Huntress INC Ransom Group August 2023

INC Ransom has used RDP to move laterally.

INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.

INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.

INC Ransom has used WMIC to deploy ransomware.

INC Ransom has used `cmd.exe` to launch malicious payloads.

INC Ransom has enumerated domain groups on targeted hosts.

INC Ransom has used valid accounts over RDP to connect to targeted systems.

INC Ransom has staged data on compromised hosts prior to exfiltration.

INC Ransom has used compromised valid accounts for access to victim environments.

INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.

INC Ransom has used Internet Explorer to view folders on other systems.

INC Ransom has used AnyDesk and PuTTY on compromised systems.

INC Ransom has used INC Ransomware to encrypt victim's data.

INC Ransomware can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.

INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.

INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.

INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.

INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.