CHAOS Ransomware: 4-Victim Surge in North America — Firewall & RMM Exploitation

title: Potential CHAOS Ransomware ScreenConnect Exploitation
id: 6a1b2c3d-4e5f-6789-0123-456789abcdef
description: Detects potential exploitation of ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) often used by CHAOS for initial access.
status: experimental
date: 2026/07/09
author: Security Arsenal Research
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/SetupWizard.aspx'
            - '/Host//'
            - '../'
    condition: selection
falsepositives:
    - Legitimate administrative misconfiguration
level: high
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.chaos
---
title: Check Point VPN IKEv1 Anomalous Authentication
id: 7b2c3d4e-5f6a-7890-1234-567890abcdef
description: Detects IKEv1 key exchange anomalies associated with CVE-2026-50751 exploitation attempts by CHAOS actors.
status: experimental
date: 2026/07/09
author: Security Arsenal Research
logsource:
    product: firewall
    vendor: check_point
detection:
    selection_ike:
        protocol: 'ike'
        ike_version: 'v1'
    selection_auth_bypass:
        action: 'accept'
        |count:
            by: src_ip
            # Threshold: > 10 successful IKEv1 connections from single IP in 1m
            timeframe: 1m
            condition: > 10
    condition: selection_ike and selection_auth_bypass
falsepositives:
    - Legacy VPN clients
    - Misconfigured VPN peers
level: critical
tags:
    - attack.initial_access
    - cve.2026.50751
    - ransomware.chaos
---
title: Suspicious Exchange PowerShell Deserialization
id: 8c3d4e5f-6a7b-8901-2345-678901bcdef
description: Detects PowerShell commands often used post-exploitation of CVE-2023-21529 on Exchange servers, common in CHAOS lateral movement.
status: experimental
date: 2026/07/09
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'New-ManagedFolder'
            - 'Get-ManagementRoleEntry'
            - 'SerializationBinder'
    condition: selection
falsepositives:
    - Exchange Admin Automation
level: high
tags:
    - attack.execution
    - cve.2023.21529
    - ransomware.chaos

// Hunt for CHAOS lateral movement and staging activity
// Look for large scale file operations (data staging) common before encryption
DeviceFileEvents
| where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "rclone.exe", "robocopy.exe")
| where ActionType == "FileCreated" 
| where FileSize > 1000000 // > 1MB
| where FolderPath contains "\\" or FolderPath contains "ProgramData"
| summarize Count=count(), FileSizeSum=sum(FileSize) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where Count > 50 // High volume of file creation indicates staging
| extend AlertMessage = "Potential CHAOS Ransomware Data Staging Detected"

<#
.SYNOPSIS
    Rapid Response Hardening Script for CHAOS Campaign Indicators.
.DESCRIPTION
    Checks for suspicious scheduled tasks, RDP exposure, and recent Shadow Copy manipulations.
#>

Write-Host "[+] Starting CHAOS Ransomware Response Hardening..." -ForegroundColor Cyan

# 1. Check for RDP Exposure (Port 3389)
$RDPListeners = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($RDPListeners) {
    Write-Host "[!] ALERT: RDP (Port 3389) is Listening on the following addresses:" -ForegroundColor Red
    $RDPListeners | Select-Object -ExpandProperty LocalAddress
} else {
    Write-Host "[+] RDP is not listening." -ForegroundColor Green
}

# 2. Enumerate Suspicious Scheduled Tasks (Last 7 Days)
$DateCutoff = (Get-Date).AddDays(-7)
Write-Host "[+] Checking for Scheduled Tasks created/modified in the last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt $DateCutoff } | 
    ForEach-Object {
        $TaskInfo = $_.TaskPath + "\" + $_.TaskName
        $Action = $_.Actions.Execute
        Write-Host "[!] Suspicious Task Found: $TaskInfo" -ForegroundColor Yellow
        Write-Host "    Action: $Action"
    }

# 3. Check Volume Shadow Copy Manipulations (VssAdmin)
Write-Host "[+] Checking VSS Admin usage events in System Log..." -ForegroundColor Cyan
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; StartTime=$DateCutoff} -ErrorAction SilentlyContinue
if ($VssEvents) {
    Write-Host "[!] Found recent VSS Admin operations (Shadow Copy activity):" -ForegroundColor Yellow
    $VssEvents | Select-Object TimeCreated, Message | Format-Table -Wrap
} else {
    Write-Host "[+] No recent suspicious VSS activity found." -ForegroundColor Green
}

Write-Host "[+] Hardening Script Complete." -ForegroundColor Cyan