Classification: TLP:CLEAR | Publication Date: 2026-11-13 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

CURIOUS WORM Ransomware Gang: 10 New Leak-Site Claims — Healthcare & Manufacturing Targeting, Sector Exposure Analysis & Detection Rules

Executive Summary

Between 2026-11-11 and 2026-11-12, the CURIOUS WORM ransomware operation listed 10 new organizations on its dark web leak site. The claims skew heavily toward the Healthcare sector (5 of 10 listings), with additional claims spanning Manufacturing, Professional Services, and Technology. Geographically, the claimed victims are concentrated in the United States (5), with single listings naming organizations in Canada, Ireland, the United Kingdom, and Saudi Arabia.

Critical caveat: Every listing below is an unverified claim by a criminal actor. Inclusion on a leak site is an accusation, not confirmation of a breach. This briefing analyzes the threat actor's claimed activity to drive defensive posture — it does not assert that any named organization has suffered an intrusion.

The publication tempo is notable: nine claims appeared on a single day (2026-11-11), suggesting a batch-posting event consistent with either a coordinated detonation/exfiltration wave or a backlog dump. Healthcare and senior-care organizations dominate the claimed victim set, and defenders in those sectors should treat this as a prioritization signal for the detection content below.

Sourcing & Verification

• 9 of 10 listings in this briefing were independently observed by a second leak-site crawler (multi-source), meaning two separate monitoring services saw the gang publish the claim. 1 of 10 (benchmarkseniorliving.com) appears on a single source only, meaning no second crawler has confirmed the posting even exists.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. Multi-source corroboration confirms only that the gang posted the claim — not that the claim is true.
• A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.
• Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — CURIOUS WORM

CURIOUS WORM is a ransomware operation tracked via its dark web leak-site presence. Based on observed posting behavior and consistent with current ransomware ecosystem norms, analysts should note the following profile characteristics:

• Model: Consistent with a Ransomware-as-a-Service (RaaS) or semi-closed affiliate model, given the multi-sector, multi-geography spread of claimed victims within a short window — a pattern typical of affiliate-driven operations rather than a single tightly-scoped intrusion team.
• Extortion approach: Double extortion is the operating assumption — data theft prior to encryption, with leak-site publication used as pressure. The batch-posting pattern observed on 2026-11-11 is characteristic of gangs that stage multiple victims and release claims simultaneously to maximize pressure and media attention.
• Known initial access methods (sector-level hypothesis, not attributed to any specific named victim): The gang's claimed victimology overlaps with sectors known to be exposed via perimeter and remote-access weaknesses — VPN/firewall appliances, RDP exposure, and phishing-delivered loaders. The actively exploited CVEs listed in the Current Campaign Analysis section represent plausible initial-access surface for the sectors targeted, framed strictly as hypothesis.
• Ransom demands: Demand sizing typically tracks perceived ability to pay; the claimed victim set (senior living, specialty healthcare, mid-market manufacturing, legal services) suggests mid-five-figure to low-seven-figure USD demand ranges typical of mid-market-focused operations.
• Dwell time: The simultaneous batch posting of nine claims suggests pre-staged access held before publication — consistent with a dwell window of days to weeks between initial access and leak-site pressure, during which discovery, lateral movement, and exfiltration occur. This dwell window is the defender's opportunity.

Current Campaign Analysis

Claimed Victim Listings

Sector Targeting

Healthcare dominates with 5 of 10 claimed listings, spanning senior living, orthopedic care, preventive health screening, dental supply, and a regional health system. This is consistent with the broader criminal economy's continued prioritization of healthcare: high-pressure negotiation leverage (patient care continuity), historically weaker segmentation, and regulated data with high extortion value. Professional Services (2 listings — including a law firm and a senior-care management company) and Manufacturing (1) round out the set, with one Technology listing.

Geographic Concentration

The United States accounts for half the claimed listings (5 of 10), with one each in Canada, Ireland, the United Kingdom, and Saudi Arabia, plus one listing with undetermined geography. This spread is consistent with opportunistic, access-driven targeting rather than deliberate geographic focus — affiliates hit what their access brokers sell.

Victim Profile

The claimed victims skew mid-market: regional healthcare providers, specialty manufacturers, and professional services firms — organizations large enough to pay meaningful ransoms but frequently lacking 24/7 SOC coverage, mature EDR deployment, and hardened identity controls. Estimated revenue bands for this profile typically range from roughly $10M to $500M annually.

Posting Frequency / Escalation

Nine claims posted on 2026-11-11 and one on 2026-11-12. Single-day batch posting of this size is an escalation pattern worth monitoring: it can indicate a wave of simultaneous detonations, an affiliate cashing out staged access, or a leak-site relaunch. Defenders should watch for a follow-on batch in the next 7–14 days.

CVE Exposure Context (Hypothesis — Not Attributed)

No evidence links any specific CVE to any specific named organization in this campaign. However, the following CISA KEV entries represent sector-level exposure consistent with the initial-access methods this class of actor is known to exploit, and all organizations in the targeted sectors should verify patch status against them:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter VPN/firewall exploitation is a top initial-access vector for ransomware affiliates. Added to KEV 2026-06-08.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise enables broad network access. Added to KEV 2026-07-29.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal. vCenter compromise is a pre-encryption force multiplier, enabling mass VM destruction/encryption. Added to KEV 2026-08-18.
• CVE-2026-63077 — JetBrains TeamCity deserialization (unauthenticated RCE). CI/CD compromise enables supply-chain-style lateral movement and credential theft. Added to KEV 2026-08-05.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply-chain exposure. Added to KEV 2026-05-27.

Patch prioritization against these KEV entries should be treated as urgent for organizations in Healthcare, Manufacturing, Professional Services, and Technology.

Detection Engineering

The following detections target TTPs consistent with this class of ransomware operation: perimeter/VPN exploitation, phishing-driven execution, RDP-based lateral movement, tooling deployment (PsExec/WMI), and pre-encryption staging (shadow copy deletion, mass file access, exfil staging).

---
title: Suspicious Shadow Copy Deletion Pre-Ransomware Staging
id: 8f2a1c3e-curious-worm-0001
status: experimental
description: Detects deletion or resize of Volume Shadow Copies via vssadmin, wmic, or PowerShell — a hallmark pre-encryption step observed across ransomware operations including batch-posting campaigns.
author: Security Arsenal Threat Intelligence
date: 2026/11/13
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bcdedit.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup administration; correlate with backup windows and service accounts
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: PsExec or WMI Remote Service Execution Lateral Movement
id: 8f2a1c3e-curious-worm-0002
status: experimental
description: Detects remote execution patterns consistent with PsExec-style service installation and WMI process creation used by ransomware affiliates for lateral movement and mass payload deployment.
author: Security Arsenal Threat Intelligence
date: 2026/11/13
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PsExec.exe'
      - '\PsExec64.exe'
      - '\psexesvc.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
  selection_service:
    CommandLine|contains:
      - 'ADMIN$'
      - '\\*\IPC$'
  condition: selection_psexec or selection_wmi or (selection_service and selection_wmi)
falsepositives:
  - Legitimate administrative tooling; baseline admin workstation IPs and service accounts
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1047
---
title: Exposed RDP Brute Force Followed By Successful Logon
id: 8f2a1c3e-curious-worm-0003
status: experimental
description: Detects password-spray/brute-force patterns against RDP (multiple 4625 failures followed by 4625/4624 success from the same source) consistent with initial-access broker tradecraft feeding ransomware affiliates.
author: Security Arsenal Threat Intelligence
date: 2026/11/13
logsource:
  product: windows
  service: security
detection:
  selection_fail:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType: 10
  timeframe: 10m
  condition: selection_fail | count() by SourceIp > 10
  # Correlate with selection_success from same SourceIp within 30m at the SIEM layer
falsepositives:
  - Misconfigured service accounts; vulnerability scanners
level: medium
tags:
  - attack.credential-access
  - attack.t1110
  - attack.initial-access
  - attack.t1133

// Hunt: Pre-ransomware staging — mass file access + staging archive creation + remote exec, by host/user in 24h
// Microsoft Sentinel / Defender XDR advanced hunting
let window = 24h;
let StagingEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where ProcessCommandLine has_any ("compress", "-a ", "rar ", "7z", "zip -r", "--password")
       or FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | project StagingTime=TimeGenerated, DeviceName, AccountName, StagingCmd=ProcessCommandLine, StagingProc=FileName;
let ShadowDeletion =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "recoveryenabled no")
    | project ShadowTime=TimeGenerated, DeviceName, AccountName, ShadowCmd=ProcessCommandLine;
let RemoteExec =
    DeviceNetworkEvents
    | where TimeGenerated > ago(window)
    | where RemotePort in (445, 135, 3389, 5985)
    | where InitiatingProcessFileName in~ ("psexec.exe", "psexec64.exe", "wmiprvse.exe", "winrs.exe", "powershell.exe")
    | project RemoteTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessFileName;
StagingEvents
| join kind=inner ShadowDeletion on DeviceName
| join kind=leftouter RemoteExec on DeviceName
| where ShadowTime between (StagingTime .. StagingTime + 6h)
| summarize
    FirstSeen=min(StagingTime),
    StagingCommands=make_set(StagingCmd, 5),
    ShadowCmds=make_set(ShadowCmd, 5),
    RemoteConnections=make_set(strcat(RemoteIP, ":", RemotePort), 10)
    by DeviceName, AccountName
| extend RiskScore = 90
| sort by FirstSeen desc;

# Rapid-response triage: exposed RDP, new scheduled tasks (7d), shadow copy integrity, suspicious services
# Run elevated on suspect hosts or via your EDR/remote shell. Outputs a consolidated triage report.
$out = @()
$cutoff = (Get-Date).AddDays(-7)

# 1) RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).SecurityLayer -eq 2
$out += [pscustomobject]@{Check='RDP_Enabled'; Result=$rdpEnabled; Detail="NLA_Enforced=$nlaEnabled"}

