NOVA Ransomware Gang: 16 New Victims Posted — Global Transport & Public Sector Attacks via Network Edge CVEs

---
title: Potential NOVA Ransomware Check Point IKEv1 Exploit
id: d6a3b1c8-9f2a-4b5c-8e1d-2f3a4b5c6d7e
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 authentication bypass attempts on Check Point Security Gateways.
status: experimental
date: 2026/06/28
author: Security Arsenal Research
logsource:
  product: firewall
  definition: Check Point Security Gateway logs
detection:
  selection:
    product: 'Check Point'
    service: 'ike'
    action: 'key_exchange'
    ike_version: '1'
  filter:
    src_ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter
falsepositives:
  - Legitimate IKEv1 VPN connections from internal networks
level: high
  
---
title: Suspicious Cisco FMC Process Execution
id: e7b4c2d9-0a3b-5c6d-9f2e-3a4b5c6d7e8f
description: Detects exploitation attempts of CVE-2026-20131 via suspicious process execution related to Cisco FMC deserialization vulnerabilities.
status: experimental
date: 2026/06/28
author: Security Arsenal Research
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: cisco
  service: fmc
detection:
  selection:
    process|contains:
      - 'sh'
      - 'bash'
      - 'python'
    parent_process|contains: 'java'
  condition: selection
falsepositives:
  - Administrative troubleshooting via FMC CLI
level: critical

---
title: Ransomware Lateral Movement via PsExec
id: f8c5d3e0-1b4c-6d7e-0a3f-4b5c6d7e8f9a
description: Detects the use of PsExec for lateral movement, a common technique used by NOVA affiliates post-initial access.
status: experimental
date: 2026/06/28
author: Security Arsenal Research
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName|contains: 'ADMIN$'
    RelativeTargetName|contains: 'PSEXESVC'
  condition: selection
falsepositives:
  - Legitimate administrative software deployment
level: high

// Hunt for NOVA lateral movement and staging indicators
// Looks for unusual service installations and remote execution often seen in this campaign
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where ProcessVersionInfoOriginalFileName in ("psexec.exe", "psexesvc.exe", "wmic.exe") or 
        ProcessCommandLine contains @"" 
        or ProcessCommandLine contains "-accepteula"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner ( 
  DeviceFileEvents 
  | where Timestamp > ago(TimeFrame) 
  | where FileName in (@"rar.exe", @"7z.exe", @"winzip.exe", @"vssadmin.exe", @"wbadmin.exe")
  | project Timestamp, DeviceName, FileName, FolderPath
) on DeviceName
| summarize count() by DeviceName, bin(Timestamp, 10m)
| order by count_ desc

<#
.SYNOPSIS
    NOVA Ransomware Hardening & Audit Script
.DESCRIPTION
    Checks for signs of NOVA TTPs: recent scheduled tasks, RDP exposure, 
    and unusual service installations (PsExec).
#>

Write-Host "[+] Starting NOVA Gang Hardening Audit..." -ForegroundColor Cyan

# 1. Check for recent Scheduled Tasks (Persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$DateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | Select-Object TaskName, Author, Date, State

# 2. Audit RDP Connections (Lateral Movement)
Write-Host "\n[*] Auditing recent RDP connections..." -ForegroundColor Yellow
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($Events) {
    $Events | Where-Object {$_.Message -match 'Logon Type:\s*10'} | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "No recent RDP events found or access denied."
}

# 3. Check for PsExec Service Artifacts
Write-Host "\n[*] Checking for PsExec service artifacts..." -ForegroundColor Yellow
$Service = Get-Service -Name "PSEXESVC" -ErrorAction SilentlyContinue
if ($Service) {
    Write-Host "[!] ALERT: PSEXESVC found. Status: $($Service.Status)" -ForegroundColor Red
} else {
    Write-Host "[+] No PSEXESVC detected."
}

# 4. Check Shadow Copy Status
Write-Host "\n[*] Checking Volume Shadow Copy Storage..." -ForegroundColor Yellow
vssadmin list shadows

Write-Host "\n[+] Audit Complete." -ForegroundColor Green