APT73 Ransomware Gang: Mass Extortion Campaign Exploiting Exchange & SmarterMail Flaws

title: Potential Microsoft Exchange Deserialization Exploit (CVE-2023-21529)
id: 7a5c2b1c-9f8d-4a3e-8b1c-9f8d4a3e8b1c
description: Detects suspicious patterns indicative of deserialization attacks targeting Microsoft Exchange Server, often associated with CVE-2023-21529.
status: experimental
date: 2026/04/30
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5156 # Windows Filtering Platform allowed connection
        DestPort: 443
        DestIp:
            - '127.0.0.1' # Local loopback exploitation often observed
            - '::1'
        Application|endswith: '\w3wp.exe'
    filter:
        SourceIp:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter
falsepositives:
    - Legitimate local Exchange management traffic
level: high
tags:
    - attack.initial_access
    - cve.2023.21529
    - apt73
---
title: SmarterMail Suspicious File Upload or Authentication Bypass
id: b4c3d2e1-0a9b-8c7d-6e5f-4a3b2c1d0e9f
description: Detects suspicious process execution by SmarterMail web services or command lines associated with vulnerability exploitation (CVE-2025-52691, CVE-2026-23760).
status: experimental
date: 2026/04/30
author: Security Arsenal Research
logsource:
    product: windows
    process:
    detection:
    selection_parent:
        ParentImage|contains: 'MailService'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
    condition: all of selection_*
falsepositives:
    - Administrative troubleshooting on the mail server
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.52691
    - apt73
---
title: APT73 Lateral Movement and Staging Indicators
id: c5d4e3f2-1b0c-9d8e-7f6a-5b4c3d2e1f0a
description: Detects common lateral movement tools and data staging patterns used by APT73 affiliates prior to encryption.
status: experimental
date: 2026/04/30
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection_psexec:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: '-accepteula'
    selection_wmi:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    selection_rclone:
        Image|endswith: '\rclone.exe' # Commonly used for data exfil by modern gangs
    selection_staging:
        Image|endswith: '\robocopy.exe'
        CommandLine|contains: '/E /Z /R:0 /W:0' # Flags often used to mirror data quickly
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative tasks
level: high
tags:
    - attack.lateral_movement
    - attack.exfiltration
    - apt73

// Hunt for suspicious parent-child relationships indicative of APT73 web shell activity
// Focuses on Exchange (w3wp) and Mail Service spawning shells
Process
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "MailService.exe", "netsvc.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| extend IOCLink = pack("InitiatingProcessCommandLine", InitiatingProcessCommandLine, "CommandLine", ProcessCommandLine)
| order by Timestamp desc

<#
.SYNOPSIS
    APT73 Rapid Response Hardening Script
.DESCRIPTION
    Checks for key indicators of compromise related to CVE-2023-21529 and SmarterMail,
    and audits recent scheduled tasks often used for persistence.
#>

Write-Host "[*] Starting APT73 Hardening and Audit Check..." -ForegroundColor Cyan

# 1. Audit Microsoft Exchange IIS Logs for Deserialization Patterns (Simplified)
$exchangePath = "C:\inetpub\logs\LogFiles\W3SVC1"
if (Test-Path $exchangePath) {
    $recentLogs = Get-ChildItem $exchangePath -Filter "*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1
    Write-Host "[+] Checking latest Exchange log: $($recentLogs.Name)" -ForegroundColor Green
    # Look for long URL strings or specific encoded patterns indicative of deserialization exploits
    Select-String -Path $recentLogs.FullName -Pattern ".{500,}" | Select-Object -First 5
}

# 2. Check for SmarterMail Service Interaction with CMD
Write-Host "[*] Checking for SmarterMail suspicious processes..." -ForegroundColor Yellow
$smProcs = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "cmd.exe" -or $_.Name -eq "powershell.exe" }
foreach ($proc in $smProcs) {
    $parent = Get-WmiObject Win32_Process | Where-Object { $_.ProcessId -eq $proc.ParentProcessId }
    if ($parent.Name -like "*Mail*" -or $parent.Name -like "*web*") {
        Write-Host "[!] ALERT: Suspicious shell spawned by $($parent.Name) (PID: $($parent.ProcessId))" -ForegroundColor Red
    }
}

# 3. Audit Scheduled Tasks created in the last 48 hours (Common Persistence)
Write-Host "[*] Auditing Scheduled Tasks created in last 48 hours..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-2) }
if ($schTasks) {
    Write-Host "[!] Found recently created tasks:" -ForegroundColor Red
    $schTasks | Select-Object TaskName, Date, Author, Actions
} else {
    Write-Host "[+] No suspicious recent tasks found." -ForegroundColor Green
}

Write-Host "[*] Script complete. Review alerts." -ForegroundColor Cyan