GENESIS Ransomware: US Sector Blitz — Critical Exploitation of ScreenConnect & Firewall Management Flaws

title: Potential Genesis Ransomware ScreenConnect Exploitation
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerabilities (CVE-2024-1708) often used by Genesis for initial access.
status: experimental
date: 2026/06/03
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Guest/.aspx'
            - '/Handler.ashx?'
        cs-method: POST
    condition: selection
falsepositives:
    - Legitimate administrative use of ScreenConnect
level: high
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.genesis
---
title: Genesis Campaign SmarterMail File Upload Exploit
description: Detects suspicious file upload patterns indicative of CVE-2025-52691 exploitation targeting SmarterMail servers used in this campaign.
status: experimental
date: 2026/06/03
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri-stem|contains:
            - '/Mailservice.asmx'
            - '/Services/MailService.asmx'
    selection_ext:
        cs-uri-query|contains:
            - '.aspx'
            - '.ashx'
            - '.asp'
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical
tags:
    - attack.initial_access
    - cve.2025.52691
    - ransomware.genesis
---
title: Ransomware Data Staging Via Rclone
description: Detects the use of rclone, a tool frequently used by ransomware gangs including Genesis for data exfiltration prior to encryption.
status: experimental
date: 2026/06/03
author: Security Arsenal Research
logsource:
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
    selection_cli:
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'megacopy'
            - 'config create'
    condition: all of selection_*
falsepositives:
    - Legitimate administrator backups
level: high
tags:
    - attack.exfiltration
    - attack.t1041

let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Hunt for ScreenConnect suspicious processes
| where (ProcessCommandLine contains "ScreenConnect" and ProcessCommandLine contains "setup") or
       (FileName =~ "w3wp.exe" and ProcessCommandLine contains "Mailservice.asmx") or
// Hunt for Genesis common staging tools
       (ProcessCommandLine contains "rclone" or ProcessCommandLine contains "mimikatz" or
        ProcessCommandLine contains "procdump" and ProcessCommandLine contains "-ma")
// Correlate with Network connection attempts to known C2 or non-standard ports
| join kind=inner (DeviceNetworkEvents 
    | where Timestamp > ago(TimeFrame) 
    | where RemotePort in (80, 443, 8040, 4433) 
    | distinct DeviceId, InitiatingProcessFileName, RemoteUrl) 
    on DeviceId, InitiatingProcessFileName
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemotePort, InitiatingProcessAccountName
| order by Timestamp desc

<#
    Genesis Ransomware Rapid Response Script
    Checks for persistence, Shadow Copy deletions, and ScreenConnect anomalies.
#>

Write-Host "[!] Starting Genesis Threat Hunt..." -ForegroundColor Cyan

# 1. Check for Shadow Copy Deletion Attempts
$ShadowCopyEvents = Get-WinEvent -LogName "Microsoft-Windows-System/Operational" -FilterXPath "*[System[(EventID=70)]] and *[EventData[Data[@Name='Context']]]" -ErrorAction SilentlyContinue
if ($ShadowCopyEvents) {
    Write-Host "[WARNING] Potential vssadmin.exe execution found in System Logs." -ForegroundColor Red
    $ShadowCopyEvents | Select-Object TimeCreated, Message | Format-Table -AutoSize
} else {
    Write-Host "[OK] No immediate vssadmin deletion events detected." -ForegroundColor Green
}

# 2. Hunt for Suspicious Scheduled Tasks (Last 7 Days)
$suspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Get-ScheduledTaskInfo
if ($suspiciousTasks) {
    Write-Host "[WARNING] Scheduled tasks created/modified in the last 7 days:" -ForegroundColor Yellow
    $suspiciousTasks | Select-Object TaskName, LastRunTime, TaskPath
}

# 3. Check for ScreenConnect Service Anomalies (CVE-2024-1708)
$scService = Get-Service -Name "ScreenConnect*" -ErrorAction SilentlyContinue
if ($scService) {
    Write-Host "[INFO] ScreenConnect Service Detected. Verifying Binary Path..." -ForegroundColor Cyan
    $scPath = (Get-WmiObject -Class Win32_Service -Filter "Name like '%ScreenConnect%'").PathName
    Write-Host "Path: $scPath"
    # Check for unauthorized web shells in the web root (heuristic)
    $webRoot = "C:\Program Files (x86)\ScreenConnect\App_Web\"
    if (Test-Path $webRoot) {
        $recentFiles = Get-ChildItem -Path $webRoot -Recurse -File | Where-Object {$_.LastWriteTime -gt (Get-Date).AddHours(-24)}
        if ($recentFiles) {
            Write-Host "[CRITICAL] Recent files detected in ScreenConnect Web Root (Potential Web Shell):" -ForegroundColor Red
            $recentFiles | Select-Object FullName, LastWriteTime
        }
    }
}

# 4. Check for SmarterMail/IIS Worker Process Spawning Cmd
$parentProcs = Get-WmiObject Win32_Process | Where-Object {$_.Name -eq "cmd.exe" -or $_.Name -eq "powershell.exe"}
foreach ($proc in $parentProcs) {
    $parent = Get-WmiObject Win32_Process | Where-Object {$_.ProcessId -eq $proc.ParentProcessId}
    if ($parent.Name -eq "w3wp.exe") {
        Write-Host "[CRITICAL] IIS Worker Process spawning Shell (Potential SmarterMail Exploit):" -ForegroundColor Red
        Write-Host "PID: $($proc.ProcessId) Command: $($proc.CommandLine)"
    }
}
Write-Host "[!] Hunt Complete." -ForegroundColor Cyan