COINBASECARTEL Ransomware: Critical Infrastructure Exploits & Surge in Victim Count

title: Potential Cisco FMC Deserialization Exploit CVE-2026-20131
id: c4c4b1d0-2026-4b1c-9e0c-123456789abc
description: Detects potential exploitation of Cisco Secure Firewall Management Center deserialization vulnerability via suspicious management interface requests.
status: experimental
date: 2026/04/19
author: Security Arsenal Labs
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/mgmt/tm/util/untar'
            - '/mgmt/tm/util/bash'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative backups
level: critical
tags:
    - attack.initial_access
    - cve.2026.20131
    - ransomware.coinbasecartel
---
title: SmarterMail Authentication Bypass CVE-2026-23760
id: e5e5c2e1-2026-4d2d-af1d-987654321xyz
description: Detects authentication bypass attempts on SmarterTools SmarterMail servers associated with CVE-2026-23760.
status: experimental
date: 2026/04/19
author: Security Arsenal Labs
logsource:
    product: smtp
    service: smtp
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 
            - '/Services/Mail.asmx'
            - '/Services/AuthenticatedService.asmx'
    filter_legit:
        cs-user-agent|contains: 'SmarterCloud'
    condition: selection and not filter_legit
falsepositives:
    - Misconfigured legacy integrations
level: high
tags:
    - attack.initial_access
    - cve.2026.23760
    - ransomware.coinbasecartel
---
title: Ransomware Shadow Copy Deletion via VssAdmin
id: f6f6d3f2-2026-5e3e-bg2e-111111111abc
description: Detects commands used by ransomware gangs like COINBASECARTEL to delete Volume Shadow Copies to prevent recovery.
status: experimental
date: 2026/04/19
author: Security Arsenal Labs
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administrator maintenance (rare)
level: critical
tags:
    - attack.impact
    - attack.t1490
    - ransomware.coinbasecartel

// Hunt for lateral movement and staging associated with COINBASECARTEL patterns
// Looks for SMB access to Admin shares and unusual PowerShell execution
DeviceProcessEvents  
| where Timestamp > ago(7d)  
| where (InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wmiprvse.exe") or FileName in~ ("powershell.exe", "cmd.exe"))  
| where (ProcessCommandLine has "New-Object" and ProcessCommandLine has "Net.WebClient") or  
         (ProcessCommandLine has "Invoke-Expression") or  
         (ProcessCommandLine contains "psexec" or ProcessCommandLine contains "wmic")  
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName  
| extend FullPath = iff(ProcessCommandLine contains "\\", extract(@'(\\[a-zA-Z0-9-_]+\[a-zA-Z0-9-_]+)', 0, ProcessCommandLine), "Unknown")  
| where isnotempty(FullPath)  
| order by Timestamp desc

# COINBASECARTEL Rapid Response Hardening Script
# Checks for exposed RDP, recent Scheduled Task creation (Persistence), and VSS health

Write-Host "[+] Starting COINBASECARTEL Hardening Checks..." -ForegroundColor Cyan

# 1. Check for RDP Exposure (Rule of thumb: Should be off unless needed)
$RDPStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
if ($RDPStatus -eq 0) {
    Write-Host "[ALERT] RDP is ENABLED. Consider disabling immediately." -ForegroundColor Red
} else {
    Write-Host "[OK] RDP is Disabled." -ForegroundColor Green
}

# 2. Hunt for suspicious Scheduled Tasks created in last 7 days (Common Persistence)
$DateCutoff = (Get-Date).AddDays(-7)
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt $DateCutoff -and $_.Author -notlike "Microsoft*" -and $_.Author -notlike "N/A*" }

if ($SuspiciousTasks) {
    Write-Host "[ALERT] Found recently created non-Microsoft Scheduled Tasks:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Date, Author, Action | Format-Table -AutoSize
} else {
    Write-Host "[OK] No suspicious recent Scheduled Tasks found." -ForegroundColor Green
}

# 3. Check for Volume Shadow Copy Manipulation Events (Event ID 7036 or VSS Provider errors)
Write-Host "[INFO] Checking Event Log for VSS Service stops (Common pre-encryption)..." -ForegroundColor Yellow
$VSSEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036; StartTime=$DateCutoff} -ErrorAction SilentlyContinue | 
              Where-Object { $_.Message -like '*VSS*' -and $_.Message -like '*stopped*' }

if ($VSSEvents) {
    Write-Host "[ALERT] VSS Service stopped recently. Potential ransomware activity." -ForegroundColor Red
} else {
    Write-Host "[OK] No VSS service stoppages detected." -ForegroundColor Green
}

Write-Host "[+] Scan Complete." -ForegroundColor Cyan


---