SECTION9 Ransomware: Surge in LATAM & Global Attacks — Check Point & ScreenConnect Exploitation

Security Arsenal Threat Intelligence Team has detected a significant spike in activity by the SECTION9 ransomware group. As of 2026-07-27, the group has posted 15 new victims to their dark web leak site, indicating a high-velocity campaign. The attack vector heavily correlates with recent CISA Known Exploited Vulnerabilities (KEV), specifically targeting perimeter security appliances (Check Point, Cisco FMC) and remote management tools (ConnectWise ScreenConnect).

Threat Actor Profile — SECTION9

• Affiliation/Model: Suspected RaaS (Ransomware-as-a-Service) operation or highly organized closed group with affiliate sub-teams handling initial access vs. encryption.
• Geographic Focus: Current campaign shows a distinct pivot towards LATAM (Brazil, Portugal, Uruguay) alongside consistent targeting of US and European entities (France, Sweden, Belgium).
• Ransom Demands: Estimated range $500,000 – $3,000,000 USD based on victim verticals (Agriculture, Retail, Healthcare).
• TTPs (Tactics, Techniques, Procedures):
  • Initial Access: Exploitation of CVE-2026-50751 (Check Point IKEv1) and CVE-2024-1708 (ConnectWise). Secondary access via vulnerable Exchange servers (CVE-2023-21529).
  • Lateral Movement: Usage of Cobalt Strike beacons and PsExec for internal propagation.
  • Exfiltration: Large-scale data staging prior to encryption utilizing rclone or custom FTP scripts.
  • Double Extortion: Standard practice; data is published to the .onion site if payment is not received within the 3-5 day deadline.
• Dwell Time: Short. Evidence suggests automation between initial exploit (VPN/RMM) and ransomware detonation, averaging 2-4 days.

Current Campaign Analysis

Sector Targeting

SECTION9 is displaying a "spray-and-pray" approach to initial access followed by selective encryption. The current victim list spans:

• Technology (High priority)
• Agriculture & Food Production (Critical infrastructure targeting)
• Retail & E-Commerce (High transaction volume)
• Healthcare (High urgency for payment)

Geographic Concentration

• Primary: Brazil (BR), Portugal (PT), Uruguay (UY).
• Secondary: United States (US), France (FR).
• Anomaly: Activity detected in Monaco (MC) and Japan (JP), suggesting a broader affiliate network or automated vulnerability scanning.

CVE Correlation & Attack Vector

The inclusion of CVE-2026-50751 (Check Point Security Gateway) is the critical differentiator in this campaign. By targeting the firewall/VPN itself, the attackers bypass internal network segmentation and MFA controls often placed on user accounts. The simultaneous use of CVE-2024-1708 (ConnectWise ScreenConnect) suggests a multi-pronged approach: attackers are exploiting both the network perimeter and trusted remote management tools.

Detection Engineering

SIGMA Rules

---
title: Potential Check Point IKEv1 Exploitation (CVE-2026-50751)
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of Check Point Security Gateway IKEv1 authentication vulnerability as seen in SECTION9 campaigns.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/27
logsource:
    product: firewall
    service: check_point
detection:
    selection:
        product: 'VPN'
        action: 'key_install'
        ike_version: 'IKEv1'
    filter:
        src_ip|startswith:
            - '10.'
            - '192.168.'
    condition: selection and not filter
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
    - ransomware.section9
---
title: ConnectWise ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: b1c2d3e4-f5a6-b7c8-d9e0-f1a2b3c4d5e6
status: experimental
description: Detects web requests indicative of the ScreenConnect path traversal vulnerability used by SECTION9 for initial access.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/07/27
logsource:
    category: webserver
detection:
    selection_uri:
        TargetUrl|contains:
            - '/Bin/'
            - '.ashx'
    selection_payload:
        TargetUrl|contains:
            - '..%2f'
            - '..\'
    condition: all of selection_*
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
    - ransomware.section9
---
title: Suspicious Vssadmin Deletion - Pre-Encryption Staging
id: c3d4e5f6-a7b8-c9d0-e1f2-a3b4c5d6e7f8
status: experimental
description: Detects commands used to delete Volume Shadow Copies, a common step in SECTION9 playbook to prevent recovery.
references:
    - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal Research
date: 2026/07/27
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
    selection_param:
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
    condition: all of selection_*
level: high
tags:
    - attack.impact
    - attack.t1490
    - ransomware.section9

