COINBASECARTEL: Critical Perimeter Exploitation Campaign Targets Healthcare & Industrial Sectors

Date: 2026-08-02
Source: Ransomware.live / Dark Web Leak Sites
Analyst: Security Arsenal Threat Intel Unit

Threat Actor Profile — COINBASECARTEL

COINBASECARTEL is a rapidly emerging ransomware operation functioning under a RaaS (Ransomware-as-a-Service) model with close ties to initial access broker (IAB) networks specializing in perimeter exploitation.

Affiliation Model: RaaS. The core development team maintains the encryption payload while a distributed network of affiliates handles initial access and lateral movement.
Ransom Demands: Typically range from $500,000 to $5 million, depending on victim revenue. They strictly enforce a "double-extortion" strategy, threatening data leaks on their dedicated .onion site if negotiations fail.
Initial Access Vectors: Historically reliant on exploiting edge-network appliances and remote management tools. Current intelligence confirms heavy reliance on Valid Accounts (VPN) and Exploitation of Public-Facing Applications (CVEs listed below).
Dwell Time: Short. Recent victims indicate an average dwell time of 3–5 days between initial perimeter breach and detonation.

Current Campaign Analysis

Based on victim postings dated 2026-08-01, COINBASECARTEL is executing a high-intensity campaign focusing on bypassing perimeter defenses to access sensitive intellectual property and operational data.

Targeted Sectors & Geography

Sectors: The group is highly opportunistic but currently favors Healthcare (MIM Fertility), Manufacturing/Construction (M. B. Kahn), Technology (Xs Cad), and Standards Bodies (CEN and Cenelec).
Geography: Active in Belgium (BE), Great Britain (GB), and the United States (US). This suggests a Western-centric focus likely due to higher cryptocurrency liquidity and willingness to pay.

Victim Profile

The victims range from mid-market (MIM Fertility, Xs Cad) to large enterprise/consortium level (CEN and Cenelec). The targeting of construction and fertility clinics suggests an intent to exfiltrate sensitive PII and proprietary CAD designs.

CVE Correlation & Initial Access

This campaign correlates directly with the active exploitation of Critical Infrastructure vulnerabilities:

CVE-2026-50751 (Check Point Security Gateway): The victim CEN and Cenelec (BE) strongly suggests the use of this IKEv1 vulnerability to bypass the corporate firewall, as Check Point is standard for European enterprise security.
CVE-2026-20131 (Cisco Secure Firewall FMC): A primary vector for US-based victims (M. B. Kahn), allowing attackers to deserialize untrusted data and gain management plane control.
CVE-2024-1708 (ConnectWise ScreenConnect): Likely used for lateral movement from the perimeter into internal IT management systems.

Escalation Patterns

The group posts victims in batches (4 victims on 2026-08-01). This synchronous posting usually indicates a single affiliate working through a list of compromised networks derived from a single vulnerability scan (e.g., mass scanning for unpatched Check Point gateways).

Detection Engineering

SIGMA Rules (Detection Logic)

YAML

---
title: Potential Check Point VPN Gateway IKEv1 Exploitation Attempt
id: 2b7f2f0e-5a6b-4c8d-9e1f-0a2b3c4d5e6f
description: Detects suspicious IKEv1 key exchange patterns or excessive authentication failures indicative of CVE-2026-50751 exploitation.
status: experimental
date: 2026/08/02
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
definition:
    condition: selection
fields:
    - src_ip
    - dst_ip
    - protocol
falsepositives:
    - Legitimate VPN misconfigurations
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - ransomware.coinbasecartel
detection:
    selection:
        protocol|contains: 'IKE'
        action: 'deny' or 'drop' or 'reject'
    condition: selection

---
title: Suspicious ConnectWise ScreenConnect Path Traversal
id: 1a1b1c1d-2e2f-3a3b-4c4d-5e5f6a6b7c8d
description: Detects path traversal strings in URIs associated with CVE-2024-1708 exploitation on ScreenConnect servers.
status: experimental
date: 2026/08/02
author: Security Arsenal
logsource:
    category: webserver
definition:
    condition: selection
fields:
    - c-ip
    - cs-uri-query
falsepositives:
    - Rare legitimate debugging queries
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
    - ransomware.coinbasecartel
detection:
    selection:
        cs-uri-query|contains:
            - '..%2f'
            - '..\\'
        cs-uri-stem|contains: 'Setup'
    condition: selection

