GENESIS Ransomware Gang: 4 Victims Posted in 48 Hours — US Healthcare Under Active Targeting, Detection Rules Inside

Classification: TLP:CLEAR | Publication Date: 2026-08-12 | Source: Security Arsenal Dark Web Collection (ransomware.live) | Confidence: Moderate-High on victimology, Low-Moderate on actor attribution

Executive Summary

Between 2026-08-10 and 2026-08-11, the GENESIS ransomware operation posted 4 new victims to its .onion leak site. Three of the four confirmed victims are US healthcare organizations, including two separate postings naming Interim HealthCare entities — a pattern consistent with either a franchise-wide compromise or deliberate pressure amplification against a single enterprise. All confirmed victims are US-based. This briefing translates GENESIS's current leak site activity into detection engineering content, incident response priorities, and hardening actions for enterprise defenders — particularly healthcare delivery organizations and their managed service providers.

Threat Actor Profile — GENESIS

Attribution caveat: GENESIS is a low-to-mid-volume operation with limited public technical reporting compared to top-tier crews. The profile below blends confirmed leak site telemetry with assessed characteristics typical of operations at this maturity tier. Treat actor-specific TTP claims as analytical assessments, not ground truth.

Current Campaign Analysis

Sector Targeting

Healthcare is the dominant theme in this posting burst:

• Interim HealthCare (Healthcare, US) — posted 2026-08-10
• Consolidated Medical Practices of Memphis (Healthcare, US) — posted 2026-08-10
• Interim HealthCare (Oklahoma and Tulsa) (Healthcare, US) — posted 2026-08-10
• E* (sector redacted, US) — posted 2026-08-11

The dual Interim HealthCare postings are analytically significant. Ransomware crews typically split postings for one enterprise when (a) a regional franchise/office is claimed separately to maximize negotiation pressure, or (b) affiliates compromised distinct segments of a shared IT environment. Healthcare defenders operating franchise or multi-site models should treat one posting as an enterprise-wide incident until proven otherwise.

Geographic Concentration

100% of confirmed victims are United States organizations. No cross-border victimology observed in the current 100-posting window.

Victim Profile

The named victims fit the classic mid-market healthcare target band: regional home-health franchises and multi-site physician practices, typically $10M–$250M revenue, running lean IT teams, often dependent on outsourced MSPs, and holding high-value regulated data (PHI) with strong statutory breach notification obligations — the exact leverage profile double-extortion crews optimize for.

Posting Frequency & Escalation

4 postings in ~48 hours represents a sharp burst for a group with only 4 entries in its last-100 window sampled. This is consistent with either a campaign wave against a single vertical or recently onboarded affiliates dumping staged access. Monitor for a second wave within 7–14 days; burst patterns of this type historically recur.

Probable Initial Access — CVE Correlation

The following CISA KEV entries with confirmed ransomware use are temporally correlated with GENESIS's operating window and are assessed as candidate initial access vectors:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1 key exchange). Edge VPN auth bypass — the highest-probability vector for this victim set. Patch and audit IKEv1 logs immediately.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. Healthcare MSPs are heavy ScreenConnect users; RMM abuse explains both initial access and lateral reach across multi-site victims.
• CVE-2023-21529 — Microsoft Exchange deserialization (authenticated RCE). Relevant where on-prem Exchange remains.
• CVE-2026-20131 — Cisco FMC / Security Cloud Control deserialization. Firewall management plane compromise provides both access and blind-spot creation.
• CVE-2026-48027 — Nx Console embedded malicious code (supply chain). Lower probability for this victim set but relevant to developer-adjacent networks.

Priority patching order for healthcare defenders: Check Point VPN → ScreenConnect → Exchange → Cisco FMC.

Detection Engineering

The rules below target the assessed GENESIS playbook: edge/RMM initial access, PsExec/WMI lateral movement, and pre-encryption staging (mass archival + shadow copy destruction). Tune allowlists to your environment before production deployment.

