-README.txt - DATALEAK_PRESS_RELEASE.txt slug: ransomware-encryption-impact tactic: impact techniques: - T1486 summary: An INC ransomware campaign featuring a 17-day lull between early persistence and final impact, likely indicating a hand-off from an access broker to an affiliate. The attackers utilized obfuscated PowerShell implants via scheduled tasks and RDP for movement, eventually deploying AnyDesk and a vulnerable driver (BYOVD) to disable security software before encrypting over 175 endpoints. series: index: 2 slug: the-tale-of-two-inc-ransom-notes-a-ransomware-timeline-huntress title: 'The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # INC Ransomware Wave 2: BYOVD and RAT Deployment This hunt focuses on the second wave of activity observed in INC ransomware attacks, where threat actors move from initial persistence to active defense evasion and encryption. The hunt identifies the deployment of remote access tools like AnyDesk and suspicious staging in public folders, then corroborates this with the loading of rare kernel-level modules and the appearance of specific INC ransom notes. An agent weighs these findings per host to confirm the attack progression and prompt containment. ## staging-and-rat-scoping Identify potential beachhead hosts where remote access tools were installed or suspicious staging occurred. ```sqlite target=endpoint role=scoping params=(rat_process_names=rat_process_names, lookback_days=lookback_days) ~~~yaml expected: Rows identify hosts with AnyDesk or binaries running from unusual paths. Silence proves absence only for these specific names and directories. reads: - device_hostname - process_name - process_path - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{rat_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%\users\public\%' OR LOWER(process_path) LIKE '%\perflogs\%' OR LOWER(process_path) LIKE '%\programdata\%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## corroborate-wave-artifacts parallel: - → rare-modules-in-staging - → inc-ransom-note-detection join: → wave-2-triage ## rare-modules-in-staging Identify the loading of the vulnerable HwAudio driver or renamed tools by looking for rare modules in the estate. ```sqlite target=endpoint role=baseline params=(scope_hosts=scope_hosts, byovd_module_names=byovd_module_names, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A module seen on only one or two hosts, specifically the HwAudio driver or tools in public paths. prevalence: by: device_hostname key: - module_name - module_path rare_below: 3 reads: - module_name - module_path - process_name - device_hostname - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT module_name, module_path, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(module_path) LIKE '%\users\public\%' OR instr(',' || '{{byovd_module_names}}' || ',', ',' || LOWER(module_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_name, module_path, process_name HAVING host_count <= 2 ``` ## inc-ransom-note-detection Detect the final stage of the attack by identifying the creation of INC ransom notes on the endpoints. ```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, ransom_note_filenames=ransom_note_filenames, lookback_days=lookback_days) ~~~yaml expected: Presence of INC-README.txt or DATALEAK_PRESS_RELEASE.txt files on any host. reads: - device_hostname - file_name - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') ``` ## wave-2-triage ```agent target=hunter cite: required context: - staging-and-rat-scoping - rare-modules-in-staging - inc-ransom-note-detection max_iterations: 4 objective: Review the process staging, module loading, and file creation events to determine if a host is undergoing an active INC ransomware infection. success_criteria: A per-host verdict of malicious | suspicious | benign, citing the specific timestamps of RAT deployment and ransomware notes. tools: - endpoint ``` ## route-on-verdict if~: "the agent determines at least one host is malicious due to a progression from AnyDesk to ransom notes" (confidence: high, judge=hunter) then: → isolate-infected-host indeterminate: → forensic-task unavailable: → forensic-task (blind_spot: missing-module-telemetry) else: → forensic-task ## isolate-infected-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Do not reboot if encryption is in progress; preserve volatile memory for driver analysis. ``` → forensic-task ## forensic-task ```manual target=analyst Review the cited rows for AnyDesk. Search specifically for the creation of temporary scheduled tasks (atexec) and the presence of netscan.exe. Collect the HWAuidoOs2Ec.sys file from C:\Users\Public if present. ``` → remediation-task ## remediation-task ```manual target=analyst Document the ransomware wave timeline. Promote the ransom note detection query to a standing rule and record any new malicious C2 IPs found in AnyDesk logs. ``` → end