In late August, an organization was compromised by INC ransomware affecting at least 175 endpoints. The attack unfolded over several weeks with a 17-day gap, indicating involvement of an initial access broker and a separate ransomware affiliate. Early activity included scheduled tasks with randomized names and lateral movement via RDP using compromised credentials. After the pause, attackers deployed AnyDesk for remote access, used Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security controls, and executed ransomware using Impacket tools. Two ransom notes were found: the standard ransom demand and a secondary data leak threat note listing stolen files and threatening to contact media, employees, and partners within 48 hours to pressure the victim.