---
title: Suspicious Child Process Spawned by VPN or Firewall Management Components
description: Detects shell or scripting interpreters spawned by network edge device management processes or RMM tooling, consistent with post-exploitation following Check Point IKEv1 auth bypass (CVE-2026-50751), Cisco FMC deserialization (CVE-2026-20131), or ScreenConnect abuse (CVE-2024-1708). Correlated with GENESIS ransomware campaign activity 2026-08.
author: Security Arsenal Threat Intelligence
date: 2026/08/12
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\ScreenConnect'
      - '\connectwise'
      - '\cp\'                    # Check Point management processes
      - '\firewall\'
      - '\fmc\'
    ParentCommandLine|contains:
      - 'screenconnect'
      - 'connectwisecontrol'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
  filter_known_admin:
    CommandLine|contains:
      - 'healthcheck'
      - 'softwareupdate'
  condition: selection_parent and selection_child and not filter_known_admin
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate RMM administrative scripting — baseline approved admin accounts and scripts
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
  - cve.2026.50751
  - cve.2024.1708
---
title: PsExec-Style Remote Service Creation for Lateral Movement
description: Detects remote service installation events (Event ID 7045) with service binaries executed from ADMIN$ or named-pipe-style random service names, consistent with PsExec and Cobalt Strike psexec_psh lateral movement observed in mid-tier ransomware intrusions including GENESIS-assessed playbook.
author: Security Arsenal Threat Intelligence
date: 2026/08/12
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_path:
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\%SystemRoot%\\'
      - '%COMSPEC%'
      - 'powershell'
  selection_name:
    ServiceName|re: '^[A-Za-z0-9]{4,8}$'   # short random service names typical of PsExec/CS
  condition: selection_event and (selection_path or selection_name)
fields:
  - ServiceName
  - ServiceFileName
  - AccountName
falsepositives:
  - Legitimate software deployment tooling (SCCM, PDQ) — allowlist known deployment service names
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1543.003
---
title: Pre-Ransomware Staging - Shadow Copy Deletion Combined with Mass Archival
description: Detects Volume Shadow Copy destruction (vssadmin, wmic, diskshadow, bcdedit recovery tampering) and mass compression utility execution (rar, 7z) indicative of data staging for double extortion. Pre-encryption behaviors assessed in GENESIS healthcare campaign 2026-08.
author: Security Arsenal Threat Intelligence
date: 2026/08/12
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\diskshadow.exe'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'bootstatuspolicy ignoreallfailures'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '              # add-to-archive switch
      - '-p'               # password-protected archive
      - '-v'               # volume splitting for staged exfil
  condition: 1 of selection_vss or selection_archive
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Backup administrators running legitimate shadow maintenance — scope by service account
  - Developers using 7-Zip interactively — alert weighting should increase with host count and off-hours execution
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.collection

Hunt logic (Sentinel): Correlate mass archival with shadow copy tampering and new service creation per host inside a 6-hour window — the classic pre-detonation sequence. A single host matching two or more of these behaviors within the window should page the on-call responder.

// GENESIS pre-ransomware staging hunt — correlates archival + VSS tampering + remote service creation
// Lookback: 14 days | Tuning: exclude known backup service accounts in Allowlist
let Lookback = 14d;
let CorrelationWindow = 6h;
let AllowlistedAccounts = dynamic(["svc_backup", "svc_veeam"]);
let VssEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("vssadmin.exe","wmic.exe","diskshadow.exe","bcdedit.exe")
    | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","ignoreallfailures")
    | where AccountName !in~ (AllowlistedAccounts)
    | summarize VssHits=count(), VssCmds=make_set(ProcessCommandLine,3) by DeviceName, bin(TimeGenerated, 1h);
let ArchiveEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe")
    | where ProcessCommandLine has_any (" a "," -p"," -v")
    | summarize ArchiveHits=count(), ArchiveCmds=make_set(ProcessCommandLine,3) by DeviceName, bin(TimeGenerated, 1h);
let ServiceEvents =
    Event
    | where TimeGenerated > ago(Lookback)
    | where EventLog == "System" and EventID == 7045
    | extend ServiceFile = tostring(parse_json(EventData).ServiceFileName)
    | extend ServiceName = tostring(parse_json(EventData).ServiceName)
    | where ServiceFile has_any ("ADMIN$","powershell","%COMSPEC%") or ServiceName matches regex "^[A-Za-z0-9]{4,8}$"
    | summarize SvcHits=count(), Svcs=make_set(ServiceName,5) by Computer, bin(TimeGenerated, 1h);
VssEvents
| join kind=inner ArchiveEvents on DeviceName, TimeGenerated
| join kind=inner (ServiceEvents | project Computer, TimeGenerated, SvcHits, Svcs)
    on $left.DeviceName == $right.Computer and $left.TimeGenerated == $right.TimeGenerated
| where VssHits + ArchiveHits + SvcHits >= 2
| project DeviceName, TimeGenerated, VssHits, VssCmds, ArchiveHits, ArchiveCmds, SvcHits, Svcs
| sort by TimeGenerated desc;

Rapid triage script: Run on suspected-compromised hosts or via your RMM/EDR remote shell during the first hour of response. It surfaces the three artifacts this playbook leaves behind: recent scheduled tasks (persistence), shadow copy state (staging), and exposed RDP (access path validation).

# GENESIS Rapid Triage — persistence, staging, and exposure checks
# Run elevated. Output: console + C:\IR-Triage-<host>.txt
$report = "C:\IR-Triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
function Section($t){ "`n===== $t =====" | Tee-Object -FilePath $report -Append }

Section "SCHEDULED TASKS CREATED/MODIFIED IN LAST 7 DAYS"
Get-ScheduledTask | ForEach-Object {
    $i = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author;
        Action=($_.Actions | ForEach-Object Execute) -join '; ' }
} | Where-Object { $_.Action -match 'powershell|cmd|rundll32|wscript|mshta|\\users\\|\\programdata\\|\\temp\\' } |
  Format-Table -AutoSize | Tee-Object -FilePath $report -Append

Section "VOLUME SHADOW COPY STATE (expect entries; EMPTY output = possible destruction)"
vssadmin list shadows 2>&1 | Tee-Object -FilePath $report -Append

Section "RDP EXPOSURE CHECK"
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - INVESTIGATE'}else{'No'})" | Tee-Object -FilePath $report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress,LocalPort,State | Format-Table -AutoSize | Tee-Object -FilePath $report -Append

Section "SUSPICIOUS SERVICES INSTALLED IN LAST 7 DAYS"
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}} |
  Format-Table -AutoSize | Tee-Object -FilePath $report -Append

Section "MASS-ARCHIVAL UTILITY EXECUTION (recent prefetch artifacts)"
Get-ChildItem "C:\Windows\Prefetch" -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'RAR|7Z|WINRAR|MEGA|RCLONE|FILEZILLA' -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
  Select-Object Name, LastWriteTime | Format-Table -AutoSize | Tee-Object -FilePath $report -Append

Write-Host "`nTriage complete: $report" -ForegroundColor Cyan

Incident Response Priorities — GENESIS Playbook

T-Minus Detection Checklist (Before Encryption Fires)

1. Edge device logs — IKEv1 authentication anomalies on Check Point gateways (CVE-2026-50751): successful logins from unrecognized source IPs, especially followed by configuration export or new local admin account creation.
2. RMM telemetry — ScreenConnect sessions from hosts outside your approved technician pool; new unattended access agents installed in the last 14 days.
3. Mass file reads — burst reads against file shares/EMR exports from a single host (staging indicator, typically T-72 to T-24 hours).
4. Compression artifacts — rar/7z execution with password (-p) and volume-split (-v) switches.
5. Exfil channels — outbound transfers to MEGA, Rclone-configured cloud endpoints, or unfamiliar SFTP destinations; sudden egress spikes >3x baseline.
6. Shadow copy tampering — any vssadmin delete shadows outside backup maintenance windows is a detonation-imminent signal.
7. Backup targeting — Veeam/backup console logins from non-backup-admin accounts; attempted deletion of restore points.

Critical Assets Prioritized for Exfiltration (Healthcare Campaign)

• PHI repositories: EMR exports, billing databases, scanned records stores — highest extortion leverage.
• HR/payroll: W-2s, SSNs — secondary extortion and downstream fraud value.
• Email of executives and compliance officers — contract and breach-notification intelligence for negotiation.
• Cyber insurance policies — used to calibrate demand sizing. Restrict policy document access.

Containment Actions by Urgency

Hardening Recommendations

Immediate (24 Hours)

1. Patch Check Point Security Gateway (CVE-2026-50751) on all internet-facing VPN concentrators; if patching is delayed, disable IKEv1 and rotate to IKEv2-only. Audit auth logs for the past 30 days.
2. Update ConnectWise ScreenConnect (CVE-2024-1708) across all MSP-managed endpoints; enumerate and remove unauthorized RMM agents (ScreenConnect, AnyDesk, Splashtop, Atera) not on your approved list.
3. Patch on-prem Exchange (CVE-2023-21529) and Cisco FMC (CVE-2026-20131); confirm FMC management interfaces are not internet-reachable.
4. Enable tamper protection on EDR and block vssadmin delete shadows for non-backup service accounts via AppLocker/WDAC.
5. Egress filtering — block consumer file-transfer services and alert on >10GB/hour outbound from any single host.
6. Deploy the Sigma and KQL content above to production with your environment's allowlists.

Short-Term (2 Weeks)

1. Segment clinical from corporate — EMR/medical device VLANs with default-deny east-west; the dual Interim HealthCare postings show how flat multi-site networks turn one intrusion into two leak posts.
2. Tier-0 identity isolation — dedicated PAWs for domain/backup administration; no Tier-0 logons on general-purpose workstations.
3. Immutable backups — object-lock or air-gapped copies with a tested restore runbook; ransomware crews at this tier specifically hunt backup consoles.
4. VPN replacement roadmap — edge VPN appliances are the dominant ransomware entry point in 2026; evaluate ZTNA migration and, in the interim, enforce phishing-resistant MFA plus device certificates on all remote access.
5. MSP/RMM governance — contractually require MSPs to disclose tooling, enforce MFA on technician access, and provide session logging; RMM abuse is the connective tissue across multi-site healthcare compromises.
6. Tabletop the leak site scenario — rehearse decision-making for a double-extortion event involving PHI, including legal, OCR notification, and ransom-payment counsel, before you need it.

Analyst Note

GENESIS's current burst is small in volume but precise in vertical selection. Healthcare organizations — particularly franchise-model home health and regional practice groups — should assume they are in this crew's active target pool for at least the next 2–4 weeks. The fastest win available to defenders right now is edge device patching and shadow copy protection: both directly break the assessed intrusion chain at its cheapest points.

Security Arsenal will continue monitoring GENESIS's leak site and will update this bulletin if a second posting wave materializes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub