INCRANSOM Ransomware Gang: Global Campaign Targets Healthcare & Gov Via Critical VPN Flaws

---
title: Potential ScreenConnect Auth Bypass (CVE-2024-1708)
id: 8c70e6b2-4f50-45a5-bb3c-9b7a2c8d1e9f
status: experimental
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability via suspicious URI patterns
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/31
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.incransom
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Bin/'
            - '.aspx'
        cs-uri-query|contains|all:
            - '..'
            - '/'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: critical
---
title: Check Point VPN IKEv1 Anomaly Detection (CVE-2026-50751)
id: 9d1f2a3e-5b4c-4d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects mass IKEv1 security association attempts or failures indicative of exploitation attempts against Check Point Gateways
references:
    - https://support.checkpoint.com/results/detail/sk/sk180332
author: Security Arsenal Research
date: 2026/07/31
tags:
    - attack.initial_access
    - cve.2026.50751
    - ransomware.incransom
logsource:
    product: firewall
detection:
    selection:
        destination_port: 500
        protocol: udp
        vpn_feature: 'ikev1'
    filter_legit:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter_legit | count(src_ip) > 50
 timeframe: 1m
falsepositives:
    - VPN storms from trusted office IPs
level: high
---
title: INCRANSOM Pattern - Volume Shadow Copy Deletion
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects commands used by INCRANSOM affiliates to delete Volume Shadow Copies via vssadmin or wmic prior to encryption
author: Security Arsenal Research
date: 2026/07/31
tags:
    - attack.impact
    - attack.t1490
    - ransomware.incransom
logsource:
    category: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    condition: 1 of selection*
falsepositives:
    - System administration scripts
level: critical

// Hunt for lateral movement and staging indicators associated with INCRANSOM
// Focuses on PsExec, WMI, and unusual SMB access often seen before encryption
let TimeFrame = ago(7d);
DeviceProcessEvents
| where Timestamp > TimeFrame
| where (ProcessVersionInfoOriginalFileName in ('psexec.exe', 'psexec64.exe') or 
         ProcessVersionInfoOriginalFileName in ('wmic.exe', 'wbem\wmic.exe') or 
         ProcessCommandLine has 'reg save' or 
         ProcessCommandLine has 'shadowcopy')
| extend HostName = DeviceName
| join kind=inner (DeviceNetworkEvents
    | where Timestamp > TimeFrame
    | where RemotePort in (445, 135, 139) 
    | summarize ConnectionCount=count() by DeviceName, RemoteIP, RemotePort
) on DeviceName
| project Timestamp, HostName, ProcessName, ProcessCommandLine, RemoteIP, RemotePort, ConnectionCount, InitiatingProcessAccountName
| order by Timestamp desc

<#
.SYNOPSIS
    Incident Response Script - Detect Ransomware Precursors
.DESCRIPTION
    Checks for recent scheduled tasks (persistence), unusual VSS activity, 
    and enumerates exposed RDP sessions which INCRANSOM often utilizes.
#>

Write-Host "[+] Starting INCRANSOM Precursor Hunt..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 24 hours (Persistence)
$Date = (Get-Date).AddDays(-1)
Write-Host "[!] Checking for Scheduled Tasks created/modified since: $Date" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt $Date} | Select-Object TaskName, TaskPath, Date, Author

# 2. Check Volume Shadow Copy Service (VSS) Writers for errors (Staging/Destruction)
Write-Host "[!] Checking VSS Writer State..." -ForegroundColor Yellow
vssadmin list writers | Select-String -Pattern "State:.*[5-9]" -Context 2,2

# 3. Enumerate recent RDP logons (Lateral Movement)
Write-Host "[!] Checking for interactive RDP logons in the last 24 hours..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; LogonType=10; StartTime=$Date} -ErrorAction SilentlyContinue | 
    Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='IP';E={$_.Properties[19].Value}} | Format-Table -AutoSize

Write-Host "[+] Hunt Complete." -ForegroundColor Green


---