BAVACAI Ransomware: Global Surge Targets Education & Business Services via Edge Exploits

Operational Model: BAVACAI operates as a Ransomware-as-a-Service (RaaS) entity, likely utilizing a sophisticated affiliate network to distribute payloads. While relatively quiet previously, their recent surge indicates a highly active deployment phase.

Ransom Demands: Historically varied, typically ranging from $500,000 to $5 million USD depending on victim revenue. They employ standard double-extortion tactics: encrypting critical systems while threatening to leak sensitive PII and corporate documents.

Initial Access Vectors: Based on recent victimology and associated CVEs, BAVACAI affiliates heavily favor Internet-Facing Vulnerability Exploitation. They are actively leveraging unpatched edge infrastructure, specifically targeting email gateways (Exchange, SmarterMail) and firewall management centers. Phishing remains a secondary vector but is less prevalent in this specific campaign.

TTPs Overview:

Dwell Time: Short (2–5 days). Recent postings indicate rapid exploitation and encryption.
Lateral Movement: Utilization of Cobalt Strike beacons and SMB tools (PsExec, WMI) for internal propagation.
Data Exfiltration: Uses RClone and WinSCP to stage data before encryption, often targeting cloud storage buckets and local file servers.

Current Campaign Analysis

Campaign Dates: Observed escalation beginning late April 2026, with a massive dump of 15 victims on May 5, 2026.

Targeted Sectors: The current campaign is characterized by a distinct lack of vertical specialization, indicating a "spray and pray" vulnerability exploitation approach. However, Education (20%) and Business Services (20%) are the hardest hit sectors.

Education: Desert Christian Schools (US), Académie de Montpellier (FR), Colegio María Inmaculada (CR).
Business Services: Strategic Imports (AU), SIT Group (IT), CourtSmart (US).

Geographic Concentration: BAVACAI has demonstrated global reach. The primary hotspots are the Americas (US, BR) and Europe (GB, FR). Notably, Brazil appears twice in this batch (Bandeirante Supermercados, CEAGESP), suggesting a dedicated focus on Latin American infrastructure.

Victim Profile: Victims range from mid-market businesses (e.g., Atencio Engineering) to large-scale critical infrastructure/logistics providers (e.g., CEAGESP). Revenue estimates suggest a target range of $10M - $500M USD.

CVE Correlation: The campaign correlates directly with the exploitation of three critical CISA KEV-listed vulnerabilities:

Microsoft Exchange (CVE-2023-21529): Allows authenticated attackers to run code; likely used where credentials were harvested or weak passwords existed.
SmarterMail (CVE-2025-52691 & CVE-2026-23760): The combination of unrestricted file upload and authentication bypass is a "god-mode" exploit for email servers. This is the likely primary vector for the Education and Business Services victims.
Cisco FMC (CVE-2026-20131): Deserialization flaws in firewall management centers allow attackers to pivot from the network edge directly into the management plane, bypassing perimeter defenses.

Detection Engineering

The following detection logic targets the specific CVEs and TTPs associated with the BAVACAI May 2026 campaign.

YAML

title: Potential Exploit SmarterMail File Upload Vulnerability
id: 4f2a9b1c-7d8e-4a3f-9b5c-2d3e4f5a6b7c
description: Detects potential exploitation of CVE-2025-52691 in SmarterMail via suspicious file extensions in web directories.
status: experimental
date: 2026/05/08
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - 'C:\\Program Files (x86)\\SmarterTools\\SmarterMail\\'
        TargetFilename|endswith:
            - '.aspx'
            - '.ashx'
            - '.asp'
    condition: selection
falsepositives:
    - Legitimate administrative file uploads
level: high
tags:
    - attack.initial_access
    - cve.2025.52691
    - ransomware.bavacai
---
title: Microsoft Exchange Deserialization Exploit Attempt
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects suspicious process execution patterns associated with CVE-2023-21529 Exchange deserialization exploitation.
status: experimental
date: 2026/05/08
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\w3wp.exe'
            - '\\Microsoft.Exchange.Directory.TopologyService.exe'
    selection_child:
        Image|endswith:
            - '\\powershell.exe'
            - '\\cmd.exe'
            - '\\whoami.exe'
    condition: all of selection*
falsepositives:
    - Administrative maintenance
level: critical
tags:
    - attack.initial_access
    - cve.2023.21529
    - ransomware.bavacai
---
title: BAVACAI Lateral Movement Pattern PsExec SMB
id: 9e8d7c6b-5a4f-3e2d-1c0b-9a8f7e6d5c4b
description: Detects known BAVACAI lateral movement using PsExec or similar administrative tools across the network.
status: experimental
date: 2026/05/08
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection_tool:
        Image|endswith:
            - '\\psexec.exe'
            - '\\psexec64.exe'
    selection_cli:
        CommandLine|contains:
            - '\\192.168.'
            - '\\10.0.'
            - '\\accepteula'
    condition: all of selection*
falsepositives:
    - Legitimate IT administration
level: high
tags:
    - attack.lateral_movement
    - attack.execution
    - ransomware.bavacai


**KQL (Microsoft Sentinel) - Pre-Encryption Staging Hunt**
kql
// Hunt for rapid file modifications and mass encryption precursors
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated" or ActionType == "FileModified"
| where FileName endswith ".locked" or FileName endswith ".bavacai" or FileName endswith ".enc"
| summarize count() by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where count_ > 50 // Threshold for mass modification
| extend AlertMessage = "Potential Ransomware Encryption Activity Detected"


**PowerShell - Rapid Response Hardening**
powershell
<#
.SYNOPSIS
    Emergency Audit for BAVACAI Indicators of Compromise
.DESCRIPTION
    Checks for recent shadow copy deletions (vssadmin), unusual scheduled tasks, 
    and processes associated with the SmarterMail CVEs.
#>

Write-Host "[+] Checking for VSS Shadow Copy Deletions (Last 24h)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4663; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -like '*vssadmin*' -or $_.Message -like '*delete shadows*'} |
Select-Object TimeCreated, Id, Message

Write-Host "[+] Checking for Scheduled Tasks created in last 48h..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-2)} | 
Select-Object TaskName, Date, Author, Action

Write-Host "[!] Checking SmarterMail Installation Path..." -ForegroundColor Cyan
$path = "C:\Program Files (x86)\SmarterTools\SmarterMail"
if (Test-Path $path) {
    Write-Host "[WARNING] SmarterMail detected. Reviewing recent file modifications in MRS directory." -ForegroundColor Red
    Get-ChildItem -Path "$path\MRS" -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} |
    Select-Object FullName, LastWriteTime, Length
} else {
    Write-Host "[INFO] SmarterMail not found on default path." -ForegroundColor Green
}


---

Incident Response Priorities

T-Minus Detection Checklist:

Edge Compromise: Immediate forensic review of Exchange and SmarterMail IIS logs for the last 30 days. Look for POST requests to anomalous endpoints.
FMC Audits: Review Cisco Secure Firewall Management Center logs for unauthorized configuration changes or odd user sessions correlating to CVE-2026-20131.
Process Anomalies: Hunt for w3wp.exe spawning cmd.exe or powershell.exe (deserialization exploit signature).

Critical Assets Prioritized for Exfiltration:

HR databases (Employee PII)
Student/Client Records
Financial Systems (Accounts Payable/Receivable)
Intellectual Property (Engineering designs)

Containment Actions (Urgency: High):

Isolate: Disconnect Exchange servers, SmarterMail gateways, and Cisco FMC appliances from the network immediately.
Credential Reset: Force reset of all admin credentials for email systems and firewall management consoles.
Block: Block inbound internet access to /MRS/ paths on SmarterMail servers at the perimeter firewall until patched.

Hardening Recommendations

Immediate (24 Hours):

Patch: Apply patches for CVE-2025-52691, CVE-2026-23760, and CVE-2023-21529 immediately. If patching is impossible, disable the vulnerable services (e.g., block external access to OWA/ECP or SmarterMail web interfaces).
MFA Enforcement: Enforce strict MFA on all VPN and remote access portals; disable legacy authentication protocols on Exchange.

Short-term (2 Weeks):

Network Segmentation: Move email servers and firewall management interfaces to a dedicated VLAN with strict egress rules.
EDR Coverage: Ensure EDR sensors are deployed on all internet-facing boundary devices and servers, not just employee workstations.
Vulnerability Management: Initiate a scan specifically for CISA KEV-listed vulnerabilities targeting deserialization flaws in enterprise software.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub