AILOCK Ransomware: Critical Infrastructure Targeted in Japan & Spain — Check Point & Cisco Exploitation Active

title: Potential AILOCK Initial Access Check Point Gateway IKEv1 Anomaly
description: Detects potential exploitation of CVE-2026-50751 involving improper authentication in IKEv1 key exchange on Check Point Security Gateways.
author: Security Arsenal Research
status: experimental
date: 2026/07/15
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: firewall
definition: 'requiredFields: [app, action, src_ip, dst_ip, tunnel_type]'
detection:
  selection:
    app|contains: 'IKE'
    tunnel_type: 'IKEv1'
    action: 'accept'
  filter_legit:
    src_ip:
      - '127.0.0.1'
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate remote VPN users from unknown IPs
level: high
tags:
  - attack.initial_access
  - cve.2026.50751
  - ailock
---
title: Suspicious ConnectWise ScreenConnect Path Traversal (CVE-2024-1708)
description: Detects potential exploitation of ConnectWise ScreenConnect authentication bypass and path traversal, often used by AILOCK for RMM access.
author: Security Arsenal Research
status: experimental
date: 2026/07/15
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: windows
  service: security
definition: 'requiredFields: [EventID, ProcessName, SubjectUserName]'
detection:
  selection:
    EventID: 4656
    ObjectType: 'File'
    FileName|contains:
      - 'Setup.ashx'
      - 'Event.ashx'
      - 'Host.ashx'
    ProcessName|contains: 'ScreenConnect'
    AccessMask: '0x10080'  # ReadControl, GenericRead
  condition: selection
falsepositives:
  - Legitimate administrative use of ScreenConnect web interface
level: critical
tags:
  - attack.initial_access
  - cve.2024.1708
  - ailock
---
title: AILOCK Ransomware Preparation - VSS Shadow Copy Deletion
description: Detects commands used to delete Volume Shadow Copies, a common step in AILOCK playbook to prevent recovery.
author: Security Arsenal Research
status: experimental
date: 2026/07/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: 1 of selection_
falsepositives:
  - System administrator maintenance
level: high
tags:
  - attack.impact
  - ailock

// Hunt for AILOCK lateral movement and staging activities
let TimeFrame = 1h;
let SuspiciousProcesses = datatable(Process:string)['powershell.exe', 'cmd.exe', 'wmic.exe', 'psexec.exe', 'psexec64.exe', 'rclone.exe', 'winscp.exe', 'filezilla.exe'];
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ (SuspiciousProcesses)
// Detecting base64 encoded commands often used in AILOCK scripts
| where ProcessCommandLine has "-enc" or ProcessCommandLine has "FromBase64String"
// Detecting lateral movement indicators
| or ( InitiatingProcessAccountName != "System" and ProcessCommandLine has "\\\\") 
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, FolderPath
| order by Timestamp desc

<#
.SYNOPSIS
    AILOCK Hardening and Investigation Script
.DESCRIPTION
    Checks for indicators of AILOCK compromise and hardens against CVE-2026-50751 and CVE-2024-1708 vectors.
#>

Write-Host "[+] Starting AILOCK Hardening and Audit Check..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in last 7 days (Persistence)
Write-Host "[!] Checking for recently created Scheduled Tasks..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($schTasks) {
    Write-Host "[ALERT] Found recent scheduled tasks:" -ForegroundColor Red
    $schTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[OK] No suspicious recent tasks found." -ForegroundColor Green
}

# 2. Audit Check Point / Cisco Vulnerability Exposure (Simulated Check)
Write-Host "[!] Checking for exposure to AILOCK CVEs (CVE-2026-50751, CVE-2026-20131)..." -ForegroundColor Yellow
# Note: In a real env, query vulnerability scanner API or CMDB. Here we check if services are running.
$cpProcess = Get-Process -Name "vpnd" -ErrorAction SilentlyContinue
$ciscoProcess = Get-Service -Name "sfmgr" -ErrorAction SilentlyContinue

if ($cpProcess) { Write-Host "[WARN] Check Point services running. Verify patch for CVE-2026-50751 immediately." -ForegroundColor Red }
if ($ciscoProcess) { Write-Host "[WARN] Cisco FMC services running. Verify patch for CVE-2026-20131 immediately." -ForegroundColor Red }
if (-not $cpProcess -and -not $ciscoProcess) { Write-Host "[OK] No high-risk edge services detected on this host." -ForegroundColor Green }

# 3. Check for RDP Exposure (Risky Configuration)
Write-Host "[!] Checking RDP Security Layer..." -ForegroundColor Yellow
$rdpSettings = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -ErrorAction SilentlyContinue
if ($rdpSettings.UserAuthentication -eq 0) {
    Write-Host "[WARN] NLA is not enabled for RDP. Enable it immediately." -ForegroundColor Red
} else {
    Write-Host "[OK] RDP NLA is enabled." -ForegroundColor Green
}

Write-Host "[+] Audit complete." -ForegroundColor Cyan


---