INC Ransomware Double-Extortion Timeline + M365 AiTM Token Replay: OTX Pulse Detection Pack

Two fresh pulses from AlienVault OTX paint a picture of the modern intrusion economy operating exactly as designed: access is brokered, identities are replayed, and extortion follows on a schedule dictated by criminal project management rather than technical necessity.

Pulse one documents an INC ransomware intrusion analyzed by Huntress in which a victim organization was compromised across at least 175 endpoints. The timeline is the tell: initial access activity in early August — scheduled tasks with randomized names and lateral movement over RDP using a compromised account — followed by a 17-day operational gap, then the ransomware phase in late August. That gap is the fingerprint of an initial access broker (IAB) handoff: one crew breaches, stages, and sells; a separate INC affiliate buys the access and executes the encryption and double-extortion phase. Tooling observed includes AnyDesk for interactive remote access, Impacket for lateral movement, scheduled tasks for persistence and execution, and a BYOVD (Bring Your Own Vulnerable Driver) attack to blind endpoint defenses before detonation. The lone domain indicator, throughoutes.net, is consistent with infrastructure used to stage or beacon during the intrusion.

Pulse two tracks a distinct but complementary threat: a ten-week campaign (July–September 2026) in which operators used adversary-in-the-middle (AiTM) phishing relays to capture Microsoft 365 sign-in sessions and then replayed stolen session tokens from infrastructure controlled by German hosting provider 1337 Services GmbH. The result: 79 organizations compromised, 497 successful sign-ins — classic business email compromise (BEC) enablement. No malware on disk, no exploit chain — just stolen sessions that sail past MFA because the token itself is the prize.

Collectively, these pulses illustrate the two dominant initial-access economies feeding enterprise victims today: brokered network access sold to ransomware affiliates, and identity-token theft sold or used directly for BEC. Defenders must hunt both the endpoint artifacts of the intrusion chain and the identity-layer anomalies of token replay.

Threat Actor / Malware Profile

INC Ransomware (Brave Prince — S0252)

• Distribution method: Purchased access from initial access brokers. The 17-day dwell between first-stage activity (randomized scheduled tasks, RDP lateral movement with a compromised account) and the ransomware phase indicates a division of labor between the broker and the INC affiliate.
• Payload behavior: Mass encryption across endpoints (175+ in this case) with double extortion — data exfiltrated before encryption, leak threats issued if ransom is unpaid. The campaign name references two distinct ransom notes observed, suggesting evolving branding or affiliate-level customization.
• C2 / staging communication: The domain throughoutes.net appears in the indicator set and should be treated as staging or beaconing infrastructure. Affiliates also lean heavily on legitimate RMM tooling (AnyDesk) whose traffic blends into enterprise noise.
• Persistence mechanism: Scheduled tasks with randomized names created in the early intrusion phase — a low-noise persistence and execution primitive that survives reboots and evades casual autoruns review.
• Anti-analysis / defense evasion: BYOVD attack — a signed but vulnerable driver is dropped and loaded to terminate EDR processes from kernel space before encryption begins. Impacket-based tooling (wmiexec/psexec-style) enables fileless-ish lateral movement that avoids dropping obvious binaries.

M365 Token Spray and Replay Operators (Unattributed)

• Distribution method: AiTM phishing relays that proxy the real Microsoft login flow, capturing session cookies/tokens after the victim completes MFA.
• Payload behavior: No endpoint payload. Stolen tokens are replayed from foreign infrastructure — in this case IPs tied to 1337 Services GmbH (185.238.2.195, 192.159.99.172, 2400:8d60:2::1:841d:5dd) — to establish authenticated M365 sessions for BEC, mailbox rule manipulation, and data theft.
• Persistence mechanism: Token/session reuse; once inside, actors typically register additional MFA methods or create inbox rules to maintain access independent of the victim password.
• Anti-analysis: Living entirely in the identity plane — no malware, no hashes to block beyond the relay tooling artifact (d8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce). Detection depends on impossible-travel, ASN, and token-anomaly analytics.

IOC Analysis

The indicator set across these pulses spans three operationally distinct types:

• Domain (1): throughoutes.net — INC intrusion staging/beaconing. Actionable at DNS sinkhole, proxy, and firewall layers. Historical passive-DNS pivoting may reveal sibling infrastructure registered in the same burst.
• IPv4 / IPv6 (3): 185.238.2.195, 192.159.99.172, 2400:8d60:2::1:841d:5dd — 1337 Services GmbH-hosted replay sources for the M365 campaign. These belong in blocklists for authentication-adjacent services, but more importantly they should drive sign-in log correlation: any successful Entra ID authentication sourced from these IPs is a confirmed compromise until proven otherwise.
• FileHash-SHA256 (1): d8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce — associated with the token-replay campaign tooling. Hashes are brittle for AiTM kits (which live server-side), but the value is in retro-hunting mail quarantine and proxy logs for delivery artifacts.

Operationalization guidance for SOC teams: Feed indicators into your SIEM as a watchlist (Sentinel Watchlists, Splunk lookups, Elastic value lists). Domains go to DNS and proxy retro-search for a minimum 90-day lookback. IPs get dual treatment: network egress alerting and identity-layer correlation against Entra ID sign-in logs — replay activity will never touch your endpoint telemetry. Hash indicators go to EDR retro-hunt. Tooling of note: grep/SIEM search for DNS cache hits, Zeek/Suricata logs for the domain, and Microsoft Defender for Identity / Entra ID Protection detections for anomalous token usage.

Detection Engineering

---
title: INC Ransomware - Randomized Scheduled Task Creation for Persistence
id: 8f3a1c2e-7b4d-4e6f-9a1b-inc0001task1
status: experimental
description: Detects creation of scheduled tasks with randomized/high-entropy names consistent with INC ransomware affiliate persistence and execution staging observed in the August 2026 intrusion timeline.
author: Security Arsenal Threat Intel
references:
  - https://www.huntress.com/blog/two-inc-ransom-notes
date: 2026/10/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/tn'
  selection_entropy:
    CommandLine|re: '/tn\s+"?[A-Za-z0-9]{12,}"?\s'
  filter_legit:
    CommandLine|contains:
      - 'MicrosoftEdgeUpdateTask'
      - 'GoogleUpdateTask'
  condition: selection_schtasks and selection_entropy and not filter_legit
falsepositives:
  - Software deployment tools creating randomized task names
level: high
tags:
  - attack.persistence
  - attack.t1053.005
---
title: INC Ransomware - BYOVD Vulnerable Driver Load Attempt
id: 9d2b4f1a-3c5e-4a7b-8c2d-inc0002byovd
status: experimental
description: Detects driver service creation followed by EDR/security process termination patterns consistent with INC ransomware BYOVD defense-evasion technique used to blind endpoint protection prior to encryption.
author: Security Arsenal Threat Intel
references:
  - https://www.huntress.com/blog/two-inc-ransom-notes
date: 2026/10/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_driver_drop:
    CommandLine|contains:
      - 'sc.exe create'
      - 'sc create'
    CommandLine|contains:
      - 'type= kernel'
      - '.sys'
  selection_tmp_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: selection_driver_drop and selection_tmp_path
falsepositives:
  - Legitimate hardware vendor driver installers (typically run from vendor directories, not temp paths)
level: critical
tags:
  - attack.defense-evasion
  - attack.t1562.001
  - attack.t1068
---
title: M365 Token Replay - Impossible Travel via Hosting Provider ASN
id: 7a1e3d5c-2b8f-4d9a-b3e7-aitm003replay
status: experimental
description: Detects successful authentication events sourced from known bulletproof/hosting provider infrastructure indicative of AiTM token replay, as observed in the 1337 Services GmbH M365 campaign compromising 79 organizations.
author: Security Arsenal Threat Intel
references:
  - https://www.huntress.com/blog/token-replay-spray
date: 2026/10/24
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ips:
    ip_address:
      - '185.238.2.195'
      - '192.159.99.172'
      - '2400:8d60:2::1:841d:5dd'
  selection_success:
    status: 'Success'
  condition: selection_ips and selection_success
falsepositives:
  - Corporate VPN egress through hosting providers (rare; validate against known egress list)
level: critical
tags:
  - attack.initial-access
  - attack.t1557
  - attack.credential-access
  - attack.t1539

// Hunt: M365 token replay sources + INC ransomware endpoint artifacts
// Part 1: Successful sign-ins from known AiTM replay infrastructure
let ReplayIPs = dynamic(["185.238.2.195", "192.159.99.172", "2400:8d60:2::1:841d:5dd"]);
SigninLogs
| where TimeGenerated > ago(90d)
| where IPAddress in (ReplayIPs)
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
    DeviceDetail, Location, ConditionalAccessStatus
| order by TimeGenerated desc;
// Part 2: Endpoint artifacts of the INC intrusion chain
DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl contains "throughoutes.net"
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| extend TaskName = extract(@"/tn\s+\"?([A-Za-z0-9]{12,})\"?", 1, ProcessCommandLine)
| where isnotempty(TaskName)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, TaskName;
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "anydesk.exe" or ProcessCommandLine has "anydesk"
| where InitiatingProcessFileName !in~ ("explorer.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Part 3: File hash from token-replay campaign tooling
DeviceFileEvents
| where SHA256 == "d8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName;

# INC Ransomware + Token Replay IOC Hunt Script
# Run on endpoints via EDR/PSRemoting; checks persistence, artifacts, and network IOCs
$ErrorActionPreference = 'SilentlyContinue'
$Report = [System.Collections.Generic.List[object]]::new()

# 1. Hunt for randomized-name scheduled tasks (INC persistence pattern)
Get-ScheduledTask | Where-Object {
    $_.TaskName -match '^[A-Za-z0-9]{12,}$' -and
    $_.TaskPath -notlike '\Microsoft\*'
} | ForEach-Object {
    $Report.Add([pscustomobject]@{
        Type = 'SuspiciousScheduledTask'; Host = $env:COMPUTERNAME
        Detail = "$($_.TaskPath)$($_.TaskName)"
        Action = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
    })
}

# 2. Check for AnyDesk presence and non-standard install paths
$anydeskPaths = @("$env:ProgramFiles\AnyDesk", "$env:APPDATA\AnyDesk", "$env:PUBLIC\anydesk.exe", "$env:TEMP\anydesk.exe")
foreach ($p in $anydeskPaths) {
    if (Test-Path $p) {
        $Report.Add([pscustomobject]@{
            Type = 'AnyDeskArtifact'; Host = $env:COMPUTERNAME; Detail = $p; Action = 'Validate legitimacy'
        })
    }
}

# 3. Hunt for campaign file hash on common staging locations
$targetHash = 'D8A3FEDB1A3CD1287CA47C6851A49E6052AB6116B43666E674765CA892D798CE'
@("$env:TEMP", "$env:PUBLIC", "$env:ProgramData") | ForEach-Object {
    Get-ChildItem -Path $_ -Recurse -File -Depth 2 | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256).Hash -eq $targetHash) {
            $Report.Add([pscustomobject]@{
                Type = 'MaliciousHashMatch'; Host = $env:COMPUTERNAME; Detail = $_.FullName; Action = 'Isolate host'
            })
        }
    }
}

# 4. Check active and historical network connections to replay/staging IOCs
$iocIPs = @('185.238.2.195', '192.159.99.172')
Get-NetTCPConnection | Where-Object { $iocIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $Report.Add([pscustomobject]@{
        Type = 'IOCNetworkConnection'; Host = $env:COMPUTERNAME
        Detail = "$($_.RemoteAddress):$($_.RemotePort) [$($proc.ProcessName)]"
        Action = 'Isolate host and reset user credentials'
    })
}

# 5. DNS cache check for INC staging domain
Resolve-DnsName -Name 'throughoutes.net' -ErrorAction SilentlyContinue | Out-Null
Get-DnsClientCache | Where-Object { $_.Entry -like '*throughoutes.net*' } | ForEach-Object {
    $Report.Add([pscustomobject]@{
        Type = 'IOCDNSCacheHit'; Host = $env:COMPUTERNAME; Detail = $_.Entry; Action = 'Pull full DNS/proxy logs for timeline'
    })
}

if ($Report.Count -gt 0) { $Report | Format-Table -AutoSize; $Report | Export-Csv "C:\INC_AiTM_Hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }
else { Write-Output "[+] No IOC artifacts found on $env:COMPUTERNAME" }

Response Priorities

Immediate (0–4 hours):

• Block throughoutes.net at DNS resolver, proxy, and firewall; block 185.238.2.195, 192.159.99.172, and 2400:8d60:2::1:841d:5dd at egress and — critically — flag them in identity-layer correlation.
• Search Entra ID sign-in logs for the three replay IPs across a 90-day lookback; any successful authentication is a confirmed account compromise — revoke all sessions and refresh tokens immediately.
• Retro-hunt EDR for the SHA256 indicator and sweep endpoints for randomized-name scheduled tasks and unauthorized AnyDesk installs.
• Audit driver loads: alert on any .sys load from user-writable paths in the last 30 days (BYOVD precursor).

24 hours:

• For every account touched by a replay-IP sign-in: force password reset, revoke all refresh tokens, re-register MFA, and audit mailbox rules, OAuth consent grants, and forwarding settings — BEC actors entrench fast.
• If credential exposure is confirmed, extend reset to any account sharing session hosts or accessed from the same endpoints; assume Kerberos/NTLM material on compromised RDP-jump systems is burned.
• Review RDP exposure: the INC intrusion moved laterally via a compromised account over RDP. Audit logons (Event ID 4624 type 10) for anomalous sources during any historical dwell window.

1 week:

• Deploy phishing-resistant MFA (FIDO2/passkeys) for all users, prioritizing finance and executive roles — AiTM relays defeat OTP and push-based MFA by design.
• Enforce Conditional Access token protection and compliant-device requirements so replayed tokens fail binding checks.
• Block or tightly gate RMM tooling: AnyDesk and similar tools should be allowlisted by hash/signature with alerting on first-seen installs.
• Implement vulnerable driver blocklisting (Microsoft's recommended driver blocklist, WDAC) to close the BYOVD path before encryption crews reach your estate.
• Establish scheduled-task creation alerting with entropy-based name detection as a standing analytic.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub