NOVA Ransomware Gang: Global Tech Sector Surge & Critical CVE Exploitation

---
title: Potential Check Point IKEv1 Exploitation Attempt
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 key exchange anomalies or authentication failures on Check Point gateways.
author: Security Arsenal Research
date: 2026/07/18
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: checkpoint
detection:
    selection:
        service|contains: 'ike'
        protocol: 'udp'
        dst_port: 500
    filter:
        action: 'accept'
    condition: selection and not filter
falsepositives:
    - Legitimate VPN misconfigurations
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - nova
---
title: ConnectWise ScreenConnect Authentication Bypass
description: Detects suspicious web requests indicative of CVE-2024-1708 exploitation on ScreenConnect servers.
author: Security Arsenal Research
date: 2026/07/18
status: experimental
logsource:
    category: web
    product: connectwise_screenconnect
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/Guest?'
            - 'SetupWizard'
    selection_method:
        cs-method: 'POST'
    condition: selection_uri and selection_method
falsepositives:
    - Legitimate administrative setup (rare in production)
level: critical
tags:
    - attack.initial_access
    - cve.2024.1708
    - nova
---
title: Suspicious PowerShell Encoded Command via RMM Tool
description: Detects base64 encoded PowerShell execution often used by ransomware gangs moving laterally through RMM tools like ScreenConnect.
author: Security Arsenal Research
date: 2026/07/18
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains: ' -enc '
    filter_parent:
        ParentProcessName|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\BomgarJumpClient.exe'
            - '\ConnectWiseControl.Client.exe'
    condition: selection and filter_parent
falsepositives:
    - Administrator troubleshooting
level: high
tags:
    - attack.execution
    - attack.lateral_movement
    - nova

// Hunt for lateral movement and data staging common in NOVA attacks
// Focuses on mass file access and unusual SMB traffic
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "cmd.exe", "wmic.exe", "psexec.exe", "psexec64.exe")
| where CommandLine contains_any ("-enc", "-encodedcommand", "downloadstring", "iex", "invoke-expression")
| extend InitatingAccount = AccountName, InitiatingProcess = FileName
| join kind=inner (DeviceNetworkEvents
    | where ActionType == "ConnectionSuccess"
    | where RemotePort in (445, 139, 3389) 
    | summarize Count=count() by DeviceId, RemoteIP, RemotePort
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcess, CommandLine, RemoteIP, RemotePort, Count
| where Count > 50 // High volume of connections suggests scanning/dump
| order by Timestamp desc

# NOVA Ransomware - T-Minus Hardening and Detection Script
# Checks for recent scheduled tasks (persistence) and Shadow Copy manipulation

Write-Host "[+] Starting NOVA Ransomware T-Minus Check..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 48 hours
$DateCutoff = (Get-Date).AddDays(-2)
Write-Host "[!] Checking for Scheduled Tasks created/modified since $DateCutoff..." -ForegroundColor Yellow

Get-ScheduledTask | ForEach-Object {
    $TaskInfo = $_ | Get-ScheduledTaskInfo
    if ($TaskInfo.LastRunTime -gt $DateCutoff -or $TaskInfo.NextRunTime -gt $DateCutoff) {
        $Action = $_.Actions.Execute
        if ($Action -match "powershell" -or $Action -match "cmd" -or $Action -match "http") {
            Write-Host "[SUSPICIOUS] Task Name: $($_.TaskName) | Action: $Action" -ForegroundColor Red
        }
    }
}

# 2. Check Volume Shadow Copy Status (Ransomware often deletes these before encryption)
Write-Host "[!] Checking Volume Shadow Copy Storage usage..." -ForegroundColor Yellow
try {
    $vss = gwmi -Namespace root/cimv2 -Class Win32_ShadowCopyStorage
    if ($vss.Count -eq 0) {
        Write-Host "[WARNING] No Shadow Copy Storage found. This may indicate prior deletion." -ForegroundColor Red
    } else {
        Write-Host "[OK] Shadow Copy Storage present." -ForegroundColor Green
    }
} catch {
    Write-Host "[ERROR] Could not query VSS." -ForegroundColor DarkGray
}

# 3. Check for suspicious RDP sessions (User mode)
Write-Host "[!] Querying recent RDP logons (non-console)..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
Where-Object {$_.Message -match 'Logon Type: 10' -and $_.Message -notmatch 'NETWORK SERVICE'} |
Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='IP';e={$_.Properties[19].Value}} | Format-Table

Write-Host "[+] Check Complete." -ForegroundColor Cyan


---