BARRACUDA Ransomware Gang: 3 New Victims Posted — Healthcare & Manufacturing Campaign Analysis with Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-08-24 | Source: ransomware.live dark web monitoring, CISA KEV | Confidence: Moderate-High (victim claims verified on leak site; technical attribution assessed)

Executive Summary

Between 2026-08-23 and 2026-08-24, the BARRACUDA ransomware operation posted three new victims to its dark web leak site, indicating an active double-extortion campaign concentrated against healthcare providers in the United States and manufacturing in South Korea. All three postings occurred within a single 24-hour window — a burst pattern consistent with a wave of intrusions from a common initial access vector, most plausibly edge-device exploitation given the cluster of perimeter CVEs currently listed in CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use.

Organizations operating Check Point Security Gateways, ConnectWise ScreenConnect, or legacy Exchange infrastructure should treat this bulletin as an immediate patch-and-hunt trigger.

1. Threat Actor Profile — BARRACUDA

Analyst note: Do not confuse this leak-site brand with Barracuda Networks (the security vendor). The naming is a common underground tactic to generate search-engine noise and confuse attribution.

2. Current Campaign Analysis

Victims Posted (2026-08-23)

Sector Concentration

• Healthcare: 2 of 3 victims (67%) — and notably small-to-mid specialty providers (periodontics, regional clinical groups), not hospital systems. This is the classic mid-tier RaaS sweet spot: organizations with PHI-rich environments, regulatory breach-notification pressure (HIPAA), cyber-insurance policies, and thin security staffing.
• Manufacturing: 1 of 3 (33%) — a South Korean industrial firm, indicating either an affiliate with KR-language capability or opportunistic access purchased from a broker with APAC coverage.

Geographic Concentration

• US: 67% | South Korea: 33%. The US healthcare targeting aligns with the broader 2025–2026 trend of ransomware groups rotating away from large hospital systems (hardened post-regulatory scrutiny) toward ambulatory and specialty care.

Victim Profile

• Size: Estimated small-to-mid-market. Specialty dental practices typically run 10–50 employees, $2M–$15M revenue. Regional clinical groups: 50–200 employees, $10M–$75M. Mid-size KR industrial manufacturers: 100–500 employees, $20M–$150M revenue.
• Common denominator: Organizations large enough to pay, small enough to lack 24/7 SOC coverage and segmented backups.

Posting Frequency / Escalation Pattern

• 3 victims in 24 hours against a last-100-postings baseline of 3 — this is a 100% burst: the entire recent posting volume landed in a single day. This pattern usually means one of two things:
  1. A freshly activated access pipeline (e.g., a broker dump of VPN/RDP creds or a newly weaponized edge CVE).
  2. Delayed batch disclosure — intrusions from prior weeks posted simultaneously to maximize leak-site visibility.
• Expect additional postings within 7–14 days as negotiations with concurrent victims expire.

Initial Access Vector Assessment (CVE Correlation)

The following CISA KEV entries are confirmed in ransomware use and align with this campaign's profile:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Highest-priority suspect. Edge gateway auth bypass is the single most common access path for healthcare and manufacturing intrusions in 2026. Action: verify patch level on all Check Point gateways immediately.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. Frequently used against MSP-managed SMBs — exactly the IT model most dental practices and regional clinics rely on. A compromised MSP tool = simultaneous access to multiple small healthcare tenants, explaining the same-day multi-victim burst.
• CVE-2026-48027 — Nx Console embedded malicious code (supply chain). Relevant for the manufacturing victim; developer workstation compromise is a documented path into industrial environments.
• CVE-2025-60710 (Windows link following) & CVE-2023-21529 (Exchange deserialization) — privilege escalation and lateral movement stages rather than initial access, but consistent with the post-exploitation chain.

Assessment (moderate confidence): Initial access via edge/RMM exploitation (CVE-2026-50751 or CVE-2024-1708), privilege escalation via CVE-2025-60710, domain pivot, staged exfiltration, then encryption. No evidence of phishing-led access in this specific burst, though it remains in the gang's general repertoire.

3. Detection Engineering

Sigma Rules

---
title: Check Point VPN Gateway Anomalous Authentication Followed by Internal Logon
id: 8f2a41c7-barr-4cud-0001-9e1a2b3c4d01
status: experimental
description: Detects successful edge gateway authentication from rare external IPs followed within 60 minutes by Windows logon from the VPN-assigned address space — consistent with BARRACUDA-style VPN exploitation (CVE-2026-50751) leading directly to internal access.
author: Security Arsenal Threat Intelligence
date: 2026/08/24
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: windows
  service: security
detection:
  selection_logon:
    EventID: 4624
    LogonType: 10
  filter_vpn_range:
    IpAddress|startswith:
      - '10.254.'
      - '172.31.'
  condition: selection_logon and filter_vpn_range
falsepositives:
  - Legitimate remote workers via corporate VPN
level: medium
---
title: PsExec or WMI Remote Service Creation for Ransomware Staging
id: 8f2a41c7-barr-4cud-0002-9e1a2b3c4d02
status: experimental
description: Detects remote service creation and process execution patterns consistent with BARRACUDA lateral movement using PsExec, WMIC, or Cobalt Strike's psexec_psh module to stage encryption binaries across hosts.
author: Security Arsenal Threat Intelligence
date: 2026/08/24
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1047/
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
      - 'PSEXESVC'
      - '%COMSPEC%'
      - 'powershell'
  selection_suspicious_name:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'RemComSvc'
  condition: selection_service or selection_suspicious_name
falsepositives:
  - Legitimate administrative tooling, SCCM, patch management
level: high
---
title: Volume Shadow Copy Deletion Followed by Mass File Rename (Pre-Detonation)
id: 8f2a41c7-barr-4cud-0003-9e1a2b3c4d03
status: experimental
description: Detects vssadmin/wmic shadow copy deletion and backup catalog tampering — the final anti-recovery step in BARRACUDA's playbook executed minutes before encryption detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/24
references:
  - https://attack.mitre.org/techniques/T1490/
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: 1 of selection_*
falsepositives:
  - Storage administrators resizing shadow storage
level: critical

KQL — Microsoft Sentinel Hunt Query

Hunt for the pre-encryption staging chain associated with this campaign: edge logon → discovery → lateral movement tooling → shadow copy deletion → outbound bulk transfer.

// BARRACUDA pre-ransomware staging hunt — 7-day lookback
// Correlate: admin share staging, discovery commands, VSS tampering, large egress
let lookback = 7d;
let DiscoveryCmds = dynamic(["nltest /dclist", "net group \"domain admins\"", "net localgroup administrators", "adfind", "bloodhound", "sharphound", "arp -a"]);
let Staging =
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where ProcessCommandLine has_any (DiscoveryCmds)
   or (FileName =~ "rclone.exe" or ProcessCommandLine has_any ("rclone copy", "mega.nz", "--transfers"))
| project StagingTime = TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let VSSTamper =
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "recoveryenabled no", "delete catalog")
| project VSSTime = TimeGenerated, DeviceName, VSSCmd = ProcessCommandLine, AccountName;
let RemoteExec =
DeviceEvents
| where TimeGenerated > ago(lookback)
| where ActionType == "ServiceInstalled"
| extend Parsed = parse_json(AdditionalFields)
| where tostring(Parsed.ServiceName) has_any ("PSEXESVC", "RemComSvc")
   or tostring(Parsed.ServiceName) matches regex @"^[A-Za-z0-9]{6,10}$"
| project RemoteTime = TimeGenerated, DeviceName, ServiceName = tostring(Parsed.ServiceName);
Staging
| join kind=inner VSSTamper on DeviceName, AccountName
| join kind=leftouter RemoteExec on DeviceName
| extend ChainWindowMinutes = datetime_diff("minute", VSSTime, StagingTime)
| summarize FirstSeen = min(StagingTime), VSSTamperTime = min(VSSTime), CmdCount = dcount(ProcessCommandLine)
  by DeviceName, AccountName, ServiceName
| order by FirstSeen asc

Rapid Response — PowerShell Exposure & Staging Audit

Run on domain controllers and suspected patient-zero hosts. Checks RDP exposure, recent scheduled tasks, shadow copy integrity, and suspicious services created in the last 7 days.

# BARRACUDA Rapid Triage — run elevated, ~60 seconds per host
$cutoff = (Get-Date).AddDays(-7)
$report = [ordered]@{}

# 1. Is RDP exposed/enabled?
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$report['RDP_Enabled'] = ($rdp.fDenyTSConnections -eq 0)
$report['NLA_Enforced'] = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication -eq 1

# 2. Scheduled tasks created in last 7 days (ransomware persistence/staging)
$report['RecentTasks'] = Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute + ' ' + $_.Actions.Arguments}}

# 3. Services installed in last 7 days (PsExec/CS service staging)
$report['RecentServices'] = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='Path';E={$_.Properties[1].Value}}

# 4. Shadow copy integrity — empty result = possible deletion
$report['ShadowCopies'] = (Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Measure-Object).Count

# 5. Failed logon burst (brute force indicator)
$report['FailedLogons24h'] = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Measure-Object).Count

# 6. Suspicious staging dirs
$report['StagingDirs'] = @('C:\ProgramData','C:\Windows\Temp','C:\Users\Public') | ForEach-Object {
    Get-ChildItem $_ -Recurse -Depth 1 -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 100MB }
}

