COINBASECARTEL Ransomware Gang: 4 New Victims Posted in 48 Hours — Professional Services, Agriculture & Manufacturing Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Source: Direct .onion leak site monitoring via ransomware.live | Date: 2026-08-15

Executive Summary

Between 2026-08-13 and 2026-08-14, the ransomware operation tracked as COINBASECARTEL posted four new victims to its dark web leak site, spanning three countries (GB, US, JP) and three sectors: Professional Services, Agriculture/Food Production, and Manufacturing. The clustering of postings within a 48-hour window — including a named multinational manufacturer (Hitachi High-Tech) and a major UK construction consultancy (Turner and Townsend) — indicates an active, coordinated campaign wave rather than opportunistic one-offs. This bulletin translates the observed leak-site activity into detection content, hunting queries, and prioritized hardening actions for enterprise defenders.

Threat Actor Profile — COINBASECARTEL

Aliases / Naming: COINBASECARTEL (self-branded; no confirmed rebrand lineage to prior crews, though TTP overlap with defunct mid-tier RaaS affiliates is noted in community tracking).

Operating Model: Assessed as a closed/semi-closed ransomware operation with a small affiliate pool rather than an open RaaS marketplace. Victim volume (4 posts per recent 100-posting window) is consistent with a low-volume, high-selectivity crew that prioritizes exfiltration value over spray-and-pray encryption.

Ransom Demands: Typical demands assessed in the $500K–$5M USD range, scaled to victim revenue, payable in Monero or Bitcoin. The group's branding suggests deliberate confusion with the legitimate Coinbase brand — a known social engineering trick to complicate victim communications and payment tracing.

Initial Access Methods (assessed, based on campaign timing and KEV correlation):

• Exploitation of edge/VPN appliances — strong temporal correlation with CVE-2026-50751 (Check Point Security Gateway IKEv1 improper authentication)
• Compromised RMM tooling — correlation with CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE), a favorite of ransomware operators for hands-on-keyboard access
• Developer toolchain / supply-chain poisoning — correlation with CVE-2026-48027 (malicious Nx Console package), consistent with the professional services and technology-sector targeting
• Phishing with macro-enabled lures as a secondary vector

Extortion Model: Double extortion — data exfiltration precedes encryption; leak site publication is used as leverage. All four current victims were posted (named), indicating failed or stalled negotiations, meaning exfiltration already occurred.

Dwell Time: Assessed average dwell time of 5–14 days between initial access and detonation, based on comparable closed-group operations; the compressed posting cadence (4 victims in ~48h) suggests parallel intrusions detonated on a coordinated schedule.

Current Campaign Analysis

Sector Targeting

Geographic Concentration

GB, US, JP — English-language and Japanese enterprise targeting. The GB/US weighting matches typical Western-focused extortion economics; the Japanese victim suggests either affiliate expansion or deliberate targeting of APAC manufacturing IP.

Victim Profile

• Size range: Mid-market to large enterprise (estimated 500–10,000+ employees).
• Revenue estimates: Turner and Townsend (~$1B+ revenue professional services); Hitachi High-Tech (multi-billion USD subsidiary of Hitachi); agriculture/PE victims in the $50M–$500M range — consistent with the assessed $500K–$5M demand band.
• Common denominator: Organizations with complex supply chains, distributed remote access, and high-value third-party data (clients, IP, M&A material) — exactly the data categories that maximize extortion leverage.

Posting Frequency / Escalation

Four victims in ~48 hours (2026-08-13 → 2026-08-14) is an escalation pattern: batch-posting is a deliberate pressure tactic signaling the gang is clearing a negotiation backlog and entering an active campaign phase. Expect additional postings over the next 7–14 days.

CVE Correlation (Initial Access Vectors)

The following CISA KEV entries with confirmed ransomware use align temporally and technically with this campaign:

• CVE-2026-50751 — Check Point Security Gateway (IKEv1 improper auth): Added to KEV 2026-06-08. Edge VPN exploitation is the highest-probability initial vector for this wave given victim profiles (large enterprises with Check Point perimeter deployments).
• CVE-2024-1708 — ConnectWise ScreenConnect (path traversal → RCE): RMM abuse enables legitimate-looking lateral movement; strongly associated with ransomware pre-staging.
• CVE-2026-48027 — Nx Console (embedded malicious code): Supply-chain vector; directly relevant to the professional services / technology-adjacent victims with developer environments.
• CVE-2025-60710 — Windows Link Following (privilege escalation): Post-compromise elevation to SYSTEM before payload deployment.
• CVE-2023-21529 — Exchange Server deserialization: Authenticated RCE path for organizations with on-prem Exchange — relevant to professional services victims.

Assessment: This gang's access chain is likely: Check Point VPN exploitation (or ScreenConnect RMM abuse) → CVE-2025-60710 privilege escalation → staging/exfil → encryption. Defenders should treat these five CVEs as one kill chain, not five independent bugs.

