CVE-2026-61500: Rejetto HFS Weak Signing Key Under Active Scanning — Detection and Remediation Guide

---
title: Rejetto HFS Process Spawning Shell or Script Interpreter
id: 3f8a2c91-6b47-4d5e-9a1c-7e2f4b8d0a35
status: experimental
description: Detects the HFS server process spawning command shells or script interpreters, consistent with post-exploitation activity following CVE-2026-61500 session forgery and code execution.
references:
  - https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.exploitation_for_client_execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\hfs.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - HFS administrator-configured event scripts or plugins that legitimately invoke commands — audit and baseline any configured HFS plugins/scripts
level: high
---
title: Rejetto HFS Scanning and Exploitation Probe Patterns in Web Logs
id: 9d1e5a47-2c83-4f6b-b8e0-5a3c7d1f9e24
status: experimental
description: Detects inbound requests to HFS administrative and session endpoints from single sources at high frequency, consistent with active scanning for CVE-2026-61500 vulnerable instances and forged session usage.
references:
  - https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/~/admin'
      - '/~/login'
      - '/api/'
  selection_cookie:
    cs-cookie|contains:
      - 'hfs.sess'
      - 'session='
  condition: selection_uri and selection_cookie
falsepositives:
  - Legitimate administrator access to the HFS admin console — filter on known admin source IPs
level: medium
---
title: Suspicious File Write by HFS Server Process
id: 5c7b3e12-8f49-4a2d-9e61-2b4d6f8a0c17
status: experimental
description: Detects the HFS server process writing executable or script files to disk, consistent with payload staging after CVE-2026-61500 account takeover.
references:
  - https://www.bleepingcomputer.com/news/security/rejetto-hfs-servers-now-actively-scanned-for-critical-rce-flaw/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: '\hfs.exe'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.js'
  filter_upload_dirs:
    TargetFilename|contains:
      - '\uploads\'
      - '\files\'
  condition: selection and not filter_upload_dirs
falsepositives:
  - Legitimate executable uploads to designated HFS share directories — tune the filter to your actual shared folder paths
level: high

// Hunt 1: HFS spawning suspicious child processes (Defender endpoint telemetry)
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "whoami.exe", "net.exe", "nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "hfs.exe"
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: Scanning/probing against HFS admin and login endpoints via ingested web/firewall logs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/~/admin", "/~/login", "/api/")
| summarize RequestCount = count(), DistinctURLs = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| where RequestCount > 50
| order by RequestCount desc;

// Hunt 3: HFS service making unexpected outbound network connections
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "hfs.exe"
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP), Ports = make_set(RemotePort) by DeviceName, AccountName
| order by Connections desc

-- Security Arsenal: Rejetto HFS CVE-2026-61500 exposure and compromise hunt
-- Identifies running HFS processes, their privilege context, children, and network connections

LET hfs_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)hfs' OR Exe =~ '(?i)hfs\.exe$' OR CommandLine =~ '(?i)hfs'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       'HFS_PROCESS' AS FindingType
FROM hfs_procs

UNION ALL

-- Child processes spawned by HFS (post-exploitation indicator)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       'HFS_CHILD_PROCESS' AS FindingType
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM hfs_procs)
  AND Name =~ '(?i)(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|certutil|curl|wget|sh|bash)'

UNION ALL

-- Network connections held by HFS processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       'HFS_NETWORK' AS FindingType
FROM netstat()
WHERE Pid IN (SELECT Pid FROM hfs_procs)

# Security Arsenal - CVE-2026-61500 HFS exposure check and interim hardening (Windows)
# Run elevated on suspected hosts or via your RMM/SCCM across the fleet

$report = @()

# 1. Find running HFS processes and their privilege context
$hfsProcs = Get-Process -Name "hfs" -ErrorAction SilentlyContinue
foreach ($p in $hfsProcs) {
    $owner = (Get-CimInstance Win32_Process -Filter "ProcessId=$($p.Id)").GetOwner()
    $report += [PSCustomObject]@{
        Host        = $env:COMPUTERNAME
        PID         = $p.Id
        Path        = $p.Path
        RunAsUser   = "$($owner.Domain)\$($owner.User)"
        StartTime   = $p.StartTime
        Finding     = "RUNNING_HFS"
    }
    Write-Warning "HFS RUNNING: PID $($p.Id) | $($p.Path) | User: $($owner.User)"

    # Flag if running as SYSTEM or Administrator - massive blast radius for RCE
    if ($owner.User -in @("SYSTEM", "Administrator")) {
        Write-Error "CRITICAL: HFS running as privileged account $($owner.User) - RCE = full host compromise"
    }
}

# 2. Find on-disk HFS installations (including dormant ones)
$hfsPaths = Get-ChildItem -Path "C:\", "$env:ProgramFiles", "${env:ProgramFiles(x86)}", "C:\Users" `
    -Recurse -Filter "hfs.exe" -ErrorAction SilentlyContinue -Depth 4
foreach ($f in $hfsPaths) {
    $report += [PSCustomObject]@{
        Host = $env:COMPUTERNAME; PID = $null; Path = $f.FullName
        RunAsUser = $null; StartTime = $null; Finding = "HFS_BINARY_ON_DISK"
    }
}

# 3. Check for HFS listening ports (default 80/8080 - confirm against your config)
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.OwningProcess -in ($hfsProcs.Id) }
$listeners | ForEach-Object {
    Write-Warning "HFS LISTENING on port $($_.LocalPort) - verify firewall exposure"
}

# 4. Export findings for central collection
$report | Export-Csv -Path "C:\Windows\Temp\hfs_exposure_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Output "Inventory complete. Remediate: update HFS per vendor advisory, rotate all sessions, restrict service account, firewall the admin console."

#!/bin/bash
# Security Arsenal - CVE-2026-61500 HFS exposure check (Linux)
# Run via SSH/Ansible across your Linux estate

echo "=== HFS Exposure Check: $(hostname) ==="

# 1. Running HFS processes and privilege context
ps aux | grep -i [h]fs | while read -r line; do
    echo "[RUNNING] $line"
    if echo "$line" | grep -qE '^root'; then
        echo "[CRITICAL] HFS running as root - RCE yields full host compromise"
    fi
done

# 2. HFS binaries on disk (node-based installs included)
echo "--- On-disk installations ---"
find /opt /srv /home /usr/local /var/www -maxdepth 4 \( -iname "hfs" -o -iname "hfs.exe" -o -path "*/hfs/*" -iname "*.js" \) 2>/dev/null | head -50
npm ls -g 2>/dev/null | grep -i hfs

# 3. Listening sockets owned by node/hfs processes
echo "--- Listeners ---"
ss -tlnp 2>/dev/null | grep -iE 'node|hfs'

# 4. Suspicious children of HFS (post-exploitation indicator)
echo "--- Suspicious HFS child processes ---"
for pid in $(pgrep -i hfs); do
    ps --ppid "$pid" -o pid,comm,args 2>/dev/null | grep -E 'sh|bash|curl|wget|nc|python|perl' && \
        echo "[ALERT] HFS PID $pid spawned suspicious child - investigate immediately"
done

echo "=== Remediation: update HFS, invalidate sessions, run as dedicated low-priv user, restrict admin UI to localhost/VPN ==="