BLACKWATER Ransomware Gang: 2 New Victims Posted on Leak Site — India & Argentina Targeting Analysis with Detection Rules

---
title: BLACKWATER RaaS - RMM Tool Execution and VPN Post-Exploitation Process Anomalies
id: 8f3c1a2e-bw01-4a11-9c22-11aa22bb33cc
status: experimental
description: Detects execution of abused RMM binaries (ScreenConnect, AnyDesk) and suspicious child processes of VPN/edge service accounts consistent with BLACKWATER affiliate initial access (CVE-2026-50751, CVE-2024-1708).
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\AnyDesk.exe'
      - '\winwork.exe'
  filter_rmm_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
  selection_vpn_child:
    ParentImage|contains:
      - 'cpwd'
      - 'fw1'
      - 'slapd'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_suspicious_children:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\AnyDesk.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
  condition: selection_suspicious_children or (selection_vpn_child and not 1 of filter_rmm_parent*)
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
  - ParentCommandLine
falsepositives:
  - Legitimate RMM administration by internal IT
level: high
tags:
  - attack.initial-access
  - attack.t1133
  - attack.t1190
  - attack.t1219
---
title: BLACKWATER RaaS - Lateral Movement via PsExec WMI and Encoded PowerShell
id: 8f3c1a2e-bw02-4b22-8d33-22bb33cc44dd
status: experimental
description: Detects PsExec-style service execution, remote WMI process creation, and encoded/obfuscated PowerShell consistent with BLACKWATER affiliate lateral movement and Cobalt Strike beacon staging.
author: Security Arsenal Threat Intelligence
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\PsExec.exe'
      - '\PsExec64.exe'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_encoded_ps:
    CommandLine|contains:
      - ' -enc '
      - ' -e '
      - 'FromBase64String'
      - 'IEX('
      - 'DownloadString'
      - 'bypass'
  selection_beacon_artifacts:
    CommandLine|contains:
      - 'rundll32.exe '
    CommandLine|endswith:
      - ',Start'
      - '#1'
  condition: selection_psexec or selection_wmi_remote or selection_encoded_ps or selection_beacon_artifacts
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
  - Computer
falsepositives:
  - Administrative PsExec use; SCCM and management tooling spawning from WmiPrvSE
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1027
  - attack.t1059.001
---
title: BLACKWATER RaaS - Pre-Encryption Staging Shadow Copy Deletion and Bulk Archive Creation
id: 8f3c1a2e-bw03-4c33-7e44-33cc44dd55ee
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and mass archive/exfil staging (rar/7z with password flags) that precede BLACKWATER encryption detonation and leak-site extortion.
author: Security Arsenal Threat Intelligence
date: 2026/08/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
      - 'wbadmin delete systemstatebackup'
  selection_bcdedit_recovery:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -hp'
      - ' -m5'
      - ' -v'
  condition: selection_vss or selection_bcdedit_recovery or selection_staging
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate backup maintenance; software packaging with 7-Zip
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1567

let Lookback = 14d;
let StagingWindow = 1h;
let SuspiciousStaging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "wbadmin delete catalog", "shadowcopy delete", "recoveryenabled no", "bootstatuspolicy ignoreallfailures")
       or (FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe") and ProcessCommandLine has_any (" -p", " -hp", " -v"))
    | project StagingTime=Timestamp, DeviceId, DeviceName, StagingAccount=AccountName, StagingCmd=ProcessCommandLine, StagingImage=FileName;
let RMMExecution =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName has_any ("ScreenConnect", "AnyDesk", "winwork.exe")
       or InitiatingProcessFileName has_any ("ScreenConnect", "AnyDesk")
    | project RMMTime=Timestamp, DeviceId, RMMImage=FileName, RMMChild=ProcessCommandLine;
let MassRead =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where ActionType == "FileCreated" and FolderPath has_any ("\\staging\\", "\\temp\\", "\\perflogs\\")
    | where FileName endswith_any (".zip", ".rar", ".7z", ".gz")
    | summarize ArchiveCount=count(), Archives=make_set(FileName, 20) by DeviceId, bin(Timestamp, StagingWindow)
    | where ArchiveCount >= 3;
let Outbound =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteIPType == "Public"
    | summarize BytesSent=sum(tolong(parse_json(AdditionalFields).bytes_sent)), RemoteIPs=make_set(RemoteIP, 25) by DeviceId, bin(Timestamp, StagingWindow)
    | where BytesSent > 500000000;
SuspiciousStaging
| join kind=inner MassRead on DeviceId
| join kind=leftouter Outbound on DeviceId
| join kind=leftouter RMMExecution on DeviceId
| project DeviceName, StagingTime, StagingAccount, StagingCmd, ArchiveCount, Archives, BytesSent, RemoteIPs, RMMImage
| order by StagingTime desc;

#Requires -RunAsAdministrator
# Security Arsenal - BLACKWATER Pre-Detonation Triage Script (2026-08-17)
$Report = @(); $Cutoff = (Get-Date).AddDays(-7)

# 1. RDP exposure check
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$Report += [pscustomobject]@{Check='RDP Enabled'; Result=($rdp.fDenyTSConnections -eq 0); Detail="NLA=$($nla.UserAuthentication) (must be 1)"}
$Report += [pscustomobject]@{Check='RDP Listening Port'; Result=($null -ne (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue)); Detail='Block 3389 at perimeter; require VPN' }

# 2. Scheduled tasks created in last 7 days (persistence / lateral movement)
Get-ScheduledTask | ForEach-Object {
    $i = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Date -and ([datetime]$_.Date) -gt $Cutoff) {
        $Report += [pscustomobject]@{Check='New Scheduled Task (7d)'; Result=$true; Detail="$($_.TaskName) | $($_.TaskPath) | Created=$($_.Date)"}
    }
}

# 3. Volume Shadow Copy integrity
$shadows = (vssadmin list shadows 2>$null)
$Report += [pscustomobject]@{Check='Shadow Copies Present'; Result=($shadows -match 'Shadow Copy Volume'); Detail=($shadows | Select-String 'creation time' | Out-String).Trim()}

# 4. RMM tool artifacts (BLACKWATER initial access tooling)
$rmmPaths = @("$env:ProgramFiles\ScreenConnect*", "$env:ProgramFiles (x86)\ScreenConnect*", "$env:ProgramData\AnyDesk", "$env:AppData\AnyDesk")
foreach ($p in $rmmPaths) { if (Test-Path $p) { $Report += [pscustomobject]@{Check='RMM Artifact Found'; Result=$true; Detail=$p } } }

# 5. Recent suspicious service installs (PsExec-style)
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'ADMIN\$|PSEXESVC|\\Temp\\|\\Perflogs\\' } |
  ForEach-Object { $Report += [pscustomobject]@{Check='Suspicious Service'; Result=$true; Detail="$($_.Name): $($_.PathName)"} }

$Report | Format-Table -AutoSize | Out-String -Width 300 | Tee-Object -FilePath "C:\Windows\Temp\BW_triage_$(hostname)_$(Get-Date -f yyyyMMdd_HHmm).txt"
Write-Host '[*] Triage complete. Any Result=True on RMM/Suspicious Service/New Task warrants host isolation.' -ForegroundColor Yellow