INCRANSOM Ransomware: Cross-Border Healthcare & Legal Sector Targeting — Critical CVE Exploitation

---
title: Potential Check Point IKEv1 Exploitation - CVE-2026-50751
id: 7b2b9d8f-1a3e-4c5d-9e6f-1a2b3c4d5e6f
description: Detects potential exploitation of Check Point Security Gateway IKEv1 improper authentication vulnerability observed in INCRANSOM campaigns.
status: experimental
date: 2026/07/26
author: Security Arsenal Intel
logsource:
  product: firewall
  definition: Check Point logs assumed
detection:
  selection:
    product|contains: 'Check Point'
    action: 'Accept'
    protocol: 'IKE'
    ike_version: 'v1'
  filter_legit:
    src_ip:
      - '127.0.0.1'
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate IKEv1 VPN connections from remote offices (if still in use)
level: high
---
title: ScreenConnect Path Traversal Exploit Attempt
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
description: Detects suspicious URI patterns associated with CVE-2024-1708 exploitation on ConnectWise ScreenConnect servers, a known INCRANSOM vector.
status: experimental
date: 2026/07/26
author: Security Arsenal Intel
logsource:
  category: web
  product: check_point
  service: checkpoint_security_gateway
detection:
  selection_uri:
    cs-uri-query|contains:
      - '/%2f'
      - '/..'
      - 'setup.aspx'
  selection_status:
    sc-status:
      - 200
      - 500
  condition: all of selection_*
falsepositives:
  - Scanning activity
level: critical
---
title: INCRANSOM Data Staging Pattern - Large Volume Copy
id: f9e8d7c6-b5a4-4f3e-8d2c-1b0a9f8e7d6c
description: Identifies potential data staging activity typical of INCRANSOM double extortion, involving mass file copying to local staging folders or external drives using ROBOCOPY or similar tools.
status: experimental
date: 2026/07/26
author: Security Arsenal Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\
obocopy.exe'
      - '\\xcopy.exe'
      - '\
clone.exe'
  selection_params:
    CommandLine|contains:
      - '/COPYALL'
      - '/MIR'
      - '/E'
      - 'copy'
  selection_staging:
    CommandLine|contains:
      - 'Staging'
      - 'Temp'
      - 'Payload'
  timeframe: 1h
  condition: all of selection_* and selection_staging
falsepositives:
  - Legitimate backup operations
level: high


**KQL Hunt Query (Microsoft Sentinel)**
Hunt for lateral movement and credential dumping indicative of post-exploitation activity before encryption.

kql
let TimeWindow = 1h;
DeviceProcessEvents
| where Timestamp >= ago(TimeWindow)
// Look for common INCRANSOM lateral movement tools
| where ProcessName has_any (\"powershell.exe\", \"cmd.exe\", \"wmic.exe\", \"psexec.exe\", \"psexec64.exe\", \"procdump.exe\", \"mimikatz.exe\")
// Check for commands related to service manipulation or remote execution
| where ProcessCommandLine has_any (\"create\", \"start\", \"call\", \"invoke\", \"export\", \"shadow\", \"copy\")
// Exclude known system paths to reduce noise
| where not (FolderPath contains @\"\\Windows\\System32\\" and ProcessCommandLine contains \"ver\")
| summarize count(), make_set(ProcessCommandLine) by DeviceName, AccountName, ProcessName
| where count_ > 5 // Threshold for mass execution


**PowerShell Response Script**
Rapidly check for signs of ransomware precursor activity: mass shadow copy deletion and unusual scheduled tasks.

powershell
<#
.INCRANSOM Incident Response Triaging Script
Checks for VSS deletions and suspicious scheduled tasks added in the last 7 days.
#>

Write-Host \"[!] Checking for recent Volume Shadow Copy (VSS) Deletions...\" -ForegroundColor Yellow
$VSSEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; ID=12343; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
if ($VSSEvents) {
    Write-Host \"[CRITICAL] VSS Deletion events found:\" -ForegroundColor Red
    $VSSEvents | Select-Object TimeCreated, Message | Format-Table -Wrap
} else {
    Write-Host \"[OK] No recent VSS deletions detected.\" -ForegroundColor Green
}

Write-Host \"\
[!] Checking for Scheduled Tasks created/modified in last 7 days...\" -ForegroundColor Yellow
$Tasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($Tasks) {
    Write-Host \"[WARNING] Recent Scheduled Tasks found (Investigate Author):\" -ForegroundColor Red
    $Tasks | Select-Object TaskName, Date, Author | Format-Table -Wrap
} else {
    Write-Host \"[OK] No suspicious recent scheduled tasks.\" -ForegroundColor Green
}

Write-Host \"\
[!] Checking for Rclone/Exfil tools...\" -ForegroundColor Yellow
$Paths = @(\"C:\\Windows\\Temp\\", \"C:\\Users\\Public\\", \"C:\\ProgramData\\")
$Extensions = @(\"rclone.exe\", \"plink.exe\", \"7z.exe\")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include $Extensions -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host \"[DETECTED] Potential Exfil Tool: $($_.FullName)\" -ForegroundColor Red
        }
    }
}


---