AKIRA Ransomware: 5 New Victims — Financial & Agri-Sector Surge & Critical Firewall Exploits

---
title: Potential Check Point VPN IKEv1 Exploitation (CVE-2026-50751)
id: 12345678-abcd-efgh-ijkl-123456789012
status: experimental
description: Detects potential exploitation of Check Point Security Gateway IKEv1 improper authentication vulnerability observed in Akira campaigns.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/08
tags:
    - cve.2026.50751
    - attack.initial_access
    - detection.emerging_threats
logsource:
    product: firewall
    service: check_point
detection:
    selection:
        protocol: 'IKE'
        version: 'v1'
        action: 'accept'
    filter_main:
        src_ip:
            - '127.0.0.1'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_main
falsepositives:
    - Legitimate remote access via IKEv1
level: critical
---
title: Suspicious ConnectWise ScreenConnect Process Chain
id: 87654321-dcba-hgfe-lkji-210987654321
status: experimental
description: Detects suspicious child processes spawned by ConnectWise ScreenConnect client, often associated with authentication bypass exploitation (CVE-2024-1708) and Akira ransomware deployment.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/08
tags:
    - cve.2024.1708
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: 
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
    selection_img:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_img
falsepositives:
    - Legitimate administrative use by support staff
level: high
---
title: Ransomware Data Staging via High Compression Archiving
id: 11223344-5566-7788-9900-aabbccddeeff
status: experimental
description: Detects the use of archiving tools (7-Zip/WinRAR) with maximum compression and password protection, a common TTP for Akira data exfiltration staging.
author: Security Arsenal Research
date: 2026/07/08
tags:
    - attack.exfiltration
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\7z.exe'
            - '\winrar.exe'
            - '\rar.exe'
    selection_flags:
        CommandLine|contains:
            - '-p'
            - '-m0=lzma2'
            - '-mx9'
    condition: selection_tool and selection_flags
falsepositives:
    - System administrator backups
level: medium

// Hunt for Akira Lateral Movement and Staging
// Looks for PsExec/WMI usage followed by large file modifications (Staging)
let ProcessCreation = DeviceProcessEvents 
| where Timestamp > ago(7d) 
| where InitiatingProcessFileName in ('psexec.exe', 'psexec64.exe', 'wmic.exe') 
| project DeviceId, DeviceName, AccountName, InitiatingProcessCommandLine, Timestamp, ProcessFileName;
let FileActivity = DeviceFileEvents 
| where Timestamp > ago(7d) 
| where FolderPath contains "\Temp\" or FolderPath contains "\AppData\Local\Temp" 
| where FileSize > 10485760 
| project DeviceId, DeviceName, FileName, FileSize, Timestamp;
ProcessCreation 
| join kind=inner FileActivity on DeviceId 
| where FileActivity.Timestamp between (ProcessCreation.Timestamp - 1h) .. (ProcessCreation.Timestamp + 4h)
| summarize count() by DeviceName, AccountName, bin(Timestamp, 1h)

<#
    .SYNOPSIS
    Akira Ransomware Rapid Response Hardening Script
    .DESCRIPTION
    Checks for signs of Akira persistence (Scheduled Tasks) and enforces hardening
    against common vectors (RDP, ScreenConnect).
#>

Write-Host "[+] Starting Akira Hardening Check..." -ForegroundColor Cyan

# 1. Hunt for Suspicious Scheduled Tasks
Write-Host "[*] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
    Select-Object TaskName, Author, Date, Actions | 
    Format-Table -AutoSize

# 2. Check for Shadow Copy Manipulation
Write-Host "[*] Checking for VSS shadow copy deletions (Event ID 4104/1)..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=4104; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | 
    Select-Object TimeCreated, Message | Format-List

# 3. Hardening: Disable RDP if not required
$RDPStatus = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections").fDenyTSConnections
if ($RDPStatus -eq 0) {
    Write-Host "[!] WARNING: RDP is ENABLED. Consider disabling it via GPO or firewall rules." -ForegroundColor Red
} else {
    Write-Host "[+] RDP is disabled." -ForegroundColor Green
}

# 4. Hardening: Check for ScreenConnect Web Interface exposure
Write-Host "[*] Checking for ConnectWise ScreenConnect services..." -ForegroundColor Yellow
$Service = Get-Service -Name "ScreenConnect*" -ErrorAction SilentlyContinue
if ($Service) {
    Write-Host "[!] ScreenConnect detected. Ensure web interface is patched (CVE-2024-1708) and MFA is enforced." -ForegroundColor Red
} else {
    Write-Host "[+] No ScreenConnect services found." -ForegroundColor Green
}

Write-Host "[+] Script completed." -ForegroundColor Cyan


---