OROVA Ransomware Gang: Active Campaign Targeting US/HK Manufacturing & Finance — Critical CVE Alert

---
title: Potential Check Point Gateway Exploitation CVE-2026-50751
id: 50e2e8c4-9a12-4b2e-8c3d-1f2e3d4a5b6c
description: Detects potential exploitation of Check Point Security Gateway improper authentication vulnerability involving IKEv1 anomalies or unexpected administrative logins.
status: experimental
author: Security Arsenal Research
date: 2026/08/04
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
  - attack.initial_access
  - cve.2026.50751
  - orova
logsource:
  category: firewall
  product: checkpoint
detection:
  selection:
    service|contains: 'ike'
    action: 'accept'
  filter_legit_traffic:
    src_ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter_legit_traffic
level: high
---
title: ScreenConnect Path Traversal Exploitation Attempt CVE-2024-1708
id: f1d2e3f4-a5b6-4c7d-8e9f-0a1b2c3d4e5f
description: Detects suspicious URL patterns associated with the ConnectWise ScreenConnect path traversal vulnerability.
status: experimental
author: Security Arsenal Research
date: 2026/08/04
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
  - attack.initial_access
  - cve.2024.1708
  - orova
logsource:
  category: webserver
detection:
  selection:
    cs_uri_query|contains:
      - '..%2f'
      - '..\'
    c_uri|contains:
      - '/Guest'
      - '/Setup'
  condition: selection
level: critical
---
title: Ransomware Pre-Encryption VSS Deletion
id: a1b2c3d4-e5f6-4a5b-8c6d-7e8f9a0b1c2d
description: Detects commands used to delete Volume Shadow Copies via vssadmin or wmic, a common precursor to OROVA encryption.
status: experimental
author: Security Arsenal Research
date: 2026/08/04
tags:
  - attack.impact
  - orova
logsource:
  category: process_creation
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: 1 of selection*
level: high

// Hunt for lateral movement and data staging indicative of OROVA behavior
// Focuses on SMB usage and unusual file masses
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName in~ ("powershell.exe", "cmd.exe", "wmic.exe", "psexec.exe", "psexec64.exe")
| where ProcessCommandLine has any("copy", "move", "robocopy") 
   or ProcessCommandLine has "net share"
| extend FileOrShare = extract(@'(copy|move|robocopy)\s+["']?(.*?)["']?\s+', 2, ProcessCommandLine)
| where isnotempty(FileOrShare)
| summarize Count=count(), Timestamp=arg_max(Timestamp, *) by DeviceName, AccountName, ProcessCommandLine
| where Count > 5 
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, Count
| order by Count desc

<#
.SYNOPSIS
    Rapid Response Hardening Script for OROVA Campaign
.DESCRIPTION
    Checks for exposed RDP, recent VSS modifications, and enumerates suspicious scheduled tasks.
#>

Write-Host "[+] Starting OROVA Rapid Response Hardening Check..." -ForegroundColor Cyan

# 1. Check for RDP Enabled
Write-Host "\n[1] Checking RDP Status..."
$RDP = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections"
if ($RDP.fDenyTSConnections -eq 0) {
    Write-Host "[!] WARNING: RDP is ENABLED. Consider disabling via GPO or firewall." -ForegroundColor Red
} else {
    Write-Host "[+] RDP is disabled." -ForegroundColor Green
}

# 2. Check for recently modified Volume Shadow Copies (Last 7 days)
Write-Host "\n[2] Checking for VSS modification events (ID 8229 - Deleted)..."
$VSSDeletions = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=8229; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
if ($VSSDeletions) {
    Write-Host ("[!] CRITICAL: Found " + $VSSDeletions.Count + " VSS deletion events in the last 7 days. Potential ransomware activity.") -ForegroundColor Red
} else {
    Write-Host "[+] No VSS deletion events found." -ForegroundColor Green
}

# 3. Enumerate Scheduled Tasks created in last 7 days
Write-Host "\n[3] Checking for Scheduled Tasks created in last 7 days..."
$CutoffDate = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $CutoffDate} | ForEach-Object {
    Write-Host "[!] Suspicious Task: $($_.TaskName) (Created: $($_.Date))" -ForegroundColor Yellow
}

Write-Host "\n[+] Scan Complete. Review warnings immediately." -ForegroundColor Cyan


---