COINBASECARTEL Ransomware Gang: 13 Victims Posted in 24 Hours — Financial Services Blitz, Sector Analysis & Detection Rules

Classification: TLP:AMBER+STRICT | Briefing Date: 2026-08-23 | Source: ransomware.live monitoring of COINBASECARTEL .onion leak site

Executive Summary

On 2026-08-22, the COINBASECARTEL ransomware operation published 13 victim organizations to its dark web leak site in a single 24-hour window — a burst pattern consistent with either a coordinated detonation wave or a backlog dump following negotiation failures. Financial services organizations account for 5 of the 13 postings (38%), with professional services and healthcare rounding out the top three. Geographic spread spans 7 confirmed countries, with notable expansion into Southeast Asia (PH, ID) and first-observed targeting of a Chinese manufacturing entity.

This briefing translates that leak-site telemetry into detection engineering content and prioritized defensive actions.

Threat Actor Profile — COINBASECARTEL

Note: COINBASECARTEL is a relatively young operation in our tracking set. Items marked [ASSESSED] are analytical judgments based on observed victimology and campaign behavior; items marked [CONFIRMED] derive from leak-site telemetry and incident reporting.

• Aliases: No confirmed aliases. The branding (cryptocurrency-themed naming) suggests possible lineage or talent bleed from defunct crypto-extortion crews; we assess with moderate confidence this is a rebrand or splinter rather than a net-new team, given the operational tempo achieved quickly.
• Operating model: [ASSESSED] Closed or semi-closed RaaS. The synchronized 13-victim posting wave suggests a small affiliate pool operating under centralized tasking rather than an open affiliate marketplace, which typically produces staggered postings.
• Ransom demands: [ASSESSED] Sector-scaled demands. Given victimology (regional banks, microfinance, mid-market professional services), estimated demand range is USD 250K–3M, calibrated to victim revenue rather than flat-rate.
• Initial access methods: [ASSESSED] Perimeter appliance exploitation and remote access abuse. Correlation with currently exploited KEV entries (see below) points to VPN/security-gateway exploitation (CVE-2026-50751 — Check Point IKEv1 improper authentication) and RMM abuse (CVE-2024-1708 — ConnectWise ScreenConnect path traversal) as primary entry vectors, supplemented by phishing. The ScreenConnect KEV addition in April 2026 aligns with this group's emergence in our telemetry.
• Extortion model: [CONFIRMED] Double extortion — leak-site publication with named-victim shaming. All 13 victims were published with sector/country tagging, indicating structured data-theft staging prior to posting.
• Dwell time: [ASSESSED] Short-to-moderate (estimated 3–14 days). Burst posting behavior and RMM-based access both correlate with compressed dwell times; defenders should assume they have days, not weeks, between initial access and encryption.

Current Campaign Analysis

Sector Targeting (13 victims, posted 2026-08-22)

Key takeaway: This is a financial-services-weighted campaign against small-to-mid-market institutions — regional banks (BPR), microfinance, insurance, and investment advisors. These organizations typically have thinner SOC coverage and weaker segmentation than tier-1 financials, making them high-yield, low-resistance targets.

Geographic Concentration

• Primary: United States (5 victims)
• Emerging: Southeast Asia — Philippines and Indonesia (3 victims combined), indicating deliberate expansion into regions with lower ransomware-reporting maturity
• Opportunistic: NZ, AR, FR, CN (1 each)

Victim Profile

Estimated revenue range across the set: USD 5M–500M, skewing toward the 50–500 employee band. The inclusion of immigration law (Klasko), engineering consultancy (OTEIS), and a creative agency (Kessler) confirms this group is not sector-purist — it follows access, not industry. Financial services weighting reflects where their current access brokers/intrusion set is landing, not an ideological focus.

Posting Frequency / Escalation Pattern

13 postings in a single day is a burst-dump pattern. Two interpretations, both actionable:

1. Negotiation-failure dump: Multiple victims refused payment simultaneously and were published en masse — meaning intrusions occurred days-to-weeks earlier and more unposted victims may still be in the pipeline.
2. Coordinated wave: A single affiliate or access cluster was burned/retired, triggering mass publication.

Either way: organizations sharing the victim profile should assume elevated probability of active, undetected intrusion right now.

CVE Correlation (CISA KEV — confirmed ransomware use)

The following actively exploited vulnerabilities are temporally and tactically consistent with this campaign's access profile:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Prime suspect for perimeter initial access. Any org running Check Point gateways with IKEv1 enabled should treat unpatched exposure as probable-compromise and hunt retroactively.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. RMM abuse is the classic short-dwell ransomware entry; ScreenConnect artifacts should be hunted on all endpoints and servers.
• CVE-2025-60710 — Windows link-following privilege escalation. Likely used post-compromise for local privesc prior to staging.
• CVE-2023-21529 — Exchange deserialization (authenticated RCE). Relevant given professional-services targeting where on-prem Exchange remains common.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain-flavored; relevant to engineering/dev-adjacent victims (OTEIS, RXPE).

Action: Cross-reference your patch posture against all five KEV entries immediately. Any gap on CVE-2026-50751 or CVE-2024-1708 in an org matching this victim profile = treat as incident, not hygiene.

Detection Engineering

Sigma Rules

Three rules targeting COINBASECARTEL's assessed playbook: (1) RMM-based initial access via ScreenConnect, (2) PsExec/WMI lateral movement, (3) pre-encryption staging — shadow copy deletion plus mass rename behavior.

---
title: ScreenConnect RMM Execution — Potential Ransomware Initial Access
id: 9f2c1a7e-cb41-4d2a-9e11-7a3f0c8d2101
status: experimental
description: Detects execution or installation artifacts of ConnectWise ScreenConnect, an RMM tool abused by ransomware affiliates (incl. CVE-2024-1708 exploitation) for initial access and hands-on-keyboard activity. Tune allowlist for sanctioned IT use.
author: Security Arsenal Threat Intel
date: 2026/08/23
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\ScreenConnect.Service.exe'
  selection_cmd:
    CommandLine|contains:
      - 'screenconnect'
      - 'connectwisecontrol'
  selection_parent:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\powershell.exe'
      - '\w3wp.exe'
  condition: (selection_img or selection_cmd) and selection_parent
falsepositives:
  - Sanctioned ScreenConnect deployment by internal IT/MSP (allowlist by MSI hash and install path)
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1219
---
title: PsExec or WMI Remote Service Creation — Lateral Movement
id: 3b8d4e92-1c5f-4a77-b2d9-6e0f1a5c3302
status: experimental
description: Detects remote service creation and ADMIN$ share usage consistent with PsExec-style lateral movement and WMI-spawned processes, commonly observed in pre-encryption ransomware staging.
author: Security Arsenal Threat Intel
date: 2026/08/23
logsource:
  product: windows
  service: system
  definition: Event ID 7045 (service installation) combined with suspicious service binary paths
detection:
  selection_event:
    EventID: 7045
  selection_path:
    ServiceFileName|contains:
      - '\ADMIN$'
      - '\Temp\'
      - '\Users\Public\'
      - 'PSEXESVC'
      - '%COMSPEC%'
  condition: selection_event and selection_path
falsepositives:
  - Legitimate software deployment tools (SCCM, PDQ) — allowlist by service name and signer
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Pre-Encryption Staging — Shadow Copy Deletion and Mass File Rename
id: 7c1e9a04-8d2b-4f63-a1c8-5b9d2e7f4403
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic/powershell and suspicious mass file-rename behavior indicative of ransomware detonation preparation. This is a T-minus indicator — alert response must be immediate.
author: Security Arsenal Threat Intel
date: 2026/08/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin.exe Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - 'resize shadowstorage'
  selection_bcd:
    CommandLine|contains:
      - 'bcdedit'
    CommandLine|contains|all:
      - 'recoveryenabled'
      - 'no'
  condition: selection_vss or selection_bcd
falsepositives:
  - Backup software maintenance windows — correlate with change tickets; rare outside backup-agent service accounts
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

KQL — Microsoft Sentinel Hunt Query

Hunts the pre-ransomware staging chain: suspicious RMM/remote execution → new service installation → shadow copy tampering, correlated per host within a 6-hour window. Run over the last 14 days given this group's burst-dump behavior.

let lookback = 14d;
let window = 6h;
// Stage 1: suspicious remote execution / RMM tooling
let RemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any ('ScreenConnect', 'psexec', 'psexesvc', 'winrm', 'wmic')
       or ProcessCommandLine has_any ('screenconnect', 'psexec', 'wmiexec', 'Invoke-WMIMethod', 'winrs')
    | summarize RemoteExecHits = count(), FirstRemote = min(TimeGenerated)
        by DeviceName, bin(TimeGenerated, 1h);
// Stage 2: new service installation (7045 via SecurityEvent) or scheduled task creation
let ServiceInstall =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045 or EventID == 4698
    | where CommandLine has_any ('ADMIN$', 'Temp', 'Public', 'PSEXESVC')
       or TaskContent has_any ('powershell', 'cmd.exe', 'rundll32')
    | summarize ServiceHits = count() by DeviceName, bin(TimeGenerated, 1h);
// Stage 3: shadow copy / recovery tampering
let VssTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ('vssadmin', 'shadowcopy delete', 'bcdedit', 'wbadmin delete', 'recoveryenabled')
    | summarize VssHits = count(), VssCmds = make_set(ProcessCommandLine, 5)
        by DeviceName, bin(TimeGenerated, 1h);
// Correlate: host showing 2+ stages within the campaign window
RemoteExec
| join kind=inner (ServiceInstall) on DeviceName
| join kind=leftouter (VssTamper) on DeviceName
| extend StageCount = 2 + iif(isnotnull(VssHits), 1, 0)
| where abs(datetime_diff('minute', TimeGenerated, TimeGenerated1)) <= 360
| project DeviceName, RemoteExecHits, FirstRemote, ServiceHits, VssHits, VssCmds, StageCount
| order by StageCount desc, FirstRemote asc;

Analyst note: Any host with StageCount == 3 is a T-minus asset — assume encryption is imminent and initiate containment immediately. Hosts with StageCount == 2 warrant same-shift investigation.

PowerShell — Rapid Triage Script

Run on suspected hosts or via your EDR's live-response across the fleet. Checks for recent scheduled tasks, unexpected RMM presence, shadow copy state, and exposed RDP.

# COINBASECARTEL Rapid Triage — run elevated. Output to C:\IR\triage-<host>-<date>.txt
$out = "C:\IR\triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
New-Item -Path 'C:\IR' -ItemType Directory -Force | Out-Null

"=== [1] Scheduled tasks created/modified in last 7 days ===" | Out-File $out
Get-ScheduledTask | Where-Object { $_.Date -and ((New-TimeSpan -Start ([datetime]$_.Date) -End (Get-Date)).Days -le 7) } |
  Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}} |
  Format-Table -AutoSize | Out-File $out -Append

"=== [2] Volume Shadow Copies (expect backups present; EMPTY = tampering indicator) ===" | Out-File $out -Append
$vss = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $vss) { 'WARNING: No shadow copies found — possible vssadmin deletion (T1490)' | Out-File $out -Append }
else { $vss | Select-Object InstallDate, DeviceObject | Format-Table -AutoSize | Out-File $out -Append }

"=== [3] RMM / remote access tooling check ===" | Out-File $out -Append
$rmm = 'ScreenConnect','ConnectWise','AnyDesk','TeamViewer','Splashtop','Atera','NinjaRMM','psexesvc'
Get-CimInstance Win32_Service | Where-Object { $n=$_.Name; $rmm | Where-Object { $n -like "*$_*" } } |
  Select-Object Name, State, PathName, StartMode | Format-Table -AutoSize | Out-File $out -Append

