LOCKBIT5: Aggressive Healthcare & Manufacturing Campaign — CVE-2026-20131 Exploitation & Detection

---
title: Potential Cisco FMC Deserialization Exploit CVE-2026-20131
id: 4b2c6a9d-0f1e-4b5a-9c3d-8e7f6a5b4c3d
description: Detects potential deserialization attacks on Cisco FMC via unusual process chains or web requests.
status: experimental
date: 2026/04/15
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains: '/mgmt/cm/devicehandling' OR '/api/fmc_config/v1/domain'
        cs-method: POST
    filter:
        sc-status: 500
    condition: selection and filter
falsepositives:
    - Misconfigured management interfaces
level: high
---
title: SmarterMail Authentication Bypass CVE-2026-23760
id: 5d3e7b0e-1g2f-5c6d-0d4e-9f8g7h6i5j4k
description: Detects successful authentication attempts to SmarterMail without standard headers or via bypass paths.
status: experimental
date: 2026/04/15
author: Security Arsenal
logsource:
    product: smtp
    service: smtpsecurity
detection:
    selection_uri:
        c-uri|contains: '/Services/MailService.asmx'
    selection_auth:
        cs-username|contains: 'admin' OR 'system'
    filter_legit:
        c-useragent|contains: 'Mozilla' or 'Outlook'
    condition: selection_uri and selection_auth and not filter_legit
falsepositives:
    - Legacy API integrations
level: critical
---
title: LockBit5 Ransomware Pre-Encryption Activity
id: 6e4f8c1f-2h3g-6d7e-1e5f-0a1b2c3d4e5f
description: Detects activity typical of LockBit affiliates prior to encryption, including VSS deletion and system shutdown.
status: experimental
date: 2026/04/15
author: Security Arsenal
logsource:
    category: process_creation
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'Delete Shadows' or 'Resize ShadowStorage'
    selection_bcd:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains: 'recoveryenabled no'
    selection_wevt:
        Image|endswith: '\wevtutil.exe'
        CommandLine|contains: 'cl' or 'clear-log'
    condition: 1 of selection_*
falsepositives:
    - System administration scripts
level: high

// Hunt for unusual SMB/NamedPipe creation often used by Cobalt Strike Beacons
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType in ("NamedPipeCreated", "SMBFileCreated")
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "rundll32.exe")
| where RemotePort in (445, 135) or FileName contains "\\\\.\\pipe\\"
| summarize count() by DeviceName, InitiatingProcessAccountName, FileName
| where count_ > 10

// Hunt for massive data egress (Exfil)
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where SentBytes > 100000000 // >100MB
| where RemoteUrl !contains "microsoft.com" and RemoteUrl !contains "windowsupdate.com"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, SentBytes

# LockBit5 Triage Script
Write-Host "Checking for Ransomware Indicators..." -ForegroundColor Yellow

# 1. Check for Recent Scheduled Tasks (Persistence)
$recentDate = (Get-Date).AddDays(-7)
$suspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $recentDate -and $_.State -eq 'Ready'}
if ($suspiciousTasks) {
    Write-Host "[ALERT] Recent Scheduled Tasks Found:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Status (Pre-Encryption)
$vssStatus = vssadmin list shadows 2>&1
if ($vssStatus -like "*No shadow copies found*" -or $vssStatus -like "*error*") {
    Write-Host "[ALERT] VSS Shadows are missing or corrupted." -ForegroundColor Red
} else {
    Write-Host "[OK] VSS Shadows present." -ForegroundColor Green
}

# 3. Check for Suspicious Network Connections (Exfil)
$netstat = netstat -ano | Select-String "ESTABLISHED"
Write-Host "[INFO] Active Established Connections found. Review IPs manually."