The INC ransomware attack involved a multi-stage intrusion over several weeks, starting with initial access broker activity characterized by scheduled tasks and lateral movement via RDP. After a 17-day gap, a ransomware affiliate resumed operations deploying AnyDesk for remote control, disabling security mechanisms through BYOVD tactics, and executing ransomware payloads via Impacket tools. The attack uniquely featured two ransom notes: the typical ransom demand and a secondary data leak threat note listing stolen files and threatening public exposure to coerce payment.

The attack compromised at least 175 endpoints within the targeted organization, resulting in ransomware encryption and data theft. The presence of a secondary ransom note threatening data leakage indicates a double extortion tactic, increasing the risk of reputational damage and operational disruption. The use of BYOVD to disable security controls and remote access tools facilitated extensive lateral movement and persistence.

No official patch or fix applies as this is a ransomware incident. Organizations should focus on detection and prevention of initial access broker activity, monitor for suspicious scheduled tasks and RDP usage, and be aware of BYOVD techniques. Implementing strong access controls, network segmentation, and endpoint detection for remote access tools like AnyDesk can help mitigate similar attacks. Incident response should include containment, eradication, and recovery procedures tailored to ransomware and data leak threats.