Ransomware Data Recovery: A Case Study on INC Ransomware Gang

In an unprecedented turn of events, researchers at Cyber Centaurs have successfully recovered data stolen by the INC ransomware gang from a dozen U.S. organizations. This achievement, detailed in a recent report, sheds light on the operational security failures that often accompany ransomware attacks and the potential for data recovery even after a ransom event.

Operational Security Failures: The Achilles' Heel

The investigation began when a client organization detected ransomware encryption activity on a production SQL Server. A deep forensic examination of the artifacts left behind revealed tooling that had not been used in the investigated attack, but exposed attacker infrastructure that stored data exfiltrated from multiple victims.

Lateral Movement and Data Exfiltration

The researchers noticed the presence of artifacts from the legitimate backup tool Restic, although data exfiltration had occurred during the lateral movement stage, and the threat actor had not used the utility in this attack. This shift in the investigation from incident response to infrastructure analysis proved crucial.

The Role of Restic Backup Tool

Remnants of the Restic backup tool indicated that the threat actor was using it selectively as part of its operational toolkit. A PowerShell script, 'new.ps1', contained Base64-encoded commands for Restic and included hardcoded environment variables used to run the tool.

Implications for Ransomware Victims

The researchers theorized that if INC routinely reused Restic-based infrastructure across campaigns, then the storage repositories referenced in attacker scripts were unlikely to be dismantled once a ransom event concluded. Instead, those repositories would likely persist as long-lived attacker-controlled assets, quietly retaining encrypted victim data well after negotiations ended or payments were made.

Data Recovery from Stolen Backups

To validate this hypothesis, the team developed a controlled, non-destructive enumeration process that confirmed the presence of encrypted data stolen from 12 unrelated organizations in the healthcare, manufacturing, technology, and service sectors in the United States.

Relevance to North East India and Broader Indian Context

While the INC ransomware attack occurred in the United States, the lessons learned from this case can be applied to organizations in North East India and the broader Indian context. Organizations must prioritize cybersecurity measures, including robust backup and recovery strategies, to mitigate the impact of ransomware attacks.

Looking Forward: Implications and Future Considerations

This incident underscores the importance of a proactive approach to cybersecurity. Organizations should not only focus on incident response but also on infrastructure analysis and the identification of long-lived attacker-controlled assets. Additionally, the development and sharing of YARA and Sigma rules to help defenders detect the Restic backup tool or its renamed binaries can aid in the early detection of potential ransomware attacks.