Cybersecurity
INC Ransomware Operational Security Failure Allows Data Recovery for 12 U.S. Organizations
July 18, 2026 | 7 min read | Global (BleepingComputer)
Breaking: A critical operational security failure has allowed cybersecurity researchers to recover stolen data from a dozen U.S. organizations targeted by the INC ransomware gang.
GLOBAL — In a significant victory for digital forensics, a deep forensic examination of artifacts left behind by the INC ransomware gang has uncovered tooling that exposed attacker infrastructure storing data exfiltrated from multiple victims. This paradigm shift in incident response was conducted by Cyber Centaurs, a digital forensics and incident response company that recently disclosed its success and shared the full details with the cybersecurity community.
The investigation began after a client U.S. organization detected ransomware encryption activity on a production SQL Server. The payload, a RainINC ransomware variant, was executed from the PerfLogs directory, a location typically created by Windows but increasingly co-opted by ransomware actors for staging their operations.
The Forensic Breakthrough
Researchers noticed the presence of artifacts from the legitimate backup tool Restic, although data exfiltration had occurred during the lateral movement stage and the threat actor had not used the utility in this specific attack. This discovery caused a pivotal shift in the investigation from standard incident response to comprehensive infrastructure analysis.
- Renamed Binaries: Attackers used disguised executables, such as 'winupdate.exe', to evade detection.
- PowerShell Scripts: Scripts like 'new.ps1' contained Base64-encoded commands for Restic, including hardcoded environment variables, access keys, repository paths, and S3 passwords for encrypted repositories.
- Persistent Infrastructure: Researchers theorized that if INC routinely reused Restic-based infrastructure across campaigns, the storage repositories would likely persist as long-lived attacker-controlled assets, quietly retaining encrypted victim data well after negotiations ended.
To validate this hypothesis, the Cyber Centaurs team developed a controlled, non-destructive enumeration process. This meticulous approach confirmed the presence of encrypted data stolen from 12 unrelated organizations across the healthcare, manufacturing, technology, and service sectors in the United States.
Remarkably, none of these organizations were Cyber Centaurs clients, and the incidents were distinct, unrelated ransomware events. The researchers successfully decrypted the backups and preserved the copies while contacting law enforcement to help validate ownership and guide them through the proper legal procedures.
Official Source Alternative
While a direct, verifiable social media embed from the exact day of the report is unavailable, the official detailed report from Cyber Centaurs and the comprehensive coverage by BleepingComputer serve as the primary, verified sources for this incident.
View Official BleepingComputer ReportDefensive Recommendations
In response to these findings, the researchers created YARA and Sigma rules to help defenders detect the Restic backup tool or its renamed binaries in the environment. Running from suspicious locations could signal a ransomware attack in development.
INC ransomware is a ransomware-as-a-service (RaaS) operation that emerged in mid-2023. The threat actor has claimed several high-profile victims over the years, including Yamaha Motor, Xerox Business Solution, Scotland's NHS, McLaren Health Care, the Texas State Bar, Ahold Delhaize, the Panama Ministry of Economy, the Pennsylvania AG Office, and Crisis24.
Incident Summary
Organizations Impacted
12 U.S. Entities
Across multiple sectors
Exploited Tool
Restic
Legitimate backup utility
Threat Actor
INC Ransomware
RaaS operation
What Comes Next?
This incident serves as a stark reminder that even the most sophisticated ransomware operations are susceptible to human error and operational oversights. As threat actors continue to evolve their tactics, the cybersecurity community must remain vigilant, leveraging advanced forensic techniques to turn attacker mistakes into defensive advantages.
Organizations are strongly advised to review their network monitoring capabilities, implement the newly released YARA and Sigma rules, and ensure that legitimate administrative tools are not being subverted by malicious actors.