INC Ransomware Explained: Tactics, Targets, and Impact

Summary

INC Ransom is a multi-extortion ransomware group active since July 2023. The operators rely heavily on living-off-the-land techniques, abusing legitimate administrative tools to perform reconnaissance, move laterally, and bypass security controls. Their campaigns target high-value industries, including healthcare, industrial organizations, and education, to increase operational disruption and extortion pressure.

Investigation

The report examines the complete INC Ransom attack chain, from initial access through exploited vulnerabilities or compromised accounts to final data encryption. It highlights the group’s use of dual-purpose tools such as AnyDesk and NETSCAN for discovery and lateral movement, along with the exploitation of Citrix vulnerabilities. The analysis also documents techniques used to disable EDR solutions and interfere with Windows Defender.

Mitigation

Defenders should promptly patch internet-facing vulnerabilities, particularly those affecting Citrix NetScaler, including CVE-2023-3519 and Citrix Bleed, tracked as CVE-2023-4966. Organizations should enforce strict controls over legitimate administrative tools and monitor suspicious use of SystemSettingsAdminFlows.exe and PsExec. Security teams should also test their defenses with ransomware simulation platforms to verify that EDR and antivirus controls remain effective.

Response

If INC Ransom activity is detected, affected systems should be isolated immediately to limit lateral movement and prevent additional encryption. Responders should review RDP and administrative tool logs for unauthorized access and unusual command-line arguments. Suspicious processes such as av.exe or renamed PsExec instances should be identified and terminated to restore endpoint monitoring and security visibility.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access to a workstation and is now performing rapid reconnaissance to identify the domain structure and high-privileged accounts. To avoid detection by simple signature-based tools, they often use common administrative tools but with specific, automated flags. The simulation will execute net group domain admins /domain to identify targets for lateral movement and nltest /dclist: to locate domain controllers. We will also simulate the use of adfind to query the directory, using the exact syntax expected by the detection rule to confirm its efficacy.

• Regression Test Script:

    # Simulation Script for INC Ransomware Reconnaissance Detection
    # This script executes commands specifically designed to trigger the detection rule.
  
    Write-Host "[*] Starting INC Ransomware Reconnaissance Simulation..." -ForegroundColor Cyan
  
    # 1. Domain Admin Enumeration (T1069.002)
    Write-Host "[+] Executing Domain Admin enumeration..."
    net group domain admins /domain
  
    # 2. Domain Controller Discovery (T1016)
    Write-Host "[+] Executing DC list discovery..."
    nltest /dclist:
  
    # 3. AD Enumeration via AdFind (T1087.002)
    # Note: This requires adfind.exe to be present in the path or current directory.
    # For simulation purposes, we assume the binary is present.
    Write-Host "[+] Executing AdFind enumeration..."
    .adfind.exe -b dc=exampleDomain,dc=net -f "objectcategory=computer"
  
    # 4. Network Scanning Emulation (T1049)
    Write-Host "[+] Executing Netscan emulation..."
    .netscan.exe /hide /auto:"C:scansreport.xml" /range:192.168.1.0/24
  
    Write-Host "[*] Simulation Complete." -ForegroundColor Green

• Cleanup Commands:

    # Cleanup Script
    Write-Host "[*] Cleaning up simulation artifacts..." -ForegroundColor Cyan
    if (Test-Path "C:scansreport.xml") {
        Remove-Item "C:scansreport.xml" -Force
        Write-Host "[-] Removed report.xml"
    }
    Write-Host "[*] Cleanup finished." -ForegroundColor Green