NOVA Ransomware Gang: Global Surge in Transportation & Tech Sectors — CVE-2026-50751 Exploitation

---
title: Potential Check Point CVE-2026-50751 Exploitation Attempt
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects exploitation of improper authentication in IKEv1 key exchange related to CVE-2026-50751.
status: experimental
date: 2026/06/26
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: check_point
detection:
    selection:
        action|startswith: 'accept'
        service: 'ike'
        reason|contains: 'encryption failure'
        src_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
    filter:
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter
falsepositives:
    - Misconfigured internal VPN clients
level: high

---
title: NOVA Affiliate Lateral Movement via PsExec
id: b2c3d4e5-f6g7-h8i9-j0k1-l2m3n4o5p6q7
description: Detects typical NOVA lateral movement patterns using PsExec with specific arguments often used by their affiliates.
status: experimental
date: 2026/06/26
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName|startswith: '\\\\*\\ADMIN$'
        RelativeTargetName|contains: 'PSEXESVC'
        AccessMask: '0x12019f'
    condition: selection
falsepositives:
    - Legitimate administrative tasks using PsExec
level: critical

---
title: Ransomware Pre-Encryption Volume Shadow Copy Deletion
id: c3d4e5f6-g7h8-i9j0-k1l2-m3n4o5p6q7r8
description: Detects commands used to delete Volume Shadow Copies via vssadmin, a common step in NOVA playbook before encryption.
status: experimental
date: 2026/06/26
author: Security Arsenal Research
logsource:
    product: windows
    service: process_creation
detection:
    selection:
        Image|endswith: '\\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administration maintenance scripts
level: high

// Hunt for NOVA pre-encryption staging and lateral movement
let TimeFrame = ago(7d);
DeviceProcessEvents
| where Timestamp > TimeFrame
| where ProcessCommandLine has_any ("vssadmin", "wbadmin", "bcdedit") or ProcessCommandLine contains "delete"
| where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "psexec.exe", "psexec64.exe")
| project DeviceName, Timestamp, AccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

<#
.SYNOPSIS
    NOVA Ransomware Hardening and Triage Script
.DESCRIPTION
    Checks for common NOVA TTPs: RDP exposure, recent schtasks, and VSS health.
#>

Write-Host "[+] Checking for exposed RDP sessions..." -ForegroundColor Cyan
$query = "quser"
Invoke-Expression $query

Write-Host "[+] Enumerating Scheduled Tasks created in last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, Author, Date

Write-Host "[+] Checking Volume Shadow Copy Storage health..." -ForegroundColor Cyan
$vss = vssadmin list shadows
if ($vss -match "No shadows found") {
    Write-Host "[!] CRITICAL: No Volume Shadow Copies found. Possible deletion." -ForegroundColor Red
} else {
    Write-Host "[+] VSS Snapshots detected." -ForegroundColor Green
}


---