$report.GetEnumerator() | ForEach-Object { Write-Host "`n=== $($_.Key) ===" -ForegroundColor Cyan; $_.Value | Format-List }
if ($report.ShadowCopies -eq 0) { Write-Host "`n[CRITICAL] No shadow copies present — possible pre-encryption tampering" -ForegroundColor Red }
if ($report.FailedLogons24h -gt 500) { Write-Host "[WARN] Elevated failed logons — investigate brute force / password spray" -ForegroundColor Yellow }

4. Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

Watch for this sequence — BARRACUDA-style operations typically follow it in order:

1. Edge anomaly: New VPN/RMM session from an IP with no prior history, especially outside business hours.
2. Discovery burst: nltest, net group "domain admins", adfind/SharpHound execution within 2h of first internal logon.
3. Credential access: LSASS memory access alerts, DCSync (directory replication from non-DC hosts), NTDS.dit staging.
4. Lateral spread: PsExec service creation (7045 events), ADMIN$ writes to multiple hosts in <30 min, RDP sessions server-to-server.
5. Exfil staging: Rclone/MEGA/7-Zip execution, large archives in ProgramData or Users\Public, egress spike to consumer cloud storage (>5 GB/hr from a single host is a strong signal).
6. Anti-recovery (last step): vssadmin delete shadows, bcdedit recoveryenabled no, backup catalog deletion. If you see step 6, you have minutes, not hours.

Critical Assets This Campaign Type Prioritizes for Exfiltration

• Healthcare victims: EHR databases and exports, patient billing records, insurance claims data, HR files (SSNs), and anything triggering HIPAA breach-notification obligations — the notification cost itself is the extortion leverage.
• Manufacturing victims: Engineering drawings/CAD files, ERP exports, customer contracts, and OT-adjacent documentation (network diagrams of plant floors are high-value for both extortion and resale).

Containment Actions — Ordered by Urgency

1. Isolate at the edge first: Disable the compromised VPN account/gateway path and block the source IP. Do NOT shut down hosts yet — you need volatile memory for scoping.
2. Kill lateral movement: Disable the compromised account(s) enterprise-wide, force KRBTGT reset (twice) if DCSync is suspected, and block PsExec/SMB service creation via GPO or host firewall on non-admin workstations.
3. Cut exfiltration: Block consumer file-sharing domains (mega.nz, *.rclone endpoints, temp-share services) at the proxy/DNS layer; rate-limit egress per host.
4. Protect backups: Take backup infrastructure offline from the network (not powered off — isolated). Verify at least one immutable/offline copy predates the earliest intrusion indicator.
5. Then isolate hosts: Network-isolate confirmed compromised endpoints. Preserve memory captures on the suspected patient-zero system.
6. Engage IR retainer and counsel before any negotiation contact; check OFAC exposure on any payment discussion.

5. Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateways for CVE-2026-50751 or disable IKEv1 where operationally feasible. If unpatched, assume compromise and hunt retroactively.
• Patch/upgrade ConnectWise ScreenConnect (CVE-2024-1708) — and if you are MSP-managed, demand written confirmation from your provider. This campaign's SMB healthcare victims almost certainly depend on third-party IT.
• Disable RDP from the internet entirely; enforce VPN + MFA for all remote access. Audit 4625/4624 events for brute-force bursts.
• Block PsExec-style service creation on workstations via AppLocker/WDAC or host firewall rules (deny inbound 445 except from designated admin jump hosts).
• Verify shadow copies exist and backups are immutable on all file servers and EHR/database hosts today.
• Deploy the Sigma rules and KQL query above to your SIEM; the VSS-deletion rule should page the on-call responder, not generate a ticket.

Short-Term (2 Weeks)

• Network segmentation: Separate clinical/OT VLANs from corporate IT with deny-by-default east-west rules; healthcare victims in this campaign profile lack internal segmentation, which is why a single VPN foothold becomes a full-domain encryption event.
• Tiered administration with dedicated privileged access workstations — eliminates the credential theft → domain admin path in most mid-tier ransomware intrusions.
• Egress filtering architecture: Default-deny outbound, explicit allow-lists for business SaaS, alerting on any new destination ASN transferring >1 GB/day.
• Deception: Canary credentials and decoy file shares with EHR-like naming (Patient_Records_2026.xlsx) that trigger immediate isolation on access — catches the exfil phase before encryption.
• Tabletop the HIPAA notification clock: For covered entities, rehearse the 60-day breach-notification workflow against a 72-hour ransomware reality. Speed of disclosure decisions materially affects regulatory outcome.
• MSA/vendor risk review: Enumerate every third party with remote access tooling into your environment and require KEV-patch SLAs in contracts.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub