Analysis of INC Ransomware Tradecraft and Multi-Note Pressure

INC Ransom, a ransomware-as-a-service (RaaS) group emerging in mid-2023, has demonstrated sophisticated pressure tactics and defensive evasion tradecraft. Analysis of recent incidents suggests a possible collaboration between Initial Access Brokers (IABs) and ransomware affiliates, evidenced by significant lulls between initial persistence and final encryption phases. The group is notable for dropping two distinct ransom notes: a standard decryption offer and a follow-up 'press release' threat intended to increase psychological pressure by detailing stolen data.

Technically, the group employs a 'Bring Your Own Vulnerable Driver' (BYOVD) approach to disable security products at the kernel level. They leverage common administrative and lateral movement tools, including RDP, AnyDesk, Impacket's atexec.py, and PSExec, to propagate their file encryption executable. Their data exfiltration strategy involves staging files with 7-Zip before utilizing MEGASync for cloud-based transfer.

These attacks target a wide range of sectors, including healthcare and hospitality, often resulting in widespread endpoint impact. The group's focus on identifying and describing stolen data in their notes indicates significant 'dwell time' spent understanding the victim's internal documentation, increasing the urgency for organizations to implement robust monitoring for unauthorized remote access and kernel driver loading.