---
title: Ransomware Data Staging via Archiving Tools
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
description: Detects execution of archiving tools like 7-Zip or WinRAR on file servers, often preceding encryption in COINBASECARTEL attacks.
status: experimental
date: 2026/08/02
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
definition:
    condition: selection and filter
fields:
    - Image
    - CommandLine
falsepositives:
    - Legitimate administrator backups
level: high
tags:
    - attack.exfiltration
    - attack.t1560
    - ransomware.coinbasecartel
detection:
    selection:
        Image|endswith:
            - '\\7z.exe'
            - '\\winrar.exe'
            - '\\rar.exe'
        CommandLine|contains: 
            - '-a'
            - '-m5'
    filter:
        User|contains:
            - 'SYSTEM'
            - 'ADMIN'

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for lateral movement and staging indicative of COINBASECARTEL
// Looks for remote service creation (PsExec/WMI) followed by archival activity
let TimeWindow = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeWindow)
| where ProcessName in~ ("powershell.exe", "cmd.exe", "wmic.exe", "psexec.exe", "psexec64.exe")
| where CommandLine has_any ("create", "call", "invoke", "start") 
       and CommandLine has_any ("remote", "\\\\", "-c", "-accepteula")
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(TimeWindow)
    | where FileName in~ ("7z.exe", "winrar.exe", "rar.exe", "vlc.exe") // VLC often used as a lolbin for exfil
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FileName, FolderPath
| order by Timestamp desc

PowerShell (Rapid Response)

PowerShell

# Check for Scheduled Tasks created/modified in the last 7 days
# COINBASECARTEL often uses scheduled tasks for persistence before encryption
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $taskInfo = $task | Get-ScheduledTaskInfo
    $xml = Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath
    
    # Check LastRunTime or Task Creation based on file/system timestamps if available
    # Focusing on recently modified tasks or tasks running suspicious binaries
    if ($taskInfo.LastRunTime -gt (Get-Date).AddDays(-7)) {
        Write-Host "[!] Potential Persistence Task Found:" -ForegroundColor Red
        Write-Host "Name: $($task.TaskName)"
        Write-Host "Path: $($task.TaskPath)"
        Write-Host "Last Run: $($taskInfo.LastRunTime)"
        Write-Host "Action: " ($xml.Task.Actions.Exec.Command)
        Write-Host "------------------------------------------------"
    }
}


---

Incident Response Priorities

T-Minus Detection Checklist

Perimeter Logs: Immediate review of Check Point and Cisco FMC logs for anomalies around IKEv1, VPN authentications, or HTTP POSTs to management interfaces occurring between 2026-07-30 and 2026-08-02.
ScreenConnect Audit: Audit ConnectWise ScreenConnect logs for path traversal attempts (..%2f) or unexpected authenticated sessions from foreign IPs.

Critical Assets at Risk

Based on current victimology (Healthcare, Construction, Tech), prioritize the protection of:

Electronic Health Records (EHR) / Patient Databases.
CAD/Schematics repositories (high value for extortion).
Email servers (Exchange) for credential harvesting.

Containment Actions

Isolate Management Planes: If running Check Point or Cisco FMC, restrict management interface access to internal subnets ONLY immediately. Block all external access to port 443/8443 on these devices.
Disable Remote Tools: Temporarily shut down ScreenConnect/ConnectWise services until CVE-2024-1708 is verified patched.
Suspend Service Accounts: Suspend accounts associated with VPN access if unusual logon patterns are detected.

Hardening Recommendations

Immediate (24 Hours)

Patch KEVs: Immediately apply patches for CVE-2026-50751 (Check Point), CVE-2026-20131 (Cisco FMC), and CVE-2024-1708 (ConnectWise).
MFA Enforcement: Enforce hardware-token MFA for all VPN and Remote Desktop Gateway accesses. Push notifications are insufficient against sophisticated phishing.

Short-term (2 Weeks)

Network Segmentation: Move IT management tools (ScreenConnect, RDP) into a dedicated administrative VLAN that is inaccessible from the general corporate network and the internet.
Geo-Blocking: Configure geo-blocking rules on firewalls to deny inbound VPN and management connections from regions outside of operational territories (e.g., block non-US/BE/GB IPs for the identified victims).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub