BARRACUDA Ransomware Gang: 4 New Victims Posted in 48 Hours — Manufacturing & Healthcare Targeting Analysis with Detection Rules

---
title: BARRACUDA Ransomware - Suspicious Authentication Anomaly on VPN/Edge Gateway
id: 7f3a1c2e-8b41-4e5a-9c1d-barracuda001
status: experimental
description: Detects anomalous successful VPN/IKEv1 authentication from unusual source IPs followed by internal lateral authentication, consistent with edge gateway exploitation (CVE-2026-50751 class) used by BARRACUDA affiliates for initial access.
author: Security Arsenal Threat Intelligence
date: 2026/08/06
references:
    - https://securityarsenal.com/darkside
logsource:
    category: authentication
    product: vpn
detection:
    selection_success:
        event.outcome: success
    selection_suspicious_geo:
        source.ip|cidr:
            - '103.0.0.0/8'
            - '45.0.0.0/8'
            - '185.0.0.0/8'
            - '193.0.0.0/8'
    filter_known_users:
        user.name|contains:
            - 'svc-vpn'
            - 'healthcheck'
    condition: selection_success and selection_suspicious_geo and not filter_known_users
falsepositives:
    - Traveling executives on roaming networks
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
---
title: BARRACUDA Ransomware - PsExec or WMI Remote Service Execution
id: 8a4b2d3f-9c52-4f6b-ad2e-barracuda002
status: experimental
description: Detects remote service creation via PsExec-style named pipes or WMI process call create, a hallmark lateral movement technique used by BARRACUDA affiliates prior to ransomware deployment.
author: Security Arsenal Threat Intelligence
date: 2026/08/06
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PSEXESVC.exe'
            - '\psexec.exe'
            - '\paexec.exe'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    selection_service_install:
        EventID: 7045
        ServiceFileName|contains:
            - 'ADMIN$'
            - '\\127.0.0.1'
            - 'AppData\\Local\\Temp'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative tooling (SCCM, PDQ) - tune by service name and admin host
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
    - attack.t1047
---
title: BARRACUDA Ransomware - Pre-Encryption Data Staging and Shadow Copy Deletion
id: 9b5c3e4a-0d63-4a7c-be3f-barracuda003
status: experimental
description: Detects the canonical pre-detonation sequence observed in BARRACUDA intrusions - mass archive creation (7z/rar) in staging directories combined with Volume Shadow Copy deletion and backup catalog tampering.
author: Security Arsenal Threat Intelligence
date: 2026/08/06
logsource:
    category: process_creation
    product: windows
detection:
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - '-mx'
            - '-hp'
    selection_staging_path:
        CommandLine|contains:
            - '\\ProgramData\\'
            - '\\PerfLogs\\'
            - 'C:\\Temp\\'
            - '\\Users\\Public\\'
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
            - '\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'delete catalog'
            - 'recoveryenabled no'
    condition: (selection_archive and selection_staging_path) or selection_vss
falsepositives:
    - Backup administrators running legitimate archive jobs - allowlist by service account
level: critical
tags:
    - attack.collection
    - attack.t1560.001
    - attack.impact
    - attack.t1490

// BARRACUDA campaign hunt: staging, exfil tooling, and lateral movement chain
// Hunt window: 14 days (covers assessed dwell time)
let Lookback = 14d;
let SuspiciousTools = dynamic(["rclone.exe","megacmd.exe","filezilla.exe","winscp.exe","psexec.exe","psexesvc.exe","7z.exe","rar.exe","nltest.exe","adfind.exe","sharpview.exe","seatbelt.exe"]);
let StagingPaths = dynamic(["\\ProgramData\\","\\PerfLogs\\","\\Users\\Public\\","C:\\Temp\\"]);
// Phase 1: Discovery + staging tool execution on servers
let StagingEvents =
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (SuspiciousTools)
   or (ProcessCommandLine has_any (StagingPaths) and ProcessCommandLine has_any (" a "," -mx"," -hp","zip"))
| project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Phase 2: VSS deletion / backup sabotage on same devices within 72h
let SabotageEvents =
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","delete catalog","recoveryenabled no","wbadmin delete")
| project SabotageTime=TimeGenerated, DeviceName, SabotageCmd=ProcessCommandLine, AccountName;
// Phase 3: correlate — same device, sabotage follows staging (kill chain ordering)
StagingEvents
| join kind=inner SabotageEvents on DeviceName
| where SabotageTime > StagingTime and SabotageTime < StagingTime + 72h
| summarize StagingFirstSeen=min(StagingTime), SabotageFirstSeen=min(SabotageTime),
            Tools=make_set(FileName), Accounts=make_set(AccountName)
  by DeviceName
| extend HoursBetween = datetime_diff("hour", SabotageFirstSeen, StagingFirstSeen)
| sort by SabotageFirstSeen desc;

# BARRACUDA Rapid Triage - run on suspect hosts or via remote session sweep
# Checks: exposed RDP, recent scheduled tasks, shadow copies, suspicious staging dirs, new local admins
$Report = @{}; $now = Get-Date

# 1. RDP exposure and NLA status
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
$Report.RDPEnabled   = ($rdp.fDenyTSConnections -eq 0)
$Report.NLAEnabled   = ($nla.UserAuthentication -eq 1)
$Report.RDPPort      = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber

# 2. Scheduled tasks created in last 7 days (persistence / remote deploy staging)
$Report.RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $now.AddDays(-7) -and
    $_.TaskPath -notlike '\Microsoft*'
} | Select-Object TaskName, TaskPath, Date, @{n='Action';s={$_.Actions.Execute}} | Format-List

# 3. Volume Shadow Copies - ransomware deletes these; absence on a server is a red flag
$Report.ShadowCopies = (Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Measure-Object).Count

# 4. Suspicious staging directories with recent large archives
$Report.StagingFiles = Get-ChildItem 'C:\ProgramData','C:\PerfLogs','C:\Users\Public' -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 50MB -and $_.LastWriteTime -gt $now.AddDays(-7) -and
                   $_.Extension -match '\.(zip|rar|7z|tar|gz)$' } |
    Select-Object FullName, Length, LastWriteTime

# 5. Local admins added in last 14 days
$Report.NewAdmins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    ForEach-Object { $m=$_; Get-LocalUser -Name $m.Name.Split('\')[-1] -ErrorAction SilentlyContinue } |
    Where-Object { $_ -and $_.PasswordLastSet -gt $now.AddDays(-14) } | Select-Object Name, PasswordLastSet

# 6. Recent 7045 service installs (PsExec-style lateral movement artifact)
$Report.NewServices = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$now.AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{n='Service';s={$_.Properties[0].Value}}, @{n='Binary';s={$_.Properties[1].Value}}

$Report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\barracuda_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "[+] Triage complete. Review output JSON in $env:TEMP" -ForegroundColor Green
if (-not $Report.NLAEnabled -and $Report.RDPEnabled) { Write-Warning "[!] RDP exposed WITHOUT NLA - immediate containment action required" }
if ($Report.ShadowCopies -eq 0) { Write-Warning "[!] Zero shadow copies on host - possible pre-detonation sabotage" }