NOVA Ransomware Gang: 14 New Victims Posted — Sector Targeting Analysis & Detection Rules

---
title: Check Point Security Gateway IKEv1 Key Exchange Exploitation Attempt
id: c0e77b86-3f7b-4e1d-9b7a-8d3e21f0a2b1
description: Detects potential exploitation of CVE-2026-50751 in Check Point Security Gateways
status: experimental
author: Security Arsenal
date: 2026/06/25
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: firewall
    definition: Check Point Security Gateway logs
detection:
    selection:
        event_type: 'IKE_SA'
        protocol: 'IKEv1'
        action: 'accept'
        payload|contains:
            - 'malformed_packet'
            - 'invalid_spi'
    condition: selection
falsepositives:
    - Misconfigured VPN clients
level: critical
---
title: ConnectWise ScreenConnect Path Traversal Exploitation Attempt
id: a1f88c97-4e8c-5f2e-0c8b-9e4f32g1b3c2
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect
status: experimental
author: Security Arsenal
date: 2026/06/25
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: webserver
    service: iis, apache, nginx
detection:
    selection:
        cs-uri-query|contains:
            - '..\\'
            - '%2e%2e%5c'
            - 'ScreenConnect'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate administrators accessing the service
level: high
---
title: Suspicious Lateral Movement via PsExec
id: b2g99d08-5f9d-6g3f-1d9c-0f5g43h2c4d3
description: Detects potential lateral movement using PsExec, commonly associated with ransomware
status: experimental
author: Security Arsenal
date: 2026/06/25
references:
    - https://attack.mitre.org/techniques/T1021/002/
tags:
    - attack.lateral_movement
    - attack.t1021
    - attack.execution
    - attack.t1569
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: 'IPC$'
        RelativeTargetName|endswith: 'PSEXESVC'
    filter:
        SubjectUserName:
            - 'SYSTEM'
            - 'NETWORK SERVICE'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative activities
level: high

// Hunt for lateral movement and pre-ransomware staging
// Look for unusual administrative activities and file operations across multiple systems
let TimeFrame = 7d;
let AdminAccounts = datatable(Account:string)["admin", "administrator", "svc_admin"];
// Detection 1: Suspicious service creation across multiple hosts
SecurityEvent
| where TimeGenerated > ago(TimeFrame)
| where EventID in (4624, 4625, 5145, 7045)
| where SubjectUserName in (AdminAccounts) or Account in (AdminAccounts)
| summarize count() by Computer, EventID, Account
| where count_ > 10
| project Computer, EventID, Account, count_
// Detection 2: Unusual file access patterns suggesting data staging
SecurityEvent
| where TimeGenerated > ago(TimeFrame)
| where EventID == 5145
| where ShareName has "C$" or ShareName has "ADMIN$"
| where RelativeTargetName has @".zip" or RelativeTargetName has @".7z" or RelativeTargetName has @".rar"
| summarize count(), make_set(RelativeTargetName) by Computer, SubjectUserName, ShareName
| where count_ > 5
// Detection 3: Multiple failed logins suggesting credential stuffing
SigninLogs
| where TimeGenerated > ago(TimeFrame)
| where Result == "Failure"
| summarize count() by AppDisplayName, UserPrincipalName, Location
| where count_ > 3

# NOVA Ransomware Rapid Response Hardening Script
# Checks for exposed RDP and enumerates suspicious scheduled tasks added in the last 7 days

# Function to check for exposed RDP
function Check-RDPExposure {
    Write-Host "Checking for exposed RDP connections..." -ForegroundColor Yellow
    $rdpStatus = Get-WmiObject -Class Win32_TSGeneralSetting -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'" | Select-Object PortNumber, SettingID
    
    if ($rdpStatus) {
        Write-Host "RDP is enabled on port $($rdpStatus.PortNumber)" -ForegroundColor Red
        $recentConnections = Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" -MaxEvents 100 | 
                             Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7)}
        
        if ($recentConnections) {
            Write-Host "Recent RDP connections in the last 7 days:" -ForegroundColor Yellow
            $recentConnections | Format-Table TimeCreated, Message -AutoSize
        } else {
            Write-Host "No recent RDP connections found in the last 7 days" -ForegroundColor Green
        }
        
        # Check if RDP is exposed to the internet
        $firewallRule = Get-NetFirewallRule -DisplayName "Remote Desktop*" | Where-Object {$_.Enabled -eq "True" -and $_.Direction -eq "Inbound"}
        if ($firewallRule) {
            Write-Host "RDP firewall rule(s) are enabled and may allow external access" -ForegroundColor Red
            $firewallRule | Select-Object DisplayName, Enabled, Direction, Profile | Format-Table -AutoSize
        }
    } else {
        Write-Host "RDP is not configured on this system" -ForegroundColor Green
    }
}

# Function to enumerate scheduled tasks added in the last 7 days
function Check-RecentScheduledTasks {
    Write-Host "`nChecking for scheduled tasks created/modified in the last 7 days..." -ForegroundColor Yellow
    $tasks = Get-ScheduledTask
    
    $recentTasks = foreach ($task in $tasks) {
        $taskInfo = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
        if ($taskInfo) {
            $createdDate = $taskInfo.Date
            if ($createdDate -gt (Get-Date).AddDays(-7)) {
                $task | Select-Object TaskName, TaskPath, State, @{Name="Created"; Expression={$createdDate}}
            }
        }
    }
    
    if ($recentTasks) {
        Write-Host "Found $($recentTasks.Count) tasks created/modified in the last 7 days:" -ForegroundColor Red
        $recentTasks | Format-Table -AutoSize
        
        # Get task details for suspicious tasks
        foreach ($task in $recentTasks) {
            $taskAction = Get-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue | 
                          Select-Object -ExpandProperty Actions
            
            if ($taskAction) {
                Write-Host "`nTask: $($task.TaskName)" -ForegroundColor Cyan
                $taskAction | ForEach-Object {
                    if ($_.Execute) {
                        Write-Host "  Executes: $($_.Execute) $($_.Arguments)" -ForegroundColor Yellow
                    }
                }
            }
        }
    } else {
        Write-Host "No scheduled tasks created/modified in the last 7 days" -ForegroundColor Green
    }
}

# Function to check for recently modified Volume Shadow Copies
function Check-ShadowCopies {
    Write-Host "`nChecking for recently modified Volume Shadow Copies..." -ForegroundColor Yellow
    try {
        $shadowCopies = Get-WmiObject Win32_ShadowCopy | 
                       Where-Object {$_.InstallDate -gt (Get-Date).AddDays(-7)}
        
        if ($shadowCopies) {
            Write-Host "Found $($shadowCopies.Count) shadow copies created in the last 7 days:" -ForegroundColor Yellow
            $shadowCopies | Format-Table DeviceObject, VolumeName, InstallDate -AutoSize
        } else {
            Write-Host "No shadow copies created in the last 7 days" -ForegroundColor Green
        }
    } catch {
        Write-Host "Error checking shadow copies: $_" -ForegroundColor Red
    }
}

# Main execution
Write-Host "NOVA Ransomware Rapid Response Hardening Script" -ForegroundColor Magenta
Write-Host "=============================================`n" -ForegroundColor Magenta

Check-RDPExposure
Check-RecentScheduledTasks
Check-ShadowCopies

Write-Host "`nScript completed. Review results above for potential indicators of compromise." -ForegroundColor Cyan