AILOCK Ransomware: Global Campaign Targets Manufacturing & Education — Critical Firewall Exploits Active

---
title: Potential Check Point VPN IKEv1 Exploitation (CVE-2026-50751)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation of improper authentication in IKEv1 key exchange on Check Point Security Gateways.
author: Security Arsenal Research
date: 2026/07/09
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
definition:
    condition: selection
selection:
    dst_port: 500
    protocol: udp
    action: 'accept' or 'decrypt'
    vendor: 'Check Point'
    vpn_feature: 'IKEv1'
    | count() by src_ip > 100
falsepositives:
    - Legitimate high-volume IKEv1 re-keying
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - ransomware.ailock
---
title: ConnectWise ScreenConnect Path Traversal Exploitation (CVE-2024-1708)
id: e5f6g7h8-9012-34cd-efab-567890123456
status: experimental
description: Detects suspicious URL patterns associated with ScreenConnect path traversal exploits.
author: Security Arsenal Research
date: 2026/07/09
logsource:
    category: webserver
definition:
    condition: selection
selection:
    c-uri|contains:
        - '/Setup/'
        - 'Authentication?'
        - '..%2f'
        - '..\\'
    sc-status: 200
falsepositives:
    - Legitimate administrative setup access
level: critical
tags:
    - attack.initial_access
    - attack.execution
    - cve.2024.1708
    - ransomware.ailock
---
title: Ransomware Data Staging via Archive Tools
id: 9a0b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects bulk compression and archiving of files indicative of data exfiltration staging prior to encryption.
author: Security Arsenal Research
date: 2026/07/09
logsource:
    category: process_creation
    product: windows
definition:
    condition: all of selection*
selection_cli:
    Image|endswith:
        - '\\winrar.exe'
        - '\\7z.exe'
        - '\\tar.exe'
    CommandLine|contains:
        - '-a'
        - '-m0'
        - '-hp'  # password protected
selection_vol:
    TargetFilename|contains:
        - 'C:\\Temp\\'
        - 'C:\\Windows\\Temp\\'
        - 'D:\\Staging\\'
level: high
tags:
    - attack.exfiltration
    - attack.impact
    - ransomware.ailock

// Hunt for lateral movement and staging indicators associated with AILOCK
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where InitiatingProcessAccountName in @("Administrator", "SYSTEM")
| where (ProcessCommandLine contains "vssadmin" and ProcessCommandLine contains "delete") 
   or (ProcessCommandLine contains "wbadmin" and ProcessCommandLine contains "delete")
   or (ProcessCommandLine contains "bcdedit" and ProcessCommandLine contains "recoveryenabled no")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, ProcessCommandLine, FileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(TimeFrame)
    | where RemotePort in (443, 80, 500) and ActionType == "ConnectionSuccess"
) on HostName
| summarize count() by Timestamp, HostName, ProcessCommandLine, RemoteUrl

<#
.SYNOPSIS
    AILOCK Ransomware Rapid Response Hardening Script
.DESCRIPTION
    Checks for common persistence mechanisms and signs of AILOCK TTPs (RDP exposure, Scheduled Tasks, VSS modifications).
#>

Write-Host "[+] Starting AILOCK Rapid Response Assessment..." -ForegroundColor Cyan

# 1. Check for recent Scheduled Tasks (Potential Persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created/modified in the last 7 days..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author

# 2. Check Volume Shadow Copy Service (VSS) Health
Write-Host "\n[*] Checking Volume Shadow Copy Storage usage..." -ForegroundColor Yellow
$vss = vssadmin list shadowstorage
if ($vss -match "No shadow copies found") {
    Write-Host "[!] WARNING: No Shadow Copies found. Possible deletion event." -ForegroundColor Red
} else {
    Write-Host "[+] Shadow Copies exist." -ForegroundColor Green
}

# 3. Audit RDP Sessions (Common Lateral Movement)
Write-Host "\n[*] Checking active RDP sessions..." -ForegroundColor Yellow
$query = "SELECT * FROM Win32_LogonSession WHERE LogonType = 10"
Get-CimInstance -Query $query | ForEach-Object {
    $sessionId = $_.LogonId
    $user = Get-CimInstance -Query "ASSOCIATORS OF {Win32_LogonSession='$sessionId'} WHERE AssocClass=Win32_LoggedOnUser" | Select-Object -ExpandProperty Caption
    Write-Host "Active Session: $user (ID: $sessionId)"
}

Write-Host "\n[+] Assessment Complete." -ForegroundColor Cyan