GLOBAL SECRET GROUP Ransomware: 3 New Victims in 24 Hours — Financial Services Under Fire, VPN Edge Exploitation Suspected

---
title: GLOBAL SECRET GROUP - Suspicious VPN/Edge Gateway Authentication Anomalies
id: 9a3e1f2d-7b4c-4d5e-9f6a-gsg20260001
status: experimental
description: Detects authentication anomalies consistent with Check Point IKEv1 improper authentication exploitation (CVE-2026-50751) and VPN credential abuse patterns used by GLOBAL SECRET GROUP affiliates for initial access.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: authentication
    product: checkpoint
detection:
    selection_failed_burst:
        outcome: failure
    condition_count: selection_failed_burst | count() by src_ip > 15
    selection_success_after_fail:
        outcome: success
    timeframe: 10m
    condition: selection_failed_burst and selection_success_after_fail
falsepositives:
    - Misconfigured VPN clients retrying
    - Legacy IKEv1 clients with incorrect pre-shared keys
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1078
    - cve.2026.50751
---
title: GLOBAL SECRET GROUP - RMM Tool Execution with Unsigned or Anomalous Binary Path
id: 9a3e1f2d-7b4c-4d5e-9f6a-gsg20260002
status: experimental
description: Detects execution of remote access tooling (ScreenConnect-class) from non-standard paths or with suspicious command lines, matching affiliate TTPs for hands-on-keyboard access prior to ransomware staging.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_binary_names:
        Image|endswith:
            - '\screenconnect.client.exe'
            - '\screenconnect.clientservice.exe'
            - '\connectwisecontrol.exe'
    selection_suspicious_paths:
        Image|contains:
            - '\Users\Public\'
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
            - '\Windows\Temp\'
            - 'C:\PerfLogs\'
    selection_loops:
        CommandLine|contains:
            - 'relay'
            - 'session'
            - 'install'
    condition: selection_binary_names and (selection_suspicious_paths or selection_loops)
falsepositives:
    - Legitimate MSP deployments (whitelist your known MSP installation paths)
    - IT department remote support sessions
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - cve.2024.1708
---
title: GLOBAL SECRET GROUP - Pre-Ransomware Data Staging and Shadow Copy Destruction
id: 9a3e1f2d-7b4c-4d5e-9f6a-gsg20260003
status: experimental
description: Detects the pre-encryption staging sequence common to GLOBAL SECRET GROUP and peer RaaS affiliates - shadow copy deletion followed by mass archive creation, indicating imminent detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
            - '\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
            - 'delete catalog'
    selection_archivers:
        Image|endswith:
            - '\rar.exe'
            - '\7z.exe'
            - '\7za.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - '-p'
            - ' -v'
    condition: selection_vss or selection_archivers
falsepositives:
    - Legitimate backup maintenance (restrict to backup windows/service accounts)
    - Software deployment archival steps
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001

// GLOBAL SECRET GROUP hunt - lateral movement + staging cluster
// Lookback: 7 days. Tune threshold to environment baseline.
let lookback = 7d;
let PseExecSvc = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec", "RemCom")
        or ServiceFileName has_any ("\\\\", "ADMIN$", "C$\