FULCRUMSEC Ransomware Gang: 15 New Victims Posted — Critical Infrastructure Targeting & Detection Engineering

---
title: Potential FULCRUMSEC Initial Access via SmarterMail Authentication Bypass
description: Detects potential authentication bypass exploitation in SmarterMail servers associated with FULCRUMSEC campaigns
author: Security Arsenal Threat Research Team
date: 2026/05/05
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: webserver
  service: iis, apache, nginx
detection:
  selection:
    c-uri|contains: 
      - '/Services/MailService.asmx'
      - '/Services/Service.asmx/Login'
      - '/SmarterMail/Admin/'
    sc-status:
      - 200
      - 500
  condition: selection
falsepositives:
  - Legitimate SmarterMail administration
level: critical

---
title: FULCRUMSEC Lateral Movement via PsExec with Renamed Binary
description: Detects PsExec usage with renamed binaries commonly used by FULCRUMSEC operators
date: 2026/05/05
author: Security Arsenal Threat Research Team
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|contains:
      - 'ADMIN$'
      - 'IPC$'
    ShareName: '\\*\*'
    SubjectUserName|contains:
      - 'admin'
      - 'administrator'
  filter_legit:
    ProcessName|endswith:
      - '\psexec.exe'
      - '\psexec64.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate system administration
level: high

---
title: FULCRUMSEC Data Staging Prior to Encryption
description: Detects rapid creation of archives and mass file copying patterns typical of FULCRUMSEC exfiltration preparation
date: 2026/05/05
author: Security Arsenal Threat Research Team
logsource:
  product: windows
  service: security
detection:
  selection_7z:
    EventID: 4663
    ObjectType: 'File'
    ObjectName|contains: '.7z'
    AccessMask: '0x2'
  selection_rar:
    EventID: 4663
    ObjectType: 'File'
    ObjectName|contains: '.rar'
    AccessMask: '0x2'
  timeframe: 5m
  condition: (selection_7z or selection_rar) | count() > 10
falsepositives:
  - Legitimate backup operations
  - User-initiated archiving
level: high


**KQL Hunt Query - Lateral Movement Detection**:
kql
// FULCRUMSEC lateral movement hunt
let timeframe = 7d;
SecurityEvent
| where TimeGenerated >= ago(timeframe)
| where EventID in (5140, 5145, 4624, 4625)
| where TargetUserName == "Administrator" or TargetUserName contains "admin"
| where AccountType == "User"
| where Computer != ComputerIP
| summarize count() by Computer, TargetUserName, EventID, bin(TimeGenerated, 1h)
| where count_ > 10
| sort by count_ desc nulls last
| project-rename "Source" = Computer, "TargetAdmin" = TargetUserName, "EventCount" = count_


**Rapid Response PowerShell Script**:
powershell
# FULCRUMSEC Emergency Detection Script
# Checks for indicators of pre-encryption staging

function Test-FulcrumsecIndicators {
    param(
        [int]$HoursToCheck = 24
    )
    
    $CutoffDate = (Get-Date).AddHours(-$HoursToCheck)
    $Results = @()
    
    # Check for recently modified scheduled tasks
    Write-Host "Checking for recently created/modified scheduled tasks..." -ForegroundColor Yellow
    $SuspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $CutoffDate} | 
        Select-Object TaskName, Date, Author, @{N='Command';E={$_.Actions.Execute}}
    if ($SuspiciousTasks) {
        $Results += [PSCustomObject]@{
            Indicator = "Scheduled Task"
            Details = $SuspiciousTasks | ConvertTo-Json -Compress
            Severity = "High"
        }
    }
    
    # Check for recently modified VSS snapshots
    Write-Host "Checking Volume Shadow Copy modifications..." -ForegroundColor Yellow
    $VSSChanges = vssadmin list shadows /for=c: 2>$null | Select-String "Shadow Copy Volume"
    if ($VSSChanges) {
        $Results += [PSCustomObject]@{
            Indicator = "VSS Activity"
            Details = $VSSChanges.Matches.Value
            Severity = "Medium"
        }
    }
    
    # Check for unusual RDP connections
    Write-Host "Checking for RDP connection patterns..." -ForegroundColor Yellow
    $RDPEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=$CutoffDate} -ErrorAction SilentlyContinue |
        Where-Object {$_.Message -match 'Logon Type.*10' -and $_.Message -notmatch 'Source Network Address.*-'} |
        Measure-Object
    
    if ($RDPEvents.Count -gt 50) {
        $Results += [PSCustomObject]@{
            Indicator = "Excessive RDP"
            Details = "$($RDPEvents.Count) RDP connections in past $HoursToCheck hours"
            Severity = "Medium"
        }
    }
    
    # Check for archive creation patterns
    Write-Host "Checking for archive creation patterns..." -ForegroundColor Yellow
    $ArchiveFiles = Get-ChildItem -Path C:\ -Recurse -Include *.7z, *.rar, *.zip -ErrorAction SilentlyContinue |
        Where-Object {$_.LastWriteTime -gt $CutoffDate -and $_.Length -gt 100MB} |
        Measure-Object
    
    if ($ArchiveFiles.Count -gt 0) {
        $Results += [PSCustomObject]@{
            Indicator = "Large Archives"
            Details = "$($ArchiveFiles.Count) large archives created in past $HoursToCheck hours"
            Severity = "Critical"
        }
    }
    
    # Output results
    if ($Results.Count -eq 0) {
        Write-Host "No suspicious activity detected." -ForegroundColor Green
    } else {
        Write-Host "`n[!] SUSPICIOUS ACTIVITY DETECTED:" -ForegroundColor Red
        $Results | Format-Table -AutoSize
    }
    
    return $Results
}

# Execute the check
Test-FulcrumsecIndicators -HoursToCheck 48


---