KQL (Microsoft Sentinel)

// Hunt for SECTION9 lateral movement and RMM exploitation
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
// Hunting for ConnectWise ScreenConnect child processes (often spawn PowerShell or Cmd)
| where InitiatingProcessFileName =~ "ScreenConnect.Service.exe" 
   or InitiatingProcessFileName =~ "ScreenConnect.ClientService.exe"
// Flagging suspicious spawned processes
| where FileName in~ ("powershell.exe", "cmd.exe", "cscript.exe", "regsvr32.exe")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

PowerShell - Rapid Response Hardening

<#
.SYNOPSIS
    SECTION9 Response Script - Audit RDP and Shadow Copies
.DESCRIPTION
    Checks for active non-local RDP sessions and recent VSS deletions.
#>

Write-Host "[SECTION9 RESPONSE] Initiating Rapid Diagnostic..." -ForegroundColor Cyan

# 1. Check for Active RDP Sessions (Non-Console)
$rdpSessions = query user | Where-Object { $_ -match 'Active' -and $_ -notmatch 'console' }
if ($rdpSessions) {
    Write-Host "[WARNING] Active RDP Sessions Detected:" -ForegroundColor Red
    $rdpSessions
} else {
    Write-Host "[INFO] No non-console RDP sessions found." -ForegroundColor Green
}

# 2. Check for Volume Shadow Copy Deletions in Event Logs (Last 24h)
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12343; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($vssEvents) {
    Write-Host "[CRITICAL] Recent Volume Shadow Copy Deletion Events Found:" -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[INFO] No VSS deletion events in the last 24 hours." -ForegroundColor Green
}

Write-Host "[SECTION9 RESPONSE] Diagnostic Complete."

Incident Response Priorities

T-Minus Detection Checklist

Before encryption fires, look for:

1. Check Point Logs: Spikes in IKEv1 negotiation failures or successful auth from unknown foreign IPs (especially BR/PT ranges).
2. ScreenConnect Logs: Web session logs containing path traversal strings (..%2f) in the SetupWizard or Bin directories.
3. Process Anomalies: powershell.exe spawning directly from ScreenConnect.Service.exe with encoded arguments.

Critical Assets for Exfiltration

SECTION9 historically prioritizes:

• Databases: SQL Server dumps (.bak, .mdf) from retail/ag sectors.
• HR Records: Employee PII and sensitive financial docs.
• R&D: Source code and intellectual property from Technology victims.

Containment Actions

1. Isolate VPN Concentrators: Immediately disconnect Check Point Security Gateways from the internal network if IKEv1 is enabled and unpatched.
2. Kill RMM Sessions: Force-logout all active ConnectWise ScreenConnect sessions and disable the service on critical servers until patched.
3. Segment Critical Data: Isolate backup repositories from the general network VLAN.

Hardening Recommendations

Immediate (24 Hours)

• Disable IKEv1: On all Check Point Security Gateways, disable IKEv1 and force IKEv2 with strong encryption suites.
• Patch External Services: Apply the patch for CVE-2024-1708 (ConnectWise) immediately. If patching is impossible, place the ScreenConnect server behind a Zero Trust Network Access (ZTNA) gateway.
• MFA Enforcement: Ensure all VPN and RMM access requires FIDO2 or hardware token MFA.

Short-term (2 Weeks)

• Network Segmentation: Move RMM tools and VPN concentrators to a dedicated management VLAN with strict egress/ingress rules.
• Shadow Copy Protection: Implement Immutable storage solutions (WORM) for backups to prevent deletion even if the VSS writer is compromised.
• Geo-Blocking: Consider blocking incoming IP ranges from non-operational regions (based on the threat intel, monitor but filter traffic from high-risk regions if business permits).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub