MEDUSALOCKER Intelligence Briefing: Surge in DACH Region Targets Telecom & Public Sector — Critical CVEs Exploited

---
title: MEDUSALOCKER - Potential Check Point CVE-2026-50751 Exploitation
id: 77bf5d13-8c6a-4827-9b6b-2e1c0e3f4a5b
description: Detects potential exploitation attempts of CVE-2026-50751 against Check Point Security Gateways via IKEv1 anomalies.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: network
    product: firewall
detection:
    selection:
        destination.port: 500
        protocol: udp
        payload|contains: 'aggressive_mode'
    condition: selection
falsepositives:
    - Legitimate VPN misconfigurations
level: critical
---
title: MEDUSALOCKER - Volume Shadow Copy Deletion via VssAdmin
id: 88ce6e24-9d7b-5938-0c7c-3f2d1f4g5b6c
description: Detects commands used by MEDUSALOCKER to delete Volume Shadow Copies to prevent recovery.
status: experimental
date: 2026/07/03
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowstorage delete'
    condition: selection
falsepositives:
    - System administration
level: high
---
title: MEDUSALOCKER - ConnectWise ScreenConnect Auth Bypass (CVE-2024-1708)
id: 99df7f35-0e8c-6a49-1d8d-4g3e2g5h6c7d
description: Detects suspicious URI patterns associated with CVE-2024-1708 exploitation on ConnectWise ScreenConnect servers.
status: experimental
date: 2026/07/03
author: Security Arsenal
logsource:
    category: web
    product: proxy
detection:
    selection:
        cs-uri-query|contains:
            - '/bin/legacy'
            - 'SessionId='
    filter:
        cs-method|notcontains:
            - 'GET'
            - 'POST'
    condition: selection and not filter
falsepositives:
    - Legitimate ScreenConnect administration
level: critical

// Hunt for MEDUSALOCKER lateral movement and staging
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Look for lateral movement tools common in MedusaLocker campaigns
| where FileName in~ ("powershell.exe", "cmd.exe", "psexec.exe", "psexec64.exe", "wmic.exe")
// Filter for suspicious arguments or encoding
| where ProcessCommandLine has "Invoke-Expression" or 
   ProcessCommandLine has "-enc " or 
   ProcessCommandLine contains "New-Object" or
   ProcessCommandLine contains "remote"
// Join with network events to see correlated outbound connections
| join kind=inner DeviceNetworkEvents on DeviceId
| where InitiatingProcessFileName in~ ("powershell.exe", "wmic.exe")
| summarize count(), make_set(IPAddress), make_set(Url) by DeviceName, FileName, ProcessCommandLine
| order by count_ desc

# MEDUSALOCKER Triage Script
# Checks for signs of compromise and recent VSS manipulation

Write-Host "[!] Starting MEDUSALOCKER Triage Check..." -ForegroundColor Cyan

# 1. Check for recent VSS Shadow Copy Deletions (Last 24h)
Write-Host "[*] Checking for VSS Deletion Events..." -ForegroundColor Yellow
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12345} -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) }
if ($VssEvents) {
    Write-Host "[ALERT] Potential Shadow Copy Deletion detected!" -ForegroundColor Red
    $VssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[+] No recent VSS deletion events found." -ForegroundColor Green
}

# 2. Enumerate Suspicious Scheduled Tasks (Last 48h)
Write-Host "[*] Checking for Scheduled Tasks created in last 48h..." -ForegroundColor Yellow
$DateCutoff = (Get-Date).AddDays(-2)
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | ForEach-Object {
    $TaskInfo = $_.Actions.Execute
    if ($TaskInfo -like "*powershell*" -or $TaskInfo -like "*cmd*" -or $TaskInfo -like "*http*") {
        Write-Host "[SUSPICIOUS] Task: $($_.TaskName) - Action: $TaskInfo" -ForegroundColor Red
    }
}

# 3. Check for RDP Exposure
Write-Host "[*] Checking RDP Configuration..." -ForegroundColor Yellow
$RDPProperty = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($RDPProperty.fDenyTSConnections -eq 0) {
    Write-Host "[WARNING] RDP is ENABLED. Ensure network-level restrictions are in place." -ForegroundColor Yellow
} else {
    Write-Host "[+] RDP is disabled." -ForegroundColor Green
}

Write-Host "[!] Triage Complete." -ForegroundColor Cyan


---