KAZU Ransomware Gang: 9 Healthcare & Professional Services Victims Posted in Single-Day Surge — Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-08-23 | Confidence: High (victimology, direct leak site observation) / Medium (TTP attribution)

Executive Summary

Monitoring of the KAZU ransomware gang's .onion leak site reveals an aggressive single-day posting surge: nine victims published on 2026-08-23, of which seven are healthcare organizations or healthcare SaaS platforms. The geographic spread — US, Argentina, Brazil, Canada, Pakistan, and Mexico — combined with a heavy concentration of healthcare software vendors (PACS platforms, telemedicine systems, appointment scheduling, practice management) rather than individual hospitals, suggests KAZU is deliberately targeting the healthcare supply chain: compromise one software provider, inherit dozens of downstream clinics' patient data.

This is a high-leverage extortion model. A breached telemedicine or practice-management vendor gives the gang both sensitive PHI at scale and the ability to pressure the vendor with regulatory fallout (HIPAA, LGPD, PIPEDA) that the vendor cannot absorb.

Threat Actor Profile — KAZU

Attribution note: KAZU is an emerging operation with limited mature public reporting. The profile below combines direct leak-site observation with tradecraft consistent across comparable mid-tier ransomware operations. Items marked (medium confidence) are assessed from victimology and ecosystem patterns, not confirmed incident forensics.

Current Campaign Analysis

Sector Targeting

The 2026-08-23 posting wave breaks down as:

• Healthcare — 7 of 9 victims (78%)
• Professional Services — 2 of 9 (22%), and notably one of those (Yocale) is a scheduling platform whose client base is substantially medical practices — functionally healthcare-adjacent.

The critical pattern: KAZU is preferentially hitting healthcare software and services vendors, not just providers. PappyJoe (practice management), Brazil Mobilemed (cloud PACS), Meducar and ConsultorioMovil (telemedicine), PawlyClinic (veterinary platform), Yocale (appointment management). These are multi-tenant systems holding data for hundreds of downstream practices.

Geographic Concentration

Latin America is disproportionately represented (AR, BR, MX — 4 of 9 victims), alongside North America (US, CA) and South Asia (PK). This aligns with regions where healthcare digitization has outpaced security maturity, and where smaller SaaS vendors commonly run internet-facing management interfaces with inconsistent patching.

Victim Profile

Predominantly SMB and mid-market organizations — regional hospital groups (Dr Akbar Niazi Teaching Hospital, Instituto Ferrero), specialty clinics (Centro Médico OSI), and venture-stage health-tech platforms. Estimated revenue band: $1M–$50M USD. These organizations typically lack 24/7 SOC coverage, making the final-72-hour staging window effectively unmonitored.

Posting Frequency / Escalation

Nine simultaneous publications is a batched pressure event, not nine same-day intrusions. Expect follow-on individual postings as unlisted victims refuse payment. The batch also suggests the gang has reached operational maturity — enough concurrent affiliate intrusions to coordinate a mass release.

CVE Correlation — Probable Initial Access Vectors

Several CISA KEV entries confirmed for ransomware use map directly onto this victim profile:

• CVE-2026-50751 (Check Point Security Gateway, IKEv1 improper auth) — the strongest candidate vector. SMB healthcare orgs heavily favor Check Point SMB appliances; improper authentication in IKEv1 key exchange enables unauthenticated perimeter entry. Any org running an unpatched gateway with IKEv1 enabled should assume exposure.
• CVE-2025-60710 (Windows link following, privilege escalation) — post-access escalation chain component; turns a phished receptionist's session into SYSTEM.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — healthcare MSPs and SaaS vendors run ScreenConnect at high rates; exploitation here explains vendor-level compromise with downstream tenant impact.
• CVE-2023-21529 (Exchange deserialization RCE) — still-productive legacy vector against on-prem Exchange in regional hospitals.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply-chain vector relevant to the health-tech SaaS victims with development teams.

Detection Engineering

The following detections target the tradecraft window between initial access and encryption — VPN/perimeter anomaly, lateral movement, and data staging — where KAZU-style operations are most detectable.

