PsExec and Renamed Backup Tools Enabled Data Theft Before INC Ransomware Attack

Cybersecurity Incident: Ransomware Deployment and Data Exfiltration

A recent cybersecurity incident involved a ransomware attack where threat actors utilized legitimate Windows tools and a renamed backup utility to stage and exfiltrate sensitive data before deploying INC ransomware.

This event highlights the increasing use of "living off the land" techniques by threat actors to evade detection within compromised environments.

Investigations revealed that the threat actor gained access to the network at least one day prior to the incident, on February 24, 2026. The organization did not have a fully deployed endpoint detection agent across its infrastructure and lacked a Security Information and Event Management (SIEM) system.

The attack was identified on February 25, 2026, when analysts detected the deployment of INC ransomware inside a customer environment. These limitations significantly reduced visibility into early attacker activity, complicating the determination of the initial access vector. However, forensic analysis of the compromised endpoint revealed a sequence of events leading to the ransomware execution.

After gaining access, the attacker mapped a network share to the system as the F:\ drive and used Microsoft's legitimate PsExec utility to escalate privileges and execute commands remotely.

The attacker then created a scheduled task named "Recovery Diagnostics," configured to run a PowerShell script located at:

This task executed under SYSTEM privileges using the Windows schtasks.exe utility, allowing the attacker to maintain persistence with elevated permissions.

Subsequently, the attacker executed a Base64-encoded PowerShell command. Once decoded, the script revealed configurations for environment variables linked to a cloud backup tool, including:

AWS access key and secret key Repository path hosted on Wasabi S3 storage A backup password Commands to initialize and run a backup utility

The password in the script was not obfuscated, appearing in plaintext. The attacker used a renamed copy of Restic, an open-source backup tool, renamed to winupdate.exe and placed in the Windows system directory to appear legitimate.

The attacker initialized the repository and ran a command to perform a backup using a file list at:

This suggests prior knowledge of valuable data locations within the environment.

On February 25, the attacker disabled security protections by executing a program named edr.exe and used the VIPRE Business Agent uninstall utility to remove endpoint protection software. Windows Event Logs confirmed the disablement and uninstallation of the VIPRE security product, followed by the deactivation of Microsoft Defender's real-time protection.

With security defenses removed, the attacker launched the INC ransomware payload from:

c:\perflogs\win.exe –sup –hide –mode medium

The attack generated ransom notes titled INC-README.txt across the system, with Event Logs indicating RestartManager API activity, commonly used by ransomware to terminate processes before encryption.

Previous incidents reported by analysts involved similar restic-based exfiltration methods and cloud credentials, indicating a broader operational pattern linked to INC ransomware operators.

The findings underscore the importance of monitoring PowerShell activity, scheduled tasks, and unexpected backup operations as indicators of potential data exfiltration.

Based on reporting by GBHackers.