Aliases & Affiliation: M3RX operates as a relatively new but aggressive Ransomware-as-a-Service (RaaS) entity. While they do not appear to be a direct rebrand of older gangs (like LockBit or Conti), their code structure suggests a sophisticated background in initial access brokerage.
Operational Model: M3RX follows a strictly RaaS model. Core developers maintain the encryption payload and leak site, while a network of affiliates handles initial access and lateral movement. This split allows for high volume targeting across varied geographies.
Ransom Demands: Demands typically range from $500,000 to $5 million, depending on victim revenue. They strictly enforce a double-extortion strategy: exfiltrating sensitive data (CAD drawings, client databases, legal documents) before encryption and threatening leaks on their .onion site if negotiation fails.
Initial Access Vectors: Based on recent victimology and the specific CVEs exploited, M3RX affiliates heavily favor:
- External Facing Perimeter Bypass: Exploiting vulnerabilities in VPNs and Firewalls (e.g., Check Point, Cisco FMC).
- Remote Monitoring and Management (RMM) Tools: Unpatched ScreenConnect servers are a primary entry point.
- Phishing: Targeted campaigns leveraging Exchange vulnerabilities to gain a foothold.
Dwell Time: M3RX exhibits a short dwell time, averaging 3–7 days between initial access and encryption. They move quickly to bypass EDR detection, often living "off-the-land" using legitimate administrative tools.
Current Campaign Analysis
Targeted Sectors: The campaign launched on 2026-07-26 shows a distinct pivot towards Manufacturing and Professional Services. These sectors are often targeted for their intellectual property and high tolerance for downtime, increasing the likelihood of ransom payment.
Geographic Concentration: The attack spread is transatlantic, targeting:
- Germany (DE): Industrial manufacturing (
hydraulic-components.net). - Portugal (PT): Professional services (
createinfor.pt). - United States (US): Service providers (
servicebypremier.com).
Victim Profile: The victims appear to be mid-market enterprises (revenue $10M - $100M). These organizations often have robust IT networks but lack the 24/7 SOC coverage required to detect the subtle initial access indicators used by M3RX.
Posting Frequency & Escalation: M3RX posted three victims simultaneously on 2026-07-26. This "batching" suggests coordinated operations by a specific affiliate cell or a deliberate weekend/holiday strategy to catch defenders understaffed.
CVE Correlation: There is a high-confidence correlation between the observed activity and the CISA KEV list:
- CVE-2026-50751 (Check Point Security Gateway): Likely used to breach the Manufacturing and Service victims who rely on site-to-site VPNs.
- CVE-2024-1708 (ConnectWise ScreenConnect): A probable vector for the Professional Services victims, allowing the attackers to bypass internal perimeter controls via compromised RMM software.
- CVE-2026-20131 (Cisco FMC): Potential use in disabling firewall logging before exfiltration.
Detection Engineering
The following detection rules and hunt queries are designed to catch M3RX TTPs based on their utilization of the CVEs listed above and standard ransomware playbook behaviors.
SIGMA Rules
---
title: Potential Check Point Security Gateway Authentication Bypass (CVE-2026-50751)
id: 6a8f9e2b-1c3d-4e5f-9a0b-1c2d3e4f5a6b
description: Detects potential exploitation of Check Point Security Gateway IKEv1 authentication vulnerability indicative of M3RX initial access attempts.
status: experimental
author: Security Arsenal Intel
date: 2026/07/28
references:
- https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
product: firewall
definition: Check Point Security Gateway Logs
detection:
selection:
product|contains: 'Check Point'
action|contains: 'accept'
service|contains: 'ike'
version|contains: 'v1'
src_ip|contains:
- 'Tor' # Assuming correlation or known bad IP lists
- 'VPN' # Generic placeholder for specific Geo anomalies
filter:
user|startswith: 'admin' # Legitimate admin access
condition: selection and not filter
falsepositives:
- Legitimate IKEv1 VPN connections from legacy partners
level: high
---
title: ScreenConnect Path Traversal Exploitation Attempt (CVE-2024-1708)
id: 7b9g0f3c-2d4e-5f6a-0b1c-2d3e4f5a6b7c
description: Detects path traversal strings in ScreenConnect web logs, often used by ransomware groups like M3RX for initial access.
status: experimental
author: Security Arsenal Intel
date: 2026/07/28
logsource:
category: web
detection:
selection_uri:
c-uri|contains:
- '..%2f'
- '..\\'
- '..%5c'
selection_sc:
c-uri|contains: '/Guest/' # Default path often targeted
condition: all of selection_*
falsepositives:
- Scanning activity
level: critical
---
title: Ransomware Pre-Encryption Shadow Copy Deletion
id: 8c0h1g4d-3e5f-6g7b-1c2d-3e4f5a6b7c8d
description: Detects commands used to delete Volume Shadow Copies via vssadmin or diskshadow, a common step before M3RX encryption.
