BLACKOUT Ransomware: Global Tech Sector Assault & Critical Infrastructure CVEs

Security Arsenal is tracking a resurgence in activity from the BLACKOUT ransomware operation. As of July 19, 2026, the group has posted three new victims, predominantly targeting the Technology sector in Japan, the United States, and the United Kingdom. This campaign is characterized by the aggressive exploitation of vulnerabilities in perimeter security and remote management tools, specifically targeting Check Point Security Gateways and ConnectWise ScreenConnect instances.

Intelligence suggests BLACKOUT is actively leveraging recently added CISA Known Exploited Vulnerabilities (KEV) to bypass perimeter defenses, indicating a shift toward "initial-access-as-a-service" methodologies or highly skilled vulnerability scanning.

Threat Actor Profile — BLACKOUT

Aliases: None confirmed (previously unaffiliated independent operators).
Operational Model: Closed-group operation ( suspected RaaS affiliation due to heterogeneous tooling).
Typical Ransom Demands: Variable, ranging from $500k to $5M USD, largely dependent on victim revenue.
Initial Access Vectors: Primary reliance on external remote services exploitation (CVE-2024-1708, CVE-2026-50751). Secondary vectors include phishing campaigns delivering malicious loaders.
Extortion Strategy: Double extortion. Exfiltration of sensitive data (source code, client databases) occurs 24-48 hours prior to encryption. Leak site pressure is high.
Dwell Time: Short. Analysis indicates an average of 3-5 days from initial breach to detonation.

Current Campaign Analysis

Targeting Sectors

The latest posting streak (3 victims) reveals a concentrated focus on the Technology sector (2/3 victims). The third victim (Bluebell Group) remains categorized as "Not Found" but likely falls under professional services or retail based on naming conventions, which often overlap with tech supply chains.

Geographic Concentration

Japan (JP): 1 Victim (yano.tokyo)
United States (US): 1 Victim (www.miatech.net)
United Kingdom (GB): 1 Victim (bluebellgroup.com)

This tri-national spread suggests BLACKOUT is scanning for vulnerable internet-facing assets globally rather than regional targeting.

Victim Profile

Based on the disclosed domains:

Yano Tokyo: Likely a mid-sized enterprise ($10M-$50M revenue).
MiaTech: Appears to be a managed service provider or software vendor.
Bluebell Group: Likely a mid-to-large retail/distribution entity.

Observed Posting Frequency

The group posted all three victims on 2026-07-19. This "bulk posting" behavior is typical of groups who automate their leak site updates or who conduct raids breaching multiple victims simultaneously via a supply chain or a specific exploit toolkit.

CVE Correlation

There is a high-confidence correlation between BLACKOUT's activity and the following CISA KEVs:

CVE-2024-1708 (ConnectWise ScreenConnect): This is the most likely primary vector for the Technology sector victims. Tech firms and MSPs heavily utilize ScreenConnect for remote support.
CVE-2026-50751 (Check Point Security Gateway): Used to bypass perimeter VPNs, allowing attackers to establish persistent tunnels without valid MFA credentials.
CVE-2026-20131 (Cisco Secure Firewall FMC): Exploitation of firewall management interfaces indicates an attempt to disable logging or alter rules to hide exfiltration traffic.

Detection Engineering

Sigma Rules

YAML

---
title: Potential ScreenConnect Authentication Bypass
id: 2c8729bf-a447-4b2c-8a2a-123456789abc
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect via suspicious web request patterns
status: experimental
date: 2026/07/19
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Bin/ScreenConnect.'
            - 'Host='
            - 'SessionId'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: critical

tags:
    - cve.2024.1708
    - initial.access
    - ransomware
    - blackout

---
title: Check Point IKEv1 Anomalous Authentication
id: 5f1d4e8c-b3a9-4d5e-9a1b-9876543210dc
description: Detects potential exploitation of CVE-2026-50751 via IKEv1 key exchange anomalies or excessive failures followed by success
status: experimental
date: 2026/07/19
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
logsource:
    product: checkpoint
    service: vpn
detection:
    selectionIKE:
        ike_suite|contains: 'ike-v1'
    filter_legit:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selectionIKE and not filter_legit
falsepositives:
    - Legacy VPN configuration usage
level: high
tags:
    - cve.2026.50751
    - initial.access
    - vpn
    - blackout