"=== [4] RDP exposure: enabled? NLA on? Recent 4625 logon failures (brute force) ===" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"RDP Disabled flag (0=enabled): $($rdp.fDenyTSConnections)" | Out-File $out -Append
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"NLA (1=on): $($nla.UserAuthentication)" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-2)} -MaxEvents 5000 -ErrorAction SilentlyContinue |
  Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10 Count, Name |
  Format-Table -AutoSize | Out-File $out -Append

"=== [5] Check Point gateway / VPN admin logons in last 72h (if logs forwarded locally) ===" | Out-File $out -Append
'Review VPN gateway logs separately for CVE-2026-50751 exploitation: anomalous IKEv1 auth success without valid cert.' | Out-File $out -Append

Write-Host "Triage complete: $out"

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

1. vssadmin / bcdedit / wbadmin execution by any account that is not your backup agent's service account → critical, respond now
2. New services or scheduled tasks staging binaries from \Temp\, \Users\Public\, or ADMIN$
3. RMM tooling (ScreenConnect, AnyDesk, Atera) present that is not your sanctioned stack
4. Burst of 4625 logon failures against RDP/VPN followed by a 4624 success from an unusual source IP
5. Large outbound transfers (multi-GB) to uncommon cloud storage, Mega, or unfamiliar IPs during off-hours — exfil precedes extortion
6. Anomalous IKEv1 authentication events on Check Point gateways (CVE-2026-50751)

Assets This Campaign Prioritizes for Exfiltration

Based on victimology, expect targeting of:

• Financial services: client PII, loan/portfolio records, KYC documents, core banking exports
• Professional services / legal (immigration): case files, client identity documents — extremely high blackmail leverage
• Healthcare: patient records and billing systems
• All victims: domain controller ntds.dit, finance shares, executive mailboxes

Containment Actions (Ordered by Urgency)

1. Isolate affected hosts at the network layer (EDR network isolation or switch port shutdown) — do NOT power off; preserve memory
2. Disable the suspected ingress path: block RMM tooling hash/domain fleet-wide, force VPN gateway cert resets
3. Reset credentials in blast-radius order: accounts on the affected host → service accounts → domain admin tier; assume krbtgt compromise if a DC was touched
4. Block egress to unknown cloud storage and throttle off-hours outbound volume
5. Snapshot forensic state: memory capture + triage script output before remediation
6. Do not engage the actor or access their leak site from corporate infrastructure — use your threat intel provider

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1 improper auth) and CVE-2024-1708 (ScreenConnect) — these are confirmed-ransomware KEV entries and the highest-probability ingress points for this campaign. If you cannot patch the gateway, disable IKEv1 aggressively authenticated VPNs.
• Audit and kill unsanctioned RMM: block execution of ScreenConnect/AnyDesk/Splashtop/Atera binaries unless explicitly approved (AppLocker/WDAC).
• Enforce NLA + MFA on all remote access; move RDP behind VPN/ZTNA — no direct internet exposure. Alert on >10 failed RDP logons per source per hour.
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days — this group's dwell time means intrusions from early August may still be live.
• Verify shadow copies and offline/immutable backups exist and are restorable. Test one restore today, not during the incident.

Short-Term (2 weeks)

• Tiered administration: separate admin accounts for workstation/server/DC tiers; no domain admin logons outside PAWs.
• Segmentation: isolate finance, HR/legal, and backup VLANs; deny workstation-to-workstation SMB/RDP by default (kills PsExec-style lateral movement).
• Egress filtering + DLP on bulk transfer: alert on multi-GB outbound to non-sanctioned destinations; this catches the exfil that precedes the leak post.
• EDR in block mode everywhere (not audit), with tamper protection enforced — ransomware operators routinely attempt EDR disablement as a staging step.
• Managed detection coverage for the small-org profile: the victims in this wave (microfinance, regional banks, law firms) overwhelmingly lacked 24/7 monitoring. If you cannot staff a SOC, outsource it (see resources below).

This briefing is based on live leak-site telemetry collected 2026-08-23. Victim postings reflect attacker claims; Security Arsenal does not independently verify breach details. Assessments marked [ASSESSED] carry stated confidence and will be updated as telemetry matures.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub