INC Ransomware Operational Security Failure Leads to Data Recovery for 12 US Organizations
- Securityish
- Threats & Incidents
Quick Summary
An operational security failure by the INC ransomware gang allowed researchers from Cyber Centaurs to recover data stolen from 12 U.S. organizations. The investigation revealed that the RainINC ransomware variant was executed from a Windows directory, and artifacts from the legitimate backup tool Restic were found, indicating data exfiltration. This incident highlights significant vulnerabilities in ransomware operations and the potential for data recovery after attacks.
The Securityish Brief
The investigation into the INC ransomware gang, specifically the RainINC variant, revealed a significant operational security failure that enabled the recovery of stolen data from 12 U.S. organizations across various sectors, including healthcare and technology. Cyber Centaurs, a digital forensics firm, conducted a thorough examination after a client detected ransomware activity on a SQL Server. The analysis uncovered that the ransomware was executed from the PerfLogs directory, a common staging area for malicious actors.
Researchers found remnants of the legitimate backup tool Restic, which had not been actively used in the attack, suggesting that the threat actor may have been using it selectively in their operational toolkit. The presence of renamed binaries and PowerShell scripts indicated that the INC ransomware group had a sophisticated method for managing their attacks, including hardcoded environment variables for accessing encrypted repositories.
During their investigation, Cyber Centaurs validated the presence of encrypted data from multiple organizations, confirming that the stolen data was still accessible on the INC ransomware’s backup server. This finding raises concerns about the long-term retention of victim data, as the threat actor may not dismantle their storage repositories after ransom negotiations.
Implications for Cybersecurity
This incident underscores the importance of robust operational security practices for organizations to mitigate the risks posed by ransomware. The ability of researchers to recover data from a ransomware attack highlights potential vulnerabilities in how ransomware groups manage and store stolen data. Organizations should be aware that even if they pay a ransom, their data may still be at risk.
Furthermore, the discovery of tools used by the INC ransomware group, including cleanup tools and remote access software, emphasizes the need for organizations to monitor their environments for suspicious activity. Implementing detection rules, such as YARA and Sigma rules, can help identify the use of legitimate tools like Restic in unauthorized contexts.
As ransomware attacks continue to evolve, organizations must remain vigilant and proactive in their cybersecurity measures. Regularly reviewing security protocols, training staff on recognizing potential threats, and ensuring backups are secure and isolated from the network can significantly reduce the impact of such attacks.
Key Takeaways
- Regularly review and update your organization’s cybersecurity protocols to address evolving ransomware threats.
- Implement monitoring tools to detect suspicious activity related to legitimate software like Restic.
- Ensure that backups are securely stored and isolated from the main network to prevent unauthorized access.
- Train staff on recognizing signs of ransomware attacks and the importance of reporting suspicious activities.
- Consider developing incident response plans that include data recovery strategies in case of a ransomware attack.
Key Terms & Concepts
- RainINC ransomware: In this article, RainINC ransomware refers to a variant of ransomware used by the INC group to encrypt victims’ data.
- Restic: Restic is a legitimate backup tool that was found in the infrastructure of the INC ransomware group, indicating its selective use in attacks.
- operational security: Operational security refers to the processes and practices that organizations use to protect their sensitive information from unauthorized access.
Read the original article here: https://www.bleepingcomputer.com/news/security/inc-ransomware-opsec-fail-allowed-data-recovery-for-12-us-orgs/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