---
title: Suspicious Service Creation via PsExec-Style Remote Execution
id: 7e3a1c4f-9b2d-4a8e-b1f6-kazu001psexec
status: experimental
description: Detects remote service installation consistent with PsExec or PsExec-clone lateral movement, a common ransomware-operator technique for pushing tooling and encryptors to hosts after perimeter compromise.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/23
logsource:
  category: service_installation
  product: windows
detection:
  selection_name:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemComSvc'
  selection_generic:
    ServiceFileName|contains:
      - '\ADMIN$\'
      - '\\127.0.0.1\ADMIN$'
      - '%SystemRoot%\PSEXESVC'
  condition: selection_name or selection_generic
falsepositives:
  - Legitimate administrative software deployment (SCCM, PDQ) — baseline by service name and deployer account
level: high
---
title: Volume Shadow Copy Deletion via Command Line
id: 8f4b2d5g-0c3e-5b9f-c2g7-kazu002vss
status: experimental
description: Detects deletion or resize of Volume Shadow Copies using vssadmin, wmic, bcdedit, or PowerShell — a near-universal pre-encryption anti-recovery action across ransomware families including emerging groups like KAZU.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'ignoreallfailures'
      - 'recoveryenabled no'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Win32_ShadowCopy'
      - 'Remove-WmiObject'
      - 'Get-WmiObject Win32_Shadowcopy'
  condition: 1 of selection_*
falsepositives:
  - Backup software maintenance; rare in legitimate interactive use
level: high
---
title: Mass Archive or Exfiltration Staging Tool Execution
id: 9g5c3e6h-1d4f-6c0g-d3h8-kazu003stage
status: experimental
description: Detects execution of archive/exfiltration utilities (rclone, 7z, WinRAR CLI, curl to suspicious endpoints) consistent with pre-leak data staging observed in double-extortion ransomware campaigns.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/08/23
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
    CommandLine|contains:
      - ' a '           # add to archive
      - '-p'            # password-protected archive
      - '-v'            # volume splitting for staged exfil
  selection_recursive_paths:
    CommandLine|contains:
      - '\\*\ shares'
      - '\\\\'
      - 'Documents and Settings'
  condition: selection_rclone or (selection_archive and selection_recursive_paths)
falsepositives:
  - IT backup scripts using 7zip/rclone — whitelist known script paths and service accounts
level: medium

The following Microsoft Sentinel KQL query hunts the pre-ransomware staging pattern: a burst of archive/utility execution followed by shadow copy tampering within a short window on the same host — the signature rhythm of the final 48 hours before detonation.

// KAZU-style pre-ransomware staging hunt: staging + anti-recovery in a compressed window
let window = 6h;
let StagingEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("rclone.exe","7z.exe","7za.exe","rar.exe","winrar.exe","megacmd.exe")
       or ProcessCommandLine has_any ("delete shadows","shadowstorage","recoveryenabled no","ignoreallfailures","Win32_ShadowCopy")
    | extend Indicator = iff(FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe")
                            or ProcessCommandLine has_any ("delete shadows","shadowstorage","recoveryenabled no","ignoreallfailures","Win32_ShadowCopy"),
                            "AntiRecovery","StagingTool")
    | project DeviceName, TimeGenerated, Indicator, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName;
StagingEvents
| summarize StagingCount = countif(Indicator == "StagingTool"),
            AntiRecoveryCount = countif(Indicator == "AntiRecovery"),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Commands = make_set(ProcessCommandLine, 10),
            Accounts = make_set(AccountName, 5)
    by DeviceName, bin(TimeGenerated, window)
| where StagingCount > 0 and AntiRecoveryCount > 0
| extend RiskScore = StagingCount * 10 + AntiRecoveryCount * 25
| order by RiskScore desc;

Rapid triage script — run on any suspected-compromised Windows host to surface scheduled-task persistence created in the last 7 days, shadow copy status, and RDP exposure in one pass:

# KAZU Rapid Triage — persistence, anti-recovery, and RDP exposure check
# Run elevated on suspected hosts. Output: console + CSV in $env:TEMP
$report = @()

Write-Host "`n=== [1] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = Join-Path $_.TaskPath $_.TaskName
    try {
        $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop
        $created = ([xml]$xml).Task.RegistrationInfo.Date
        if ($created -and [datetime]$created -gt $cutoff) {
            $report += [PSCustomObject]@{Check="NewScheduledTask"; Detail=$taskPath; Created=$created}
            Write-Host "  [!] NEW TASK: $taskPath (created $created)" -ForegroundColor Yellow
        }
    } catch {}
}

Write-Host "`n=== [2] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Host "  [!!] ZERO shadow copies present — possible anti-recovery deletion" -ForegroundColor Red
    $report += [PSCustomObject]@{Check="ShadowCopies"; Detail="NONE FOUND - investigate vssadmin/wmic deletion"; Created="N/A"}
} else {
    Write-Host "  [OK] $($shadows.Count) shadow copies present"
}

Write-Host "`n=== [3] RDP Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$rdpListening = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdpEnabled -and $rdpListening) {
    $nlaState = if ($nla -eq 1) { "NLA ON" } else { "NLA OFF - HIGH RISK" }
    Write-Host "  [!] RDP LISTENING ($nlaState)" -ForegroundColor $(if($nla -eq 1){"Yellow"}else{"Red"})
    $report += [PSCustomObject]@{Check="RDP"; Detail="Enabled & listening; NLA=$nlaState"; Created="N/A"}
    Get-NetTCPConnection -LocalPort 3389 -State Established -ErrorAction SilentlyContinue |
        ForEach-Object { Write-Host "      Active session from: $($_.RemoteAddress)" -ForegroundColor Yellow }
}

Write-Host "`n=== [4] Recent VPN/Perimeter Auth Anomalies (local logon type sweep) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
    Group-Object { if ($_.Message -match 'Account Name:\s+([^\s]+)') { $Matches[1] } } |
    Where-Object { $_.Count -gt 50 } |
    ForEach-Object { Write-Host "  [!] High-volume network/RDP logons: $($_.Name) ($($_.Count) events)" -ForegroundColor Yellow }

$report | Export-Csv "$env:TEMP\kazu_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "`nTriage complete. Report exported to $env:TEMP" -ForegroundColor Green

Incident Response Priorities — KAZU Playbook

T-Minus Detection Checklist (before encryption fires)

1. New local/domain admin accounts created outside change windows, especially named to blend in (svc_backup, admin2, helpdesk).
2. Archive tooling appearing where it shouldn't — rclone, 7z, WinRAR CLI on servers, particularly on database and file-share hosts.
3. Abnormal outbound volume to consumer cloud storage (MEGA, Dropbox, Backblaze) or unfamiliar VPS IPs — this is the exfil stream funding the leak-site post.
4. Shadow copy deletion events (the Sigma rules above) — treat any vssadmin delete shadows outside backup maintenance as a potential pre-detonation action.
5. EDR tampering: attempts to stop/uninstall security services, disable tamper protection, or boot into safe mode.
6. ScreenConnect/RMM anomalies — new unattended access sessions, unexpected RMM agent installs (CVE-2024-1708 follow-on tooling).

Assets Historically Prioritized for Exfiltration

Given the healthcare-SaaS victim profile, assume the gang goes where the extortion leverage lives:

• Patient databases (EHR/EMR exports, PACS imaging stores, telemedicine session records)
• Multi-tenant platform databases — for SaaS victims, every downstream clinic's data is in scope
• HR/payroll records (identity-theft-ready PII)
• Contracts and insurance documents (used to calibrate ransom to coverage limits)
• Email archives from executive mailboxes

Containment Actions — Ordered by Urgency

1. Isolate, don't power off suspected hosts — preserve memory for forensic value while severing lateral movement.
2. Disable the suspected initial access path immediately: if Check Point gateway compromise is possible, take the VPN offline and force full credential rotation (CVE-2026-50751 enables session-level compromise — assume harvested creds).
3. Revoke and rotate all domain admin and service account credentials — twice, with a krbtgt double-reset if domain compromise is suspected.
4. Block exfil at egress: emergency deny rules for consumer cloud storage and unsanctioned file-sharing endpoints.
5. Protect backups: verify offline/immutable copies are actually isolated before the operator reaches them.
6. Preserve evidence: VPN/auth logs, EDR telemetry, and any staging directories — needed for regulatory breach notification scope determination (HIPAA/LGPD/PIPEDA clock starts on awareness).

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate CVE-2026-50751: update Check Point Security Gateway; if patching is not possible, disable IKEv1 key exchange and migrate to IKEv2-only VPN profiles.
• Patch CVE-2024-1708 on all ConnectWise ScreenConnect instances; audit for rogue user accounts and unexpected sessions.
• Apply the CVE-2025-60710 Windows update fleet-wide; verify Exchange servers are patched against CVE-2023-21529.
• Enforce MFA on all remote access — VPN, RDP gateways, RMM consoles. No exceptions for service vendors.
• Deploy the Sigma rules and KQL query above into your SIEM/EDR and run the KQL retro-hunt over the last 14 days.
• Restrict outbound egress to an allowlist where feasible; alert on consumer cloud-storage destinations.
• Verify shadow copies exist on critical servers and that backup credentials are separated from domain credentials.

Short-Term (2 Weeks)

• Decommission direct RDP exposure — move all administrative access behind a VPN + jump host with NLA and MFA; audit with the triage script.
• Segment clinical/medical-device VLANs from corporate IT and especially from any vendor management interfaces.
• Healthcare SaaS vendors: isolate tenant databases, enforce per-tenant encryption keys, and instrument database export events — bulk export is the highest-fidelity pre-leak signal you have.
• Implement application control (WDAC/AppLocker) blocking rclone, 7z CLI, and unapproved RMM binaries on servers.
• Immutable/offline backup tier with tested restoration — measure your actual RTO against a full-environment rebuild, not a single server.
• Third-party review: if you are a healthcare provider, enumerate your SaaS dependencies (scheduling, PACS, telemedicine, billing) and request their patch posture against the CVEs above — KAZU's campaign demonstrates your vendors are the target.

This briefing is based on direct observation of criminal leak infrastructure. Victim names are reported as posted by the threat actor; inclusion does not confirm the organization's own acknowledgment of an incident. Security Arsenal continues to monitor KAZU infrastructure for follow-on postings.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub