HELIX Ransomware Gang: 5 New Victims Posted in 24 Hours — Transportation & Financial Services Surge, Detection Rules Included

---
title: HELIX Ransomware - Check Point VPN Anomalous Authentication (CVE-2026-50751)
id: 7f3a91c2-helix-0001-4c2d-8e5f-a1b2c3d4e5f6
status: experimental
description: Detects anomalous IKEv1/VPN authentication patterns consistent with Check Point Security Gateway improper authentication exploitation (CVE-2026-50751), a suspected HELIX initial access vector. Fires on successful VPN auth from rare source IPs outside business hours or from known VPS/TOR exit ranges, followed by internal authentication.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: authentication
    product: checkpoint
    service: vpn
detection:
    selection_success:
        action: 'login successful'
    filter_known_users:
        user|startswith:
            - 'svc_'
            - 'vpn-service'
    selection_suspicious_time:
        # Auth events between 00:00-05:00 local — HELIX affiliates operate RU/EU hours
        event_time|contains:
            - 'T00:'
            - 'T01:'
            - 'T02:'
            - 'T03:'
            - 'T04:'
    selection_new_source:
        src_ip|cidr:
            - '45.0.0.0/8'      # placeholder — replace with your rare-IP / VPS ASN feed
            - '185.0.0.0/8'
    condition: selection_success and (selection_suspicious_time or selection_new_source) and not filter_known_users
falsepositives:
    - Legitimate traveling users on new networks
    - MSP after-hours maintenance
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
---
title: HELIX Ransomware - Pre-Encryption Staging and Shadow Copy Destruction
id: 7f3a91c2-helix-0002-4c2d-8e5f-b2c3d4e5f6a7
status: tested
description: Detects the canonical HELIX pre-detonation sequence — Volume Shadow Copy deletion via vssadmin/wmic/powershell combined with boot recovery disablement via bcdedit. This command cluster fires minutes before encryption and is a last-chance detection opportunity.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith: '\vssadmin.exe'
          CommandLine|contains:
              - 'delete shadows'
              - 'resize shadowstorage'
        - Image|endswith: '\wmic.exe'
          CommandLine|contains: 'shadowcopy delete'
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
          CommandLine|contains:
              - 'Get-WmiObject Win32_Shadowcopy'
              - 'Remove-WmiObject'
              - 'vssadmin delete shadows'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    condition: 1 of selection_*
falsepositives:
    - Legitimate backup maintenance scripts (rare to combine with bcdedit)
    - Storage admins resizing shadowstorage
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.defense_evasion
---
title: HELIX Ransomware - Lateral Movement via PsExec/WMI and Staging Archive Creation
id: 7f3a91c2-helix-0003-4c2d-8e5f-c3d4e5f6a7b8
status: tested
description: Detects HELIX lateral movement tooling — remote service creation (PsExec-style), WMI process spawn on remote hosts, and mass archive creation in staging directories consistent with pre-exfiltration data collection. HELIX affiliates stage data in C:\ProgramData and user temp paths before exfil to MEGA/rclone endpoints.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        - Image|endswith:
              - '\psexec.exe'
              - '\paexec.exe'
              - '\csexec.exe'
        - CommandLine|contains:
              - '\\'
              - '-accepteula'
    selection_wmi_remote:
        Image|endswith: '\wmiprvse.exe'
        ParentImage|endswith: '\svchost.exe'
        CommandLine|contains: '-Embedding'
    selection_staging:
        Image|endswith:
            - '\7z.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - 'C:\ProgramData'
            - 'AppData\Local\Temp'
            - ' a '
            - '-p'
    selection_rclone:
        Image|endswith: '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - '--config'
    condition: selection_psexec or selection_staging or selection_rclone
falsepositives:
    - IT admin software deployment via PsExec
    - Legitimate WinRAR usage by end users (tune by parent process)
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
    - attack.collection
    - attack.t1560.001
    - attack.exfiltration
    - attack.t1567.002

// HELIX Pre-Ransomware Staging & Lateral Movement Hunt
// Hunts the full pre-detonation kill chain: suspicious VPN ingress →
// new admin-tool execution → mass file staging → shadow copy deletion.
// Lookback: 14 days (matches HELIX estimated dwell time)
let lookback = 14d;
let stagingPaths = dynamic([@"C:\ProgramData\", @"\AppData\Local\Temp\", @"C:\Users\Public\"]);
// Stage 1: Rare admin tooling execution clustered on hosts
let suspiciousHosts = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName in~ ("psexec.exe","paexec.exe","rclone.exe","7z.exe","rar.exe","winscp.exe","anydesk.exe","screenconnect.client.exe")
   or ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","recoveryenabled no","ignoreallfailures")
| summarize ToolCount = dcount(FileName),
            Tools = make_set(FileName),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by DeviceName, AccountName
| where ToolCount >= 2;
// Stage 2: Correlate with mass file access (staging/exfil precursor)
let massFileAccess = DeviceFileEvents
| where TimeGenerated >= ago(lookback)
| where FolderPath has_any (stagingPaths)
| where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar"
| summarize ArchiveCount = count(), Archives = make_set(FileName, 20)
    by DeviceName
| where ArchiveCount >= 3;
// Stage 3: Join — hosts doing BOTH are high-fidelity pre-ransomware candidates
suspiciousHosts
| join kind=inner massFileAccess on DeviceName
| extend RiskScore = ToolCount * 10 + ArchiveCount * 5
| project DeviceName, AccountName, Tools, FirstSeen, LastSeen, ArchiveCount, Archives, RiskScore
| order by RiskScore desc
// Pivot: investigate any host where vssadmin/wmic shadow deletion appears —
// that host is likely MINUTES from detonation. Isolate immediately.

# HELIX Rapid Response Triage — Run via PSRemoting/Intune across fleet
# Checks: recent scheduled tasks, VSS tampering, exposed RDP, suspicious staging archives
# Security Arsenal Threat Intelligence — 2026-08-07

$report = @()
$cutoff = (Get-Date).AddDays(-7)

Write-Host "[1/5] Scheduled tasks created in last 7 days (persistence check)..." -ForegroundColor Cyan
$recentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $cutoff -and
    $_.TaskPath -notlike "\Microsoft*"
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
if ($recentTasks) { $report += "SUSPICIOUS TASKS: $($recentTasks | Out-String)" }

Write-Host "[2/5] Volume Shadow Copy status (HELIX deletes VSS pre-encryption)..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$vssSvc  = Get-Service VSS -ErrorAction SilentlyContinue
if (-not $shadows) { $report += "CRITICAL: No shadow copies present on $env:COMPUTERNAME — possible vssadmin deletion" }
if ($vssSvc.Status -ne 'Running') { $report += "WARNING: VSS service stopped on $env:COMPUTERNAME" }

Write-Host "[3/5] RDP exposure check..." -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
if ($rdpEnabled -and -not $nlaEnabled) { $report += "HIGH RISK: RDP enabled WITHOUT NLA on $env:COMPUTERNAME" }

Write-Host "[4/5] Staging archive hunt (ProgramData/Public)..." -ForegroundColor Cyan
$staging = Get-ChildItem 'C:\ProgramData','C:\Users\Public' -Recurse -Depth 2 -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 50MB }
if ($staging) { $report += "STAGING ARCHIVES FOUND: $($staging.FullName -join '; ')" }

Write-Host "[5/5] Recent security log clears (defense evasion)..." -ForegroundColor Cyan
$logClears = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -MaxEvents 5 -ErrorAction SilentlyContinue
if ($logClears) { $report += "EVENT LOG CLEARED: $($logClears.TimeCreated -join '; ')" }

Write-Host "`n===== TRIAGE RESULT: $env:COMPUTERNAME =====" -ForegroundColor Yellow
if ($report) { $report | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
else { Write-Host "No HELIX indicators detected." -ForegroundColor Green }

# Optional hardening: block vssadmin for non-admin contexts via AppLocker (uncomment to apply)
# Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe' -Name 'EnforcementMode' -Value 1