Aliases: None publicly confirmed / Independent operation. Model: Private RaaS or closed-group operation. Victim volume suggests high selectivity or manual targeting rather than mass automation. Ransom Demands: Estimated $2M - $5M USD based on target verticals (Manufacturing/Technology). Initial Access: Focuses on perimeter network devices (Check Point, Cisco FMC) and remote management software (ConnectWise ScreenConnect). Phishing is not a primary vector for this group. Double Extortion: Standard practice. Victims' data is posted to a dedicated leak site if ransom negotiations fail or are ignored. Dwell Time: Short (3-7 days). The group appears to move quickly from initial access via CVE exploitation to data staging and encryption.
Current Campaign Analysis
Sectors: Manufacturing, Technology. Geographic Concentration: United States. Victim Profile: Mid-to-large enterprises. Recent victims (Oklahoma Manufacturing Alliance, Incredible Technologies) indicate a focus on organizations with high-value intellectual property and complex supply chain dependencies. Observed Posting Frequency: Low frequency (2 recent victims) with simultaneous postings, suggesting a batch-processing approach to operations. CVE Connection: The group is actively exploiting CVE-2026-50751 (Check Point Security Gateway) to bypass perimeter defenses. Access is likely followed by CVE-2024-1708 (ConnectWise ScreenConnect) exploitation for lateral movement within the internal network.
Detection Engineering
Sigma Rules
---
title: Potential Check Point IKEv1 Exploitation (CVE-2026-50751)
id: 8f6e5d4c-3b2a-1a09-9876-543210fedcba
status: experimental
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies or excessive authentication failures on Check Point Gateways.
author: Security Arsenal
date: 2026/07/29
logsource:
product: firewall
service: check_point
detection:
selection:
service: 'ike'
action|contains: 'log'
details|contains: 'encryption_failure' or 'authentication_failed'
condition: selection | count() by src_ip > 50
level: high
tags:
- attack.initial_access
- cve.2026.50751
---
title: ConnectWise ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: 1a2b3c4d-5e6f-7890-1234-567890abcdef
status: experimental
description: Detects web requests indicative of the ScreenConnect path traversal vulnerability.
author: Security Arsenal
date: 2026/07/29
logsource:
category: webserver
detection:
selection:
c-uri|contains: '/Guest/'
cs-uri-query|contains:
- '..%2f'
- '%2e%2e'
- '%5c%2e%2e'
condition: selection
level: critical
tags:
- attack.initial_access
- attack.execution
- cve.2024.1708
---
title: Ransomware Data Staging via 7-Zip
id: 9a8b7c6d-5e4f-3a2b-1c0d-9876543210ab
status: experimental
description: Detects use of 7-Zip for archiving large volumes of data, a common precursor to exfiltration by BOOBA PROJECT.
author: Security Arsenal
date: 2026/07/29
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\\7z.exe'
CommandLine|contains: ' -a'
filter:
User|contains: 'Administrators' # Adjust based on environment
condition: selection
level: medium
tags:
- attack.exfiltration
- attack.collection
**KQL (Microsoft Sentinel)**
kql
// Hunt for ScreenConnect anomalies and lateral movement
DeviceProcessEvents
| where Timestamp >= ago(1d)
| where ProcessVersionInfoCompanyName contains 'ConnectWise'
and (ProcessCommandLine contains 'powershell' or ProcessCommandLine contains 'cmd')
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| union
DeviceNetworkEvents
| where RemotePort == 3389 and ActionType == 'InboundAllowed'
| summarize Count() by DeviceName, RemoteIP
**PowerShell Response Script**
powershell
Write-Host "Checking for Persistence and Exposure..." -ForegroundColor Cyan
# 1. Check for abnormal RDP connections
Write-Host "Recent RDP Logons (Last 24h):" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -match "Logon Type:\s+10"} | Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='IP';e={$_.Properties[19].Value}}
# 2. Check for recent Scheduled Tasks (Persistence)
Write-Host "Scheduled Tasks Modified in Last 7 Days:" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, Date, Author
# 3. Check for VSS Shadow Copy Deletions
Write-Host "VSS Deletion Events (Last 24h):" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -like '*stopped*'} | Select-Object TimeCreated, Message | Format-List
Incident Response Priorities
T-Minus Checklist:
- Verify patch status for CVE-2026-50751 on all Check Point gateways immediately.
- Search web server logs for ScreenConnect requests matching path traversal patterns (CVE-2024-1708).
- Identify any unusual archive processes (WinRAR, 7-Zip) running on file servers.
Critical Assets:
- PII and HR databases.
- Intellectual Property/CAD files (Manufacturing).
- Financial systems and accounting data.
Containment:
- Disconnect VPN/Edge devices if compromise is suspected.
- Segment the management plane for ScreenConnect servers.
- Reset credentials for accounts active during the suspected dwell window.
Hardening Recommendations
Immediate (24h):
- Patch CVE-2026-50751 (Check Point) and CVE-2024-1708 (ScreenConnect) immediately.
- Disable IKEv1 where possible or restrict source IP ranges for VPN connections.
- Enforce Multi-Factor Authentication (MFA) on all remote access points.
Short-term (2 weeks):
- Implement Zero Trust Network Access (ZTNA) for administrative interfaces.
- Conduct an external attack surface assessment for edge firewall vulnerabilities.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.