# 2) Scheduled tasks created/modified in last 7 days (persistence staging)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Date -and ([datetime]$_.Date) -gt $cutoff) {
        $out += [pscustomobject]@{Check='NewScheduledTask'; Result=$_.TaskName; Detail="Path=$($_.TaskPath) Author=$($_.Author)"}
    }
}

# 3) Volume Shadow Copy inventory (expect >0 on servers; zero may indicate pre-encryption tampering)
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$out += [pscustomobject]@{Check='ShadowCopyCount'; Result=($shadows | Measure-Object).Count; Detail='Zero on a server = investigate immediately'}

# 4) Recently created services with suspicious binary paths (PsExec-style / temp-dir payloads)
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match '(?i)(\\temp\\|\\users\\public\\|\\programdata\\[^\\]+\.exe|ADMIN\$|psexesvc)' -and $_.State -eq 'Running'
} | ForEach-Object {
    $out += [pscustomobject]@{Check='SuspiciousService'; Result=$_.Name; Detail=$_.PathName}
}

# 5) Failed logon spike (4625) by source in last 24h — brute force indicator
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
    ForEach-Object { [xml]$x=$_.ToXml(); ($x.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'}).'#text' } |
    Group-Object | Where-Object {$_.Count -gt 25} | ForEach-Object {
        $out += [pscustomobject]@{Check='LogonFailSpike'; Result=$_.Name; Detail="$($_.Count) failures/24h"}
    }

$out | Format-Table -AutoSize
$out | Export-Csv "$env:TEMP\cw_triage_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. Shadow copy tampering — any vssadmin delete shadows, bcdedit recoveryenabled no, or sudden drop to zero shadow copies on servers is a near-term detonation indicator.
2. Staging archives — large .rar/.7z files in C:\ProgramData, user profiles, or DFS/SMB roots created outside backup windows.
3. Anomalous outbound volume — sustained multi-GB egress to unfamiliar cloud storage, MEGA-style endpoints, or VPS ASNs, especially overnight.
4. Mass admin-share enumeration — rapid ADMIN$/C$ connections fanning out from a single workstation (lateral movement origin).
5. EDR/AV tampering — service stops, driver loads targeting security tooling, or Defender exclusions added via GPO change.
6. New privileged accounts or GPO changes — ransomware operators routinely stage a domain-wide payload distribution GPO in the final hours.

Critical Assets This Threat Profile Historically Prioritizes for Exfiltration

• Healthcare claims data and patient records (PHI carries maximum extortion leverage — 5 of 10 claimed listings are healthcare)
• Legal matter files (note the claimed law-firm listing — privileged client data is premium pressure material)
• Finance/payroll exports and HR records
• Backup catalogs and backup admin credentials (destroying recovery capability is part of the extortion play)
• Domain controller NTDS.dit and credential stores (enables both leverage and persistence for re-entry)

Containment Actions, Ordered by Urgency

1. Isolate, don't power off — network-quarantine suspect hosts via EDR; preserve memory for forensics.
2. Disable compromised identities — force-disable any account tied to staging/lateral-movement alerts; reset tier-0 credentials from a clean admin workstation.
3. Block egress at the perimeter — temporarily deny unsanctioned cloud-storage and file-sharing destinations; inspect for in-flight exfiltration.
4. Snapshot and protect backups — verify offline/immutable copies are actually isolated; revoke backup-admin credentials used in the last 30 days.
5. Sever the access path — if perimeter appliances (VPN/firewall) are implicated, patch the KEV-listed CVEs above or take the appliance out of service; do not assume a password reset closes an exploited vulnerability.
6. Engage IR counsel and review notification obligations — particularly for healthcare entities given regulatory breach-notification timelines; a leak-site claim alone does not trigger obligations, but confirmation work should start immediately.

Hardening Recommendations

Immediate (24 Hours)

• Patch the perimeter now: Verify remediation of CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), and CVE-2026-48027 (Nx Console) across your estate. These are KEV-listed with confirmed ransomware exploitation.
• Disable or gate RDP: No direct internet-exposed RDP. Enforce VPN + MFA, or better, move administrative access behind a ZTNA broker.
• Enforce phishing-resistant MFA on all remote access, email, and admin portals — no SMS/OTP for privileged accounts.
• Enable tamper protection and block shadow-copy deletion for standard users; alert on the Sigma rules above.
• Verify backup immutability and test one restore — an untested backup is a hope, not a control.

Short-Term (2 Weeks)

• Segment ruthlessly: Isolate healthcare/clinical systems, backup infrastructure, and management planes (vCenter, backup consoles, CI/CD) into enforcement zones with deny-by-default east-west rules.
• Deploy the detections above into your SIEM/EDR and run the KQL hunt retroactively across the last 30 days.
• Constrain lateral movement: LAPS on all endpoints, disable NTLMv1, restrict WMI/PsExec to dedicated admin workstations via host firewall policy, and implement gMSA/tiering for service accounts.
• Egress control program: Default-deny outbound for server VLANs; allowlist sanctioned storage; DLP alerting on bulk archive types.
• Attack-surface monitoring: Continuously enumerate internet-exposed services (RDP, VPN portals, vCenter, TeamCity) so exploited-CVE windows shrink from months to hours.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub