IAH6477 Ransomware Gang: 4 US Victims Posted in 72 Hours — Manufacturing Surge, Edge-Device Exploitation & Detection Rules

---
title: IAH6477 - Check Point VPN Exploitation Followed by Internal Authentication Anomaly
id: 8f4a2c11-iah6-4770-9001-aa01bb02cc03
status: experimental
description: Detects suspicious internal authentication or new admin session originating from VPN gateway segments shortly after edge-device exploitation patterns consistent with CVE-2026-50751 abuse by IAH6477 affiliates.
author: Security Arsenal Dark Side Intel
date: 2026/08/30
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: windows
detection:
  selection_source:
    IpAddress|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_event:
    EventID:
      - 4624
    LogonType:
      - 3
      - 10
  filter_known_users:
    TargetUserName|endswith: '$'
  condition: selection_source and selection_event and not filter_known_users
falsepositives:
  - Scheduled service authentications
  - Vulnerability scanners
level: medium
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: IAH6477 - ScreenConnect or RMM Tool Abuse for Lateral Movement
id: 8f4a2c12-iah6-4770-9002-aa01bb02cc04
status: experimental
description: Detects execution of remote access tooling (ScreenConnect client, unexpected PsExec/WMI launches) from non-standard paths, consistent with IAH6477 post-exploitation lateral movement via abused RMM following CVE-2024-1708 exploitation.
author: Security Arsenal Dark Side Intel
date: 2026/08/30
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_wmi_spawn:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: (selection_rmm and selection_suspicious_path) or selection_wmi_spawn
falsepositives:
  - Legitimate IT administration via RMM — baseline approved RMM install paths first
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1219
  - attack.t1047
---
title: IAH6477 - Pre-Encryption Staging and Shadow Copy Destruction
id: 8f4a2c13-iah6-4770-9003-aa01bb02cc05
status: experimental
description: Detects data staging into archive files and Volume Shadow Copy deletion attempts observed in the final 24-48 hours before IAH6477 detonation, including use of vssadmin, wmic, and bcdedit recovery tampering.
author: Security Arsenal Dark Side Intel
date: 2026/08/30
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'bootstatuspolicy ignoreallfailures'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -m5'
      - ' -v'
  condition: 1 of selection_shadow or all of selection_staging
falsepositives:
  - Backup software maintenance windows
  - IT archiving workflows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.collection

// IAH6477 Pre-Detonation Hunt: RMM abuse + shadow tampering + staging within 72h window
// Security Arsenal Dark Side Intel | 2026-08-30
let Lookback = 14d;
let ShadowTamper =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "ignoreallfailures")
    | summarize ShadowEvents = count(), FirstSeen = min(Timestamp) by DeviceName, InitiatingProcessAccountName;
let RMMExecution =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName has_any ("ScreenConnect", "psexec", "psexesvc")
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe", "powershell.exe"))
    | where FolderPath has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\")
       or InitiatingProcessFileName =~ "WmiPrvSE.exe"
    | summarize RMMEvents = count() by DeviceName, InitiatingProcessAccountName;
let ArchiveStaging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | where ProcessCommandLine has_any (" a ", " -m5", " -v")
    | summarize ArchiveEvents = count(), SampleCmd = any(ProcessCommandLine) by DeviceName, InitiatingProcessAccountName;
ShadowTamper
| join kind=inner RMMExecution on DeviceName
| join kind=leftouter ArchiveStaging on DeviceName
| project DeviceName, InitiatingProcessAccountName, FirstSeen, ShadowEvents, RMMEvents, ArchiveEvents, SampleCmd
| extend RiskScore = (ShadowEvents * 40) + (RMMEvents * 15) + (iif(isnull(ArchiveEvents), 0, ArchiveEvents * 25))
| sort by RiskScore desc

# IAH6477 Rapid Triage: shadow copies, new scheduled tasks, suspicious RMM artifacts
# Run elevated on suspect hosts. Security Arsenal Dark Side Intel | 2026-08-30

Write-Host "=== [1] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Host "[ALERT] NO shadow copies present - possible pre-encryption tampering" -ForegroundColor Red
} else {
    $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
}

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = "$($_.TaskPath)$($_.TaskName)"
    try {
        $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop
        $created = ([xml]$xml).Task.RegistrationInfo.Date
        if ($created -and ([datetime]$created) -gt (Get-Date).AddDays(-7)) {
            [PSCustomObject]@{ Task = $taskPath; Created = $created; Author = ([xml]$xml).Task.RegistrationInfo.Author }
        }
    } catch {}
} | Format-Table -AutoSize

Write-Host "=== [3] Suspicious RMM / PsExec Artifacts ===" -ForegroundColor Cyan
$suspectPaths = @("$env:TEMP", "C:\ProgramData", "C:\Users\Public", "$env:LOCALAPPDATA")
foreach ($p in $suspectPaths) {
    Get-ChildItem -Path $p -Recurse -ErrorAction SilentlyContinue -Include "psexec*","ScreenConnect*","*.ps1" |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
        Select-Object FullName, LastWriteTime, Length
}

Write-Host "=== [4] Exposed RDP Check ===" -ForegroundColor Cyan
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) { Write-Host "[WARN] RDP listening. Verify NLA, MFA-gateway, and firewall scoping." -ForegroundColor Yellow }
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
Write-Host "fDenyTSConnections = $rdpEnabled (0 = RDP enabled)"