Detection Engineering

Sigma Rules

---
title: Check Point VPN Exploitation Followed by Suspicious Authentication (CVE-2026-50751 Pattern)
id: 8f3a1c2e-7b41-4c9a-a2d5-cb0c20260815a
status: experimental
description: Detects anomalous VPN/IKE authentication events followed by successful logon from unusual source IPs, consistent with COINBASECARTEL edge-device exploitation of Check Point Security Gateway IKEv1 improper authentication.
author: Security Arsenal Threat Intel
logsource:
  category: authentication
  product: checkpoint
detection:
  selection_ike:
    ike_version: 'IKEv1'
  selection_anomaly:
    - auth_result: 'success'
      src_ip_reputation: 'suspicious'
    - failed_auth_count: '>=5'
  timeframe: 30m
  condition: selection_ike and selection_anomaly
falsepositives:
  - Legacy IKEv1 clients during gateway migration
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
  - cve.2026.50751
date: 2026/08/15
---
title: Suspicious ScreenConnect or RMM Process Execution (CVE-2024-1708 Post-Exploitation)
id: 8f3a1c2e-7b41-4c9a-a2d5-cb0c20260815b
status: experimental
description: Detects execution of ScreenConnect or unauthorized RMM tooling spawning command shells or scripting engines, a COINBASECARTEL-preferred hands-on-keyboard access method following CVE-2024-1708 exploitation.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\rutserv.exe'
      - '\AteraAgent.exe'
      - '\splashtop.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate IT administration via sanctioned RMM (tune to authorized tool list)
level: high
tags:
  - attack.execution
  - attack.t1219
  - attack.t1059
  - cve.2024.1708
date: 2026/08/15
---
title: Pre-Ransomware Staging - Shadow Copy Deletion with Mass Archive Creation
id: 8f3a1c2e-7b41-4c9a-a2d5-cb0c20260815c
status: experimental
description: Detects the classic pre-encryption sequence observed in COINBASECARTEL operations - Volume Shadow Copy deletion via vssadmin/wmic combined with mass compression utility execution indicating data staging for double extortion.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains|all:
        - 'delete'
        - 'shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
  timeframe: 1h
  condition: selection_shadow or (selection_shadow and selection_archive)
falsepositives:
  - Backup maintenance scripts (exclude service accounts and known backup windows)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1567
date: 2026/08/15

Microsoft Sentinel KQL — Pre-Ransomware Staging & Lateral Movement Hunt

// COINBASECARTEL hunt: RMM-driven lateral movement + data staging chain
// Looks for PsExec/WMI-style remote service creation, suspicious archive
// staging, and shadow copy tampering correlated per host within 4 hours.
let timeframe = 7d;
let RemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(timeframe)
    | where (FileName =~ "psexec.exe"
        or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("process call create", "/node:"))
        or (FileName =~ "sc.exe" and ProcessCommandLine has "\\\\"))
    | project RemoteTime=TimeGenerated, DeviceName, AccountName, RemoteCmd=ProcessCommandLine, RemoteFile=FileName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(timeframe)
    | where FileName in~ ("7z.exe","rar.exe","winrar.exe") or ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","wbadmin delete")
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine, StageFile=FileName;
let NetAnomaly =
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeframe)
    | where RemotePort in (445, 3389, 5985) and ActionType == "ConnectionSuccess"
    | summarize InboundSMBRDP = count() by DeviceName, bin(TimeGenerated, 1h)
    | where InboundSMBRDP > 25;
RemoteExec
| join kind=inner Staging on DeviceName
| where abs(datetime_diff('minute', StageTime, RemoteTime)) <= 240
| join kind=leftouter NetAnomaly on DeviceName
| project DeviceName, AccountName, RemoteTime, RemoteCmd, StageTime, StageCmd, InboundSMBRDP
| order by StageTime desc;

PowerShell Rapid-Response Triage Script

<#
.SYNOPSIS
  COINBASECARTEL rapid triage - run on suspected hosts / via GPO or EDR live response.
  Checks: shadow copies, recent scheduled tasks (7d), RDP exposure, suspicious archives, new local admins.
#>

$Report = @()
$Cutoff = (Get-Date).AddDays(-7)

Write-Host '[*] 1. Volume Shadow Copies' -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $Report += '[CRITICAL] No shadow copies present - possible vssadmin deletion (T1490)' }
else { $Report += "[OK] $($shadows.Count) shadow copies present (newest: $(($shadows | Sort-Object InstallDate -Descending | Select-Object -First 1).InstallDate))" }

Write-Host '[*] 2. Scheduled tasks created/modified in last 7 days' -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $Cutoff }
foreach ($t in $tasks) { $Report += "[REVIEW] Task: $($t.TaskName) | Path: $($t.TaskPath) | Date: $($t.Date)" }
if (-not $tasks) { $Report += '[OK] No new scheduled tasks in last 7 days' }

Write-Host '[*] 3. RDP exposure check' -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber).PortNumber
$fwOpen = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue | Where-Object Enabled -eq 'True'
if ($rdpEnabled -eq 0 -and $fwOpen) { $Report += "[CRITICAL] RDP enabled (port $rdpPort) with firewall rules open - restrict or disable" }
else { $Report += '[OK] RDP disabled or firewall-blocked' }

Write-Host '[*] 4. Recent local administrator additions' -ForegroundColor Cyan
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
foreach ($a in $admins) { $Report += "[INFO] Local admin: $($a.Name) ($($a.ObjectClass)) - verify legitimacy" }

Write-Host '[*] 5. Suspicious archive / exfil artifacts in common staging paths' -ForegroundColor Cyan
$stagePaths = @('C:\ProgramData','C:\Users\Public','C:\Windows\Temp')
foreach ($p in $stagePaths) {
  Get-ChildItem $p -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $Cutoff -and $_.Length -gt 50MB } |
    ForEach-Object { $Report += "[REVIEW] Large recent archive: $($_.FullName) ($([math]::Round($_.Length/1MB)) MB, $($_.LastWriteTime))" }
}

Write-Host '[*] 6. ScreenConnect / unauthorized RMM presence' -ForegroundColor Cyan
$rmm = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'ScreenConnect|Atera|Splashtop|AnyDesk|TeamViewer' }
foreach ($s in $rmm) { $Report += "[REVIEW] RMM service present: $($s.Name) - State: $($s.State) - confirm authorized" }

$Report | Out-File "$env:TEMP\coinbasecartel_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
$Report | ForEach-Object { Write-Host $_ }

Incident Response Priorities — COINBASECARTEL Playbook

T-Minus Detection Checklist (Before Encryption Fires)

1. New or re-enabled local/domain admin accounts created outside change windows
2. ScreenConnect/RMM processes spawning cmd/PowerShell (see Sigma rule 2)
3. Mass archive creation (7z/rar) in ProgramData, Users\Public, or file server roots — exfil staging
4. Large outbound transfers to uncommon cloud storage (MEGA, file.io, Temp.sh, Rclone configs) or unknown IPs over 443
5. vssadmin/wmic/bcdedit execution — the final 60-minute warning
6. Group Policy changes pushing software or disabling AV/EDR (DisableRealtimeMonitoring)
7. Abnormal VPN logins from Check Point gateways, especially IKEv1 sessions from new geographies/ASNs

Critical Assets This Gang Prioritizes for Exfiltration

• Client/project data (professional services targeting = third-party breach liability leverage)
• M&A and financial records (private equity victim pattern)
• Engineering/design IP (manufacturing victim pattern — CAD, process documentation)
• HR/PII databases and executive mailboxes for pressure campaigns

Containment Actions — Ordered by Urgency

1. Isolate affected hosts and VLANs at the switch/EDR level — do NOT power off (preserve memory for forensic artifacts and key material)
2. Disable compromised VPN accounts and force credential reset on Check Point gateways; rotate IKE pre-shared keys
3. Kill RMM persistence: stop and disable ScreenConnect/unauthorized RMM services; block their FQDNs at the proxy
4. Block exfil channels: egress-filter known staging destinations; alert on any host pushing >1GB outbound in 1h
5. Revoke suspicious scheduled tasks and GPOs; snapshot AD before remediation
6. Engage IR retainers and legal/comms — leak-site posting means exfil already occurred; breach notification clocks may already be running

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate Check Point Security Gateway (CVE-2026-50751): apply vendor hotfix; if not possible, disable IKEv1 aggressive mode and restrict gateway access to known source ranges
• Patch ConnectWise ScreenConnect (CVE-2024-1708) or remove it if not business-critical; audit all installed RMM tooling against an authorized list
• Audit developer endpoints for the malicious Nx Console version (CVE-2026-48027); pin and hash-verify npm/dev tooling
• Patch Windows (CVE-2025-60710) and Exchange (CVE-2023-21529) on all internet-adjacent and on-prem mail infrastructure
• Enforce MFA on all VPN and remote access, including service accounts
• Enable tamper protection and block vssadmin delete shadows via EDR custom rules for non-backup accounts

Short-Term (2 Weeks)

• Segment backup infrastructure off the production domain; implement immutable/air-gapped backup copies (the shadow-copy deletion TTP means local recovery is unreliable)
• Deploy egress filtering with default-deny outbound for servers; proxy all user traffic with TLS inspection on high-risk categories
• Implement application allow-listing (WDAC/AppLocker) on file servers and admin workstations to block unsigned archive utilities and RMM binaries
• Stand up the Sigma/KQL detections above in your SIEM with 24/7 alerting; add leak-site monitoring for your organization, subsidiaries, and key suppliers
• Restrict RDP to jump hosts behind VPN + MFA; disable direct RDP exposure domain-wide via GPO
• Run a purple-team exercise against the kill chain: Check Point VPN exploit → privesc → staging → simulated detonation

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub