An operational security failure allowed researchers to recover data that the INC ransomware gang stole from a dozen U.S. organizations. A deep forensic examination of the artifacts left behind uncovered tooling that had not been used in the investigated attack, but exposed attacker infrastructure that stored data exfiltrated from multiple victims. The operation was conducted by Cyber Centaurs, a digital forensics and incident response company that disclosed its success last November and now shared the full details with BleepingComputer. The Cyber Centaurs investigation began after a client U.S. organization detected ransomware encryption activity on a production SQL Server. The payload, a RainINC ransomware variant, was executed from the PerfLogs directory, which is typically created by…