APT73 Ransomware: Global Surge Targets Finance & Education via Critical Infrastructure CVEs

---
title: Potential Exchange Deserialization Exploit (CVE-2023-21529)
id: d7b5b4c2-1a3e-4d5f-9e6b-8c7d6e5f4a3b
description: Detects suspicious deserialization activities in Microsoft Exchange logs often associated with CVE-2023-21529 exploitation attempts.
status: experimental
date: 2026/04/27
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: msexchange-management
detection:
    selection:
        EventID: 6 # Or relevant Exchange backend log ID for serialization errors
        Message|contains:
            - 'BinaryFormatter'
            - 'LosFormatter'
            - 'ObjectStateFormatter'
    filter_legit:
        SubjectUserName|contains: 'HealthMailbox'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate Exchange management scripts
level: high
---
title: SmarterMail Auth Bypass and File Upload (CVE-2025-52691 / CVE-2026-23760)
id: e8c6d3e1-2b4f-5e6a-0f7c-9d8e7f6a5b4c
description: Detects web requests to SmarterMail endpoints indicative of authentication bypass or unrestricted file upload exploitation.
status: experimental
date: 2026/04/27
author: Security Arsenal Research
logsource:
    product: webserver
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/WebService/Mail.asmx'
            - '/MailLogin.aspx'
    selection_suspicious:
        cs-method: 'POST'
        sc-status: 200
    condition: selection_uri and selection_suspicious
falsepositives:
    - Legitimate mail client access
level: high
---
title: APT73 Lateral Movement via PsExec and WMI
id: f9d7e4f2-3c5g-6h7b-1g8d-0e9f0a1b2c3d
description: Detects the use of PsExec or WMI for lateral movement, a hallmark of APT73 post-exploitation behavior before encryption.
status: experimental
date: 2026/04/27
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 4688
        NewProcessName|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
    selection_wmi:
        EventID: 4688
        NewProcessName|endswith: '\wmiprvse.exe'
        ParentProcessName|endswith: '\svchost.exe'
    condition: 1 of selection_
falsepositives:
    - Administrative IT management
level: medium

// Hunt for SmarterMail Exploitation and subsequent PowerShell Activity
// Correlates IIS logs with process execution
let SmarterMailEndpoints = dynamic(["/MailLogin.aspx", "/WebService/Mail.asmx", "/grizzlyhandler.ashx"]);
let TimeFrame = 1h;
let IISLogs = imWebEvent
| where TimeGenerated > ago(TimeFrame)
| where csUriStem in (SmarterMailEndpoints) and csMethod == "POST" and scStatus == 200
| project ComputerIP = cIP, TimeGenerated, Url = csUriStem;
let ProcessActivity = DeviceProcessEvents 
| where TimeGenerated > ago(TimeFrame)
| where InitiatingProcessFileName in ("w3wp.exe", "webengine.dll") // Web shell spawning process
| where ProcessCommandLine has "powershell" or ProcessCommandLine has "cmd"
| project DeviceName, TimeGenerated, ProcessCommandLine;
IISLogs
| join kind=inner (ProcessActivity) on $left.ComputerIP == $right.DeviceName
| project TimeGenerated, ComputerIP, Url, ProcessCommandLine

<#
.SYNOPSIS
    APT73 Incident Response Check - Exchange & SmarterMail
.DESCRIPTION
    Checks for indicators of CVE-2023-21529 (Exchange) and suspicious SmarterMail processes.
    Also enumerates scheduled tasks created in the last 7 days (common persistence).
#>

Write-Host "[*] APT73 Rapid Response Check" -ForegroundColor Cyan

# 1. Check Exchange Backend Logs for Deserialization Errors (Last 24h)
Write-Host "\n[+] Checking Exchange Application Logs for Deserialization Events..." -ForegroundColor Yellow
try {
    $events = Get-WinEvent -LogName "MSExchange Management" -ErrorAction SilentlyContinue | 
              Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) -and 
                            $_.Message -match "(BinaryFormatter|LosFormatter|Deserialization)" }
    if ($events) { 
        $events | Select-Object TimeCreated, Id, Message | Format-Table
        Write-Host "[!] SUSPICIOUS ACTIVITY DETECTED in Exchange Logs." -ForegroundColor Red
    } else {
        Write-Host "[-] No suspicious deserialization events found." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Could not access MSExchange Management logs." -ForegroundColor Gray
}

# 2. Check for SmarterMail Web Shell Suspicious Processes
Write-Host "\n[+] Checking for SmarterMail Service Suspicious Children..." -ForegroundColor Yellow
$smarterMailProc = Get-Process -Name "SmarterMail" -ErrorAction SilentlyContinue
if ($smarterMailProc) {
    $children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $smarterMailProc.Id }
    if ($children) {
        Write-Host "[!] SmarterMail spawning unexpected child processes:" -ForegroundColor Red
        $children | Select-Object Name, CommandLine
    }
}

# 3. Check for Scheduled Tasks created in last 7 days (Persistence)
Write-Host "\n[+] Enumerating Scheduled Tasks created/modified in last 7 days..." -ForegroundColor Yellow
$cutoffDate = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { 
    $_.Date -gt $cutoffDate -or 
    (Get-ScheduledTaskInfo $_.TaskName).LastRunTime -gt $cutoffDate 
} | Select-Object TaskName, Date, Author, State

Write-Host "\n[*] Script Complete." -ForegroundColor Cyan


---