Threats Tagged 'inc ransomware'

Huntress SOC analysts have uncovered sophisticated data exfiltration techniques employed by threat actors. The analysis reveals the use of various tools for data staging, including WinZip, 7Zip, and Windows' native tar.exe. Exfiltration methods observed include the use of finger.exe and backup utilities like restic, BackBlaze, and s5cmd. A specific incident on February 25, 2026, involved INC ransomware deployment, with the threat actor using PSEXEC for privilege escalation and creating a scheduled task to run a malicious PowerShell script. The actor utilized the Restic backup utility, renamed as winupdate.exe, to exfiltrate data. Similar tactics were observed in a previous incident on February 9, suggesting a pattern in the threat actor's methodology.

MediumMalwareUnited StatesCanadaUnited Kingdom+7#data exfiltration#restic#vipre

A new ransomware called Osiris was used in an attack on a major food service franchisee operator in Southeast Asia in November 2025. The ransomware shares similarities with previous Inc ransomware attacks, including the use of Wasabi buckets for data exfiltration and a specific version of Mimikatz. Osiris has typical ransomware functions, uses a hybrid encryption scheme, and drops a ransom note. The attack chain involved data exfiltration using Rclone, deployment of dual-use tools, and the use of a malicious driver called Abyssworker or Poortry. The attackers employed bring-your-own-vulnerable-driver (BYOVD) techniques to disable security software. While the impact of Osiris on the ransomware landscape remains uncertain, it appears to be wielded by experienced attackers with potential links to Inc ransomware or its affiliates.

MediumMalwareUnited KingdomGermanyFrance+4#abyssworker#osiris#inc ransomware