APT73 Ransomware Gang: Global Surge Exploiting Check Point & ScreenConnect Vulnerabilities

Classification: RaaS / Closed-Group Hybrid Aliases: None confirmed (suspected rebrand of a former LockBit affiliate subset).

APT73 operates with a high degree of technical sophistication, distinguishing themselves from "commodity" gangs through the rapid integration of "Day 0" and "Day 1" CVE exploits into their automated attack chains. They function primarily as a closed group but occasionally solicit access brokers, suggesting a hybrid operational model.

TTPs & Playbook:

• Initial Access: Heavy reliance on external remote services (VPN gateways, Firewalls) and remote management software (ScreenConnect). Phishing is rare; they prefer unauthenticated exploitation.
• Ransom Demands: Variable, typically ranging from $500k to $5M USD depending on victim revenue.
• Double Extortion: Aggressive. Data is exfiltrated to cloud storage prior to encryption. Leak site updates occur on a strict 48-72 hour countdown timer.
• Dwell Time: Short. APT73 averages 3-5 days from initial compromise to detonation, indicating automated tooling for lateral movement.

Current Campaign Analysis

Campaign Dates: 2026-07-02 to 2026-07-03 Recent Victim Count: 4

Targeted Sectors:

• Technology (25%): Specifically targeting SaaS/platform providers (e.g., flazio.com).
• Hospitality & Tourism (25%): High-value target for PII exfiltration (e.g., holidaypalace.com).
• Undetermined/Miscellaneous (50%): Two victims listed as "Not Found", suggesting opportunistic scanning or failure to identify sector post-compromise.

Geographic Distribution: The campaign is highly dispersed, avoiding regional concentration to evade geopolitical heat:

• TR (Turkey): 1 victim
• BR (Brazil): 1 victim
• MO (Macao): 1 victim
• AT (Austria): 1 victim

Victim Profile: Based on the victim footprint, APT73 is currently targeting Small to Mid-sized Enterprises (SMEs). The victims appear to rely heavily on external-facing perimeter appliances (Check Point, Cisco) for remote connectivity, likely due to decentralized workforces or remote management needs in the Hospitality/Tech sectors.

CVE Correlation & Initial Access: There is a high-confidence correlation between the active exploitation of CVE-2024-1708 (ConnectWise ScreenConnect) and CVE-2026-50751 (Check Point Security Gateway) in this campaign.

• The Technology sector victim (flazio.com) likely provided access via unpatched ScreenConnect instances, a common management tool for IT service providers.
• The Hospitality victim (holidaypalace.com) suggests VPN exploitation (Check Point) was the vector, given the sector's reliance on secure remote tunneling for property management systems.

Detection Engineering

SIGMA Rules

---
title: Potential Exploitation of CVE-2024-1708 ScreenConnect Path Traversal
id: 0c8d0e2f-6b1a-4f5c-9e1d-2a3b4c5d6e7f
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability (CVE-2024-1708) via suspicious URI patterns or file access.
status: experimental
date: 2026/07/04
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/bin/'
            - 'App_Extensions'
            - '.aspx?'
        cs-method: 'GET'
    filter:
        sc-status: 200
    condition: selection and filter
falsepositives:
    - Legitimate administrative access
level: critical
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.apt73

---
title: Check Point VPN IKEv1 Auth Bypass (CVE-2026-50751) Indicator
id: 1d9e1f3g-7c2b-5g6d-0f2e-3b4c5d6e7f8g
description: Detects indicators of potential exploitation of Check Point Security Gateway IKEv1 authentication bypass. Focuses on anomaly in VPN logs or subsequent shell execution.
status: experimental
date: 2026/07/04
author: Security Arsenal
logsource:
    product: firewall
detection:
    selection_ike:
        service: 'ike'
        protocol: 'udp'
        dst_port: 500
    selection_anomaly:
        |count: > 50
        | timeframe: 1m
    selection_shell:
        ImagePath|contains:
            - '/bin/sh'
            - 'cmd.exe'
        ParentProcessName|contains: 'vpnd'
    condition: 1 of selection*
falsepositives:
    - High volume legitimate IKE renegotiation
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - ransomware.apt73

