IAH6477 Ransomware Gang: 3 US Victims Posted in 24 Hours — Retail, Finance & Tech Targeting with Detection Rules

---
title: IAH6477 — Check Point VPN Anomalous IKEv1 Authentication Followed by Internal RDP
id: 8f2a1c4e-iah6-4770-a001-cve202650751
status: experimental
description: Detects suspected exploitation of CVE-2026-50751 (Check Point IKEv1 improper authentication) followed by inbound RDP from VPN address space — IAH6477 assessed initial access chain.
author: Security Arsenal Dark Web Intelligence Desk
date: 2026/08/21
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: network_connection
  product: windows
detection:
  selection_rdp:
    DestinationPort: 3389
    Initiated: 'true'
  filter_vpn_range:
    SourceIp|cidr:
      - '10.0.0.0/8'   # tune to your VPN client pool
  condition: selection_rdp and filter_vpn_range
falsepositives:
  - Legitimate VPN user RDP to jump hosts
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1021.001
---
title: IAH6477 — ScreenConnect / RMM Tool Execution Outside Approved Baseline
id: 8f2a1c4e-iah6-4770-b002-rmm-abuse
status: experimental
description: Detects execution of ConnectWise ScreenConnect or other RMM binaries from non-standard paths, a persistence and lateral movement TTP associated with CVE-2024-1708 exploitation and IAH6477-style intrusions.
author: Security Arsenal Dark Web Intelligence Desk
date: 2026/08/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\ScreenConnect.Service.exe'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ScreenConnect'
      - 'C:\Program Files (x86)\ScreenConnect'
  condition: selection_img and not filter_approved_paths
falsepositives:
  - MSP custom install paths (baseline before enabling)
level: high
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.t1133
---
title: IAH6477 — Pre-Encryption Staging — Shadow Copy Deletion and Mass Archive Creation
id: 8f2a1c4e-iah6-4770-c003-pre-ransom-staging
status: experimental
description: Detects Volume Shadow Copy deletion combined with mass archive utility execution — classic pre-detonation staging observed in double-extortion ransomware campaigns including IAH6477's playbook.
author: Security Arsenal Dark Web Intelligence Desk
date: 2026/08/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  timeframe: 10m
  condition: selection_vss or selection_archive
falsepositives:
  - Backup administrators running maintenance scripts
  - Software packaging workflows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

// IAH6477 Hunt — Pre-ransomware lateral movement & staging chain
// Looks for: remote service/tool execution -> archive staging -> shadow copy tampering
// within a 4-hour window per device. Microsoft Sentinel / Defender XDR.
let Window = 4h;
let SuspiciousProcs = dynamic(["psexec.exe","wmic.exe","screenconnect.clientservice.exe","7z.exe","rar.exe","vssadmin.exe","bcdedit.exe","rclone.exe","megacmd.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (SuspiciousProcs)
| extend TTP = case(
    FileName in~ ("psexec.exe","wmic.exe"), "LateralMovement",
    FileName has "screenconnect", "RMMAbuse",
    FileName in~ ("7z.exe","rar.exe"), "DataStaging",
    FileName in~ ("rclone.exe","megacmd.exe"), "ExfilTool",
    FileName in~ ("vssadmin.exe","bcdedit.exe"), "DefenseEvasion",
    "Other")
| summarize TTPs = make_set(TTP), Commands = make_set(ProcessCommandLine, 5),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, AccountName, bin(TimeGenerated, Window)
| extend TTPCount = array_length(TTPs)
| where TTPCount >= 2
| extend KillChainScore = iff(set_has_element(TTPs,"DefenseEvasion") and set_has_element(TTPs,"DataStaging"), "CRITICAL — likely pre-detonation", iff(set_has_element(TTPs,"LateralMovement"), "HIGH", "MEDIUM"))
| order by KillChainScore asc, FirstSeen desc

# IAH6477 Rapid Triage — run on suspected compromised hosts or via GPO/SCCM sweep
# Checks: exposed RDP, recent scheduled tasks, shadow copy state, suspicious RMM artifacts
Write-Host