status: experimental
author: Security Arsenal Intel
date: 2026/07/28
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- '\vssadmin.exe'
- '\diskshadow.exe'
- '\wmic.exe'
selection_cli:
CommandLine|contains:
- 'delete shadows'
- 'shadowcopy delete'
- 'shadowstorage delete'
condition: all of selection_*
falsepositives:
- System administrator maintenance
level: high
KQL Hunt Query (Microsoft Sentinel)
Hunts for lateral movement and data staging patterns associated with M3RX tooling.
let Timeframe = 1h;
DeviceProcessEvents
| where Timestamp > ago(Timeframe)
// Hunt for lateral movement tools
| where ProcessName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe', 'powershell.exe', 'cmd.exe')
// Hunt for commands used in M3RX playbooks
| where ProcessCommandLine has_any ('New-Item', 'Copy-Item', 'Invoke-Expression', 'IEX', 'DownloadString', 'Net use', 'user add')
// Filter for suspicious parent processes (often hiding)
| where InitiatingProcessFileName !in~ ('explorer.exe', 'services.exe', 'svchost.exe', 'mmc.exe', 'powershell.exe')
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend FullContext = strcat('Process: ', ProcessName, ' | Command: ', ProcessCommandLine, ' | Parent: ', InitiatingProcessFileName)
Rapid Response Script (PowerShell)
A script to check for indicators of M3RX compromise, specifically looking for recent suspicious scheduled tasks and Shadow Copy manipulation.
<#
.SYNOPSIS
M3RX Ransomware Rapid Response Check
.DESCRIPTION
Checks for recent Scheduled Tasks (common persistence) and Shadow Copy status.
#>
Write-Host "[+] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author, Actions
Write-Host "[+] Checking recent Security Event Logs for Process Creation (4688) involving vssadmin..." -ForegroundColor Cyan
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688) and TimeCreated[timediff(@SystemTime) <= 604800000]]] and *[EventData[Data[@Name='NewProcessName']='vssadmin.exe']]" -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message | Format-List
Write-Host "[+] Checking for unusual network connections (Established) on non-standard ports..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established | Where-Object {$_.LocalPort -notin (80,443,3389,22,135,139,445)} | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
Write-Host "[!] Manual Review: Check 'C:\ProgramData' and 'C:\Windows\Temp' for recent modified .exe or .bat files." -ForegroundColor Yellow
---
Incident Response Priorities
Based on M3RX's known playbook, execute the following actions immediately if compromise is suspected:
-
T-Minus Detection Checklist:
- VPN Logs: Scrub logs for Check Point gateway authentication failures or successes from anomalous IPs (CVE-2026-50751).
- RMM Audit: Immediately audit ScreenConnect (ConnectWise) logs for path traversal attempts (
..%2f) and unauthorized session logins. - Exchange: Check for IIS logs related to deserialization attacks on OWA/ECP endpoints.
-
Critical Asset Prioritization:
- M3RX aggressively targets CAD/PLM data in manufacturing and Client PII/Financial Records in professional services.
- Secure backup repositories immediately; they are a primary target for deletion.
-
Containment Actions (Ordered by Urgency):
- Segment: Disconnect VPN concentrators from the internal LAN if traffic anomalies exist.
- Disable: Temporarily disable internet-facing RMM tools until patched.
- Isolate: Isolate the
createinfor.ptand `servicebypremier.com equivalent servers** from the network.
Hardening Recommendations
Immediate (24 Hours):
- Patch Critical CVEs: Apply patches for CVE-2026-50751 (Check Point), CVE-2024-1708 (ScreenConnect), and CVE-2026-20131 (Cisco FMC). These are the active keys to the kingdom for M3RX right now.
- MFA Enforcement: Enforce phishing-resistant MFA on all VPN and RMM portals immediately.
- Block External RDP: Block inbound RDP (TCP 3389) from the internet at the firewall level.
Short-term (2 Weeks):
- Network Segmentation: Implement strict Zero Trust controls between IT and OT (Manufacturing) networks.
- E-DR Implementation: Deploy Endpoint Detection and Response (EDR) on all servers, specifically monitoring for
vssadminanddiskshadowusage. - Access Review: Review and revoke unnecessary administrative privileges for service accounts commonly targeted in Exchange attacks.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.