FULCRUMSEC Ransomware: High-Volume Campaign Targets US Healthcare & Tech — Exploitation of Exchange & Firewall CVEs

---
title: Potential Microsoft Exchange Deserialization Exploit CVE-2023-21529
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential exploitation of Microsoft Exchange Server Deserialization of Untrusted Data vulnerability (CVE-2023-21529) based on suspicious Exchange Backend process patterns.
status: experimental
date: 2026/05/02
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140 or 5145
        ShareName|contains: 'Exchange'
        SubjectUserName|contains: 'IIS APPPOOL'
    filter_legit:
        IpAddress:
            - '127.0.0.1'
            - '::1'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate Exchange administrative activity from internal IPs
level: high
---
title: SmarterMail Unrestricted File Upload Activity CVE-2025-52691
id: b2c3d4e5-6789-01bc-def2-2345678901bc
description: Detects suspicious file creation patterns in SmarterMail web roots indicative of exploitation of CVE-2025-52691.
status: experimental
date: 2026/05/02
author: Security Arsenal Research
logsource:
    product: windows
    file_creation: true
detection:
    selection:
        TargetFilename|contains:
            - 'MRS\'
            - 'SmarterMail\'
        TargetFilename|contains:
            - '.aspx'
            - '.ashx'
            - '.config'
    timeframe: 1m
    condition: selection
falsepositives:
    - Software updates or legitimate administrative uploads
level: critical
---
title: FULCRUMSEC Lateral Movement via WMI Event Subscription
id: c3d4e5f6-7890-12cd-ef23-3456789012cd
description: Detects lateral movement techniques consistent with FULCRUMSEC operations using WMI for remote code execution.
status: experimental
date: 2026/05/02
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
        LogonProcessName|contains: 'Advapi'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Network logons by service accounts
level: medium

// Hunt for evidence of SmarterMail exploitation and subsequent lateral movement
// Look for web shell access patterns or unexpected processes launched by IIS
SecurityEvent
| where EventID in (5140, 5145, 4688)
| extend FilePath = iff(EventID == 4688, NewProcessName, TargetFileName)
| extend Account = iff(EventID == 4688, SubjectUserName, SubjectUserName)
| where FilePath has "SmarterMail" or FilePath has "Exchange"
| where Account !contains "$" and Account != "SYSTEM"
| project TimeGenerated, Computer, Account, EventID, FilePath, ProcessCommandLine
| sort by TimeGenerated desc

<#
.SYNOPSIS
    FULCRUMSEC Response: Audit Exchange and SmarterMail Security Posture.
.DESCRIPTION
    Checks for recent suspicious scheduled tasks and exposed file extensions in web roots.
#>

Write-Host "[+] Checking for recently created Scheduled Tasks (Last 7 Days)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, Author, Date, State

Write-Host "[+] Checking for suspicious ASP/ASPX files in inetpub..." -ForegroundColor Cyan
$Paths = @("C:\inetpub", "C:\Program Files\SmarterTools")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include *.aspx, *.ashx, *.config -ErrorAction SilentlyContinue | 
        Where-Object {$_.LastWriteTime -gt (Get-Date).AddHours(-24)} | 
        Select-Object FullName, LastWriteTime
    }
}

Write-Host "[+] Verifying Exchange Patch Status (Checking DLL Version) ..." -ForegroundColor Cyan
# This is a simplified check; verify against MSRC bulletin for CVE-2023-21529
$ExchangePath = "C:\Program Files\Microsoft\Exchange Server\V15\Bin"
if (Test-Path $ExchangePath) {
    Get-Item "$ExchangePath\Microsoft.Exchange.Diagnostics.dll" | Select-Object Name, VersionInfo
}