---
title: Ransomware Prep - Volume Shadow Copy Deletion
id: 9e8f7d6c-5e4d-3c2b-1a09-8765432109fe
description: Detects commands used to delete Volume Shadow Copies, a common precursor to encryption by BLACKOUT and similar groups
status: experimental
date: 2026/07/19
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    condition: 1 of selection_
falsepositives:
    - System administration scripts
level: critical
tags:
    - impact
    - defense.evasion
    - ransomware
    - t1490

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for lateral movement and data staging patterns associated with BLACKOUT
// Looks for large file movements to hidden shares and PsExec usage
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where (FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe") or 
         ProcessCommandLine has "\\\\" and ProcessCommandLine has "copy" and ProcessCommandLine matches regex @"\\.(zip|rar|7z|tar|sql|bak|mdb)\s*$")
| extend FileName = tostring(split(FileName, '\\')[-1])
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

PowerShell Response Script

PowerShell

<#
.SYNOPSIS
    Rapid Response Hardening Script - BLACKOUT Campaign
.DESCRIPTION
    Checks for recent suspicious scheduled tasks (persistence) and enumerates exposed RDP sessions.
#>

Write-Host "[*] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Cyan

$CutoffDate = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {
    $_.Date -gt $CutoffDate
} | ForEach-Object {
    $TaskInfo = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{
        TaskName = $_.TaskName
        TaskPath = $_.TaskPath
        LastRunTime = $TaskInfo.LastRunTime
        Author = $_.Author
        State = $_.State
    }
} | Format-Table -AutoSize

Write-Host "[*] Querying Recent RDP Connections (Event ID 4624, Type 10)..." -ForegroundColor Cyan

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=$CutoffDate} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -match 'Logon Type:\s*10'} |
Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='SourceIP';e={$_.Properties[18].Value}} |
Format-Table -AutoSize

Write-Host "[+] Script Complete. Review output for anomalies." -ForegroundColor Green


---

Incident Response Priorities

T-minus Detection Checklist (Pre-Encryption)

ScreenConnect Logs: Audit WebService.log and Gateway.log for requests containing ../ or anomalous session creation patterns around July 15-19, 2026.
Firewall Logs: Check Check Point/Cisco FMC logs for unauthorized administrator logins or changes to rule bases.
Remote Access: Identify any RDP or VPN sessions originating from unusual geolocations or non-corporate assets.

Critical Assets for Exfiltration

BLACKOUT prioritizes:

Source code repositories (Git, SVN).
Customer PII/CRM databases.
Intellectual Property (CAD files, proprietary schematics).

Containment Actions (Order of Urgency)

Immediate: Isolate affected systems from the network; disable internet access for ScreenConnect and VPN gateways.
High: Revoke all local administrator credentials and force password resets for domain admins.
Medium: Suspend or shutdown vulnerable appliances (Check Point VPNs < patched version, Cisco FMC < patched version) until updates are applied.

Hardening Recommendations

Immediate (24 Hours)

Patch CVE-2024-1708: Update ConnectWise ScreenConnect to the latest patched version immediately. If patching is delayed, enforce MFA on all access paths and block access from the internet via firewall.
Patch CVE-2026-50751: Apply Check Point hotfixes for IKEv1 authentication. Disable IKEv1 if not strictly required for legacy compatibility.
Network Segmentation: Ensure management interfaces (FMC, ScreenConnect) are not accessible from the public internet without a VPN jump host.

Short-term (2 Weeks)

Implement Zero Trust Network Access (ZTNA): Replace traditional VPN access with ZTNA to minimize lateral movement risks.
Audit External Attack Surface: Conduct a scan for all instances of ScreenConnect, RDP, and management panels exposed to the internet.
EDR Expansion: Deploy EDR sensors to management servers and backup appliances to detect process anomalies.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub