Data Recovery from INC Ransomware Due to Operational Security Lapse

An operational security failure by the INC ransomware gang allowed researchers to recover data stolen from twelve U.S. organizations. Cyber Centaurs, a digital forensics firm, discovered the gang's cloud storage infrastructure, which contained exfiltrated data, during their investigation. The attackers used a variant of the RainINC ransomware and left behind artifacts that facilitated the recovery process.