---
title: Ransomware Preparation - Volume Shadow Copy Deletion via VssAdmin
id: 2a0f2g4h-8d3c-6h7e-1g3f-4c5d6e7f8g9h
description: Detects attempts to delete Volume Shadow Copies using vssadmin.exe, a common precursor to encryption by APT73.
status: experimental
date: 2026/07/04
author: Security Arsenal
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    condition: selection
falsepositives:
    - Legitimate system administration (rare)
level: critical
tags:
    - attack.impact
    - attack.t1490
    - ransomware.apt73

KQL (Microsoft Sentinel)

Hunt for lateral movement and data staging indicators often seen post-initial access for this group.

// Hunt for APT73 Lateral Movement and Data Staging
let CommonTools = dynamic(["PsExec.exe", "psexec64.exe", "wmic.exe", "powershell.exe", "cmd.exe"]);
let SuspiciousCommands = dynamic(["-encodedcommand", "downloadstring", "iex", "invoke-expression"]);
DeviceProcessEvents 
| where Timestamp >= ago(7d)
| where FileName in~ CommonTools 
| where ProcessCommandLine has_any (SuspiciousCommands) 
or ProcessCommandLine has "\\192.168." 
or ProcessCommandLine has "\\10."
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| summarize count() by DeviceName, FileName
| where count_ > 5

PowerShell (Rapid Response)

Rapid script to enumerate scheduled tasks added recently (a common persistence mechanism for APT73) and check VSS health.

# APT73 Rapid Response Script
# Check for suspicious Scheduled Tasks created in the last 24 hours
Write-Host "[+] Hunting for recently created Scheduled Tasks (Last 24h)..." -ForegroundColor Cyan

$Date = (Get-Date).AddDays(-1)
Get-ScheduledTask | Where-Object {$_.Date -ge $Date} | Select-Object TaskName, TaskPath, State, Author

# Check Volume Shadow Copy Service Health
Write-Host "\n[+] Checking Volume Shadow Copy Storage Usage..." -ForegroundColor Cyan

vssadmin list shadowstorage

Write-Host "\n[+] Checking for recent VSS Deletion Events in System Log..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; ID=8224; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message


---

Incident Response Priorities

1. T-Minus Detection Checklist:

   • Immediately review VPN logs (Check Point/Cisco) for successful authentications followed immediately by administrative command-line activity.
   • Hunt for web.config or App_Extensions access logs on ScreenConnect servers.
   • Look for vssadmin.exe execution or unexpected service stops on backup agents.

2. Critical Asset Prioritization:

   • Hospitality: Guest PII databases (CRM/Property Management Systems).
   • Technology: Source code repositories and client credential stores. APT73 prioritizes data that facilitates supply chain attacks.

3. Containment Actions (Urgency: High):

   • Isolate: Disconnect any identified VPN concentrators or ScreenConnect servers from the network immediately if compromise is suspected.
   • Revoke: Force-reset credentials for all local and domain administrator accounts used on the affected jump hosts.
   • Block: Block outbound traffic to known file-sharing domains (Mega, MediaFire) on all firewalls.

Hardening Recommendations

Immediate (24 Hours):

• Patch CVE-2024-1708: Apply the ConnectWise ScreenConnect patch immediately or restrict access to /Guest paths via WAF.
• Disable IKEv1: On Check Point Security Gateways, disable IKEv1 and enforce IKEv2 only to mitigate CVE-2026-50751.
• MFA Enforcement: Enforce MFA on all remote access solutions, including ScreenConnect and VPN gateways.

Short-term (2 Weeks):

• Network Segmentation: Move remote administration tools (ScreenConnect, RDP) into a dedicated administrative VLAN with strict ingress/egress rules.
• EDR Coverage: Ensure full EDR coverage on perimeter appliances and any server exposed to the internet, not just internal workstations.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub