SPACEBEARS Ransomware Gang: 3 Fresh Leak-Site Victims — US/IT Sector Pressure, KEV Edge Exposure & Pre-Encryption Hunt Rules

Assessment date: 2026-09-05
Source basis: ransomware.live monitoring of SPACEBEARS onion leak-site postings, correlated against CISA Known Exploited Vulnerabilities entries with confirmed ransomware use.
Confidence: High on observed victims and posting dates; moderate on likely initial-access themes; low-to-moderate on direct CVE attribution until victim telemetry confirms exploit paths.

Executive view

SPACEBEARS published three victims in a 48-hour window: Sports Endeavors (US retail/e-commerce), Schwartz, Giannini, Lantsberger & Adamson / SGLA (US professional services/legal), and Studio Oculistico Ciraci (IT healthcare). The cluster is small but operationally useful: it shows continued pressure against mid-market organizations with high-value PII/PHI, client-matter data, payment-adjacent systems and interruptible revenue operations. Defenders should treat internet-edge VPNs, remote access/RMM tooling, Exchange, Windows privilege-escalation paths and developer-workstation supply-chain exposure as priority validation points this week.

Threat Actor Profile — SPACEBEARS

• Aliases: No widely corroborated aliases are confirmed in the provided dataset. Treat lookalike branding, recycled leak templates and shared infrastructure as unverified until infrastructure overlap is proven.
• Operating model: Not confirmed from the posting sample alone. The cadence and cross-sector spread are consistent with either a closed crew purchasing access or a compact RaaS with selective affiliates; do not assume affiliate scale from three posts.
• Ransom posture: Specific demand amounts are not included in the live pull. For planning, model double extortion: encryption plus leak-site publication, with pressure concentrated on legal exposure, regulated data and downtime cost.
• Likely initial access: Prioritize validation of internet-facing edge services and remote access stacks. The KEV set below points to plausible routes: Check Point IKEv1 improper authentication, ConnectWise ScreenConnect path traversal/RCE, Exchange deserialization, malicious Nx Console package exposure, and Windows link-following privilege escalation after foothold.
• Extortion approach: Assume data theft before detonation. Retail and healthcare victims create payment-card/PHI sensitivity; legal/professional services create privileged-client and litigation-data sensitivity.
• Dwell time: Not established by the leak dates. Use a planning range of days to weeks and hunt backward at least 14 days from first leak post for staging, new admin creation, RMM persistence and backup tampering.

Current Campaign Analysis

Targeted sectors: Retail & E-Commerce, Professional Services, Healthcare. This mix suggests monetization through operational disruption plus regulated/confidential data leverage rather than a single vertical exploit chain.

Geographic concentration: United States dominates with two victims; Italy adds a European healthcare data-protection angle under GDPR-like breach pressure.

Victim profile: The named organizations align to mid-market and upper-SMB enterprise bands: large enough to hold sensitive data and pay, often lean enough to have edge/tooling gaps. Revenue estimates should be treated as directional only: US retail/e-commerce and legal-services victims commonly sit in the tens to hundreds of millions USD range; the Italian specialty clinic is likely smaller but carries high per-record regulatory impact.

Posting frequency and escalation: Three postings across 2026-09-03 to 2026-09-04 indicate a tight release burst. Watch for follow-on waves: leak-site crews often post proof-of-breach first, then escalate filenames, sample trees or countdown timers when negotiations stall.

CVE connection as candidate access vectors: These CVEs are confirmed by CISA KEV as exploited and ransomware-associated, but are not yet proof of SPACEBEARS tradecraft in these specific cases. They are high-value hypothesis drivers:

• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 key exchange: prioritize VPN gateway logs, IKEv1 anomalies and emergency patch verification.
• CVE-2026-48027 — Nx Console embedded malicious code: inspect developer endpoints and build agents for malicious package versions and unexpected outbound beacons.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal/RCE: hunt for RMM service spawning shells, unexpected ScreenConnect installs and web traversal probes.
• CVE-2025-60710 — Microsoft Windows link following privilege escalation: look for post-foothold elevation to SYSTEM before deployment.
• CVE-2023-21529 — Microsoft Exchange deserialization: validate Exchange patch state and investigate authenticated webshell-to-mailbox or transport-layer abuse.

Detection Engineering

---
title: SPACEBEARS Candidate Edge Access - Check Point IKEv1 Authentication Anomaly
id: 9f4d7c1a-spacebears-0001
status: experimental
description: Detects suspicious IKEv1 authentication outcomes on Check Point Security Gateway that may indicate exploitation of improper authentication or validation gaps. Tune vendor field names to local log schema.
author: Security Arsenal - From The Dark Side
date: 2026/09/05
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: checkpoint
  service: vpn
detection:
  selection_ike:
    ike_version|contains: 'IKEv1'
  selection_auth:
    event.outcome|in:
      - success
      - failure
      - error
  filter_routine:
    auth_method|contains: 'certificate'
  condition: selection_ike and selection_auth and not filter_routine
falsepositives:
  - Legacy partner VPNs still using IKEv1 with weak proposals
  - Misconfigured remote access gateways during maintenance windows
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - cve.2026.50751
---
title: SPACEBEARS Candidate RMM Abuse - ScreenConnect Service Spawning Shell
id: 9f4d7c1a-spacebears-0002
status: experimental
description: Detects ConnectWise ScreenConnect components launching command interpreters, encoded PowerShell or script hosts, consistent with RMM abuse and path traversal/RCE follow-on activity.
author: Security Arsenal - From The Dark Side
date: 2026/09/05
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - ScreenConnect.ClientService.exe
      - ScreenConnect.WindowsClient.exe
      - ScreenConnect.Service.exe
  selection_child:
    Image|endswith:
      - cmd.exe
      - powershell.exe
      - pwsh.exe
      - wscript.exe
      - cscript.exe
      - rundll32.exe
      - mshta.exe
  selection_suspicious_cli:
    CommandLine|contains:
      - -enc
      - -encodedcommand
      - downloadstring
      - iex
      - bypass
      - hidden
  condition: selection_parent and selection_child and selection_suspicious_cli
falsepositives:
  - Legitimate ScreenConnect admin scripts deployed by MSPs
  - Managed remote support sessions during approved change windows
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.t1219
  - cve.2024.1708
---
title: SPACEBEARS Pre-Encryption Staging - Backup Tamper and Shadow Copy Destruction
id: 9f4d7c1a-spacebears-0003
status: experimental
description: Detects rapid anti-recovery behavior commonly observed immediately before ransomware detonation, including shadow copy deletion, backup catalog interference and boot recovery disabling.
author: Security Arsenal - From The Dark Side
date: 2026/09/05
references:
  - https://attack.mitre.org/techniques/T1490/
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - vssadmin.exe
      - wmic.exe
      - bcdedit.exe
      - wbadmin.exe
      - diskshadow.exe
  selection_args:
    CommandLine|contains:
      - delete shadows
      - shadowcopy delete
      - delete catalog
      - recoveryenabled no
      - ignoreallfailures
      - resize shadowstorage
  condition: selection_tool and selection_args
falsepositives:
  - Backup administrators pruning snapshots under change control
  - Storage optimization scripts on isolated test systems
level: critical
tags:
  - attack.impact
  - attack.t1490
  - ransomware.staging

let lookback = 14d;
let staging_terms = dynamic(['delete shadows','shadowcopy delete','recoveryenabled no','delete catalog','ignoreallfailures','psexec','process call create','/node:','-enc','encodedcommand']);
let risky_ports = dynamic(['445','3389','5985','5986']);
let proc = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where ProcessCommandLine has_any (staging_terms)
   or InitiatingProcessFileName in~ ('ScreenConnect.ClientService.exe','ScreenConnect.Service.exe')
   or FileName in~ ('PsExec.exe','wmic.exe','vssadmin.exe','bcdedit.exe','wbadmin.exe','diskshadow.exe')
| project ProcessTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId;
let net = DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemotePort in (risky_ports)
| where RemoteIPType !in~ ('Private','Loopback') or ActionType == 'ListeningConnectionSucceeded'
| project NetTime=TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, ActionType, ReportId;
proc
| join kind=leftouter net on DeviceName, ReportId
| extend SuspicionScore = iff(ProcessCommandLine has_any ('delete shadows','recoveryenabled no','delete catalog'), 3, 0) + iff(ProcessCommandLine has_any ('psexec','process call create','/node:'), 2, 0) + iff(InitiatingProcessFileName has 'ScreenConnect', 2, 0)
| where SuspicionScore >= 2
| summarize FirstSeen=min(ProcessTime), LastSeen=max(ProcessTime), max(SuspicionScore), Commands=make_set(ProcessCommandLine, 20), Parents=make_set(InitiatingProcessFileName, 20), RemoteEndpoints=make_set(strcat(RemoteIP,':',RemotePort), 20) by DeviceName, AccountName
| order by max_SuspicionScore desc, LastSeen desc

# SPACEBEARS rapid-response checks: RDP exposure, new persistence, shadow tamper and local admin drift.
$ErrorActionPreference = 'SilentlyContinue'
$since = (Get-Date).AddDays(-7)
$report = [ordered]@{}

$ts = Get-ItemProperty -Path 'HKLM:/SYSTEM/CurrentControlSet/Control/Terminal Server'
$rdpEnabled = ($null -ne $ts -and $ts.fDenyTSConnections -eq 0)
$report.RDPEnabled = $rdpEnabled
$report.RDPListening = (Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue).TcpTestSucceeded

$report.NewScheduledTasks = Get-ScheduledTask | Where-Object { $_.Date -ge $since -or $_.Info.LastRunTime -ge $since } | Select-Object TaskName,TaskPath,State,@{n='Actions';e={($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join ' | '}}

$report.ShadowTamperEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4682; StartTime=$since} | Select-Object TimeCreated,Id,Message | Select-Object -First 50
$report.ProcessAntiRecovery4688 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$since} | Where-Object { $_.Message -match 'vssadmin|wmic|bcdedit|wbadmin|diskshadow|delete shadows|shadowcopy delete|recoveryenabled' } | Select-Object TimeCreated,Message | Select-Object -First 100

$report.LocalAdministrators = Get-LocalGroupMember -Group 'Administrators' | Select-Object Name,ObjectClass,PrincipalSource
$report.RecentLocalUsers = Get-LocalUser | Where-Object { $_.Created -ge $since -or $_.LastLogon -ge $since } | Select-Object Name,Enabled,Created,LastLogon

$report.RMMIndicators = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'screenconnect|connectwise|anydesk|teamviewer|splashtop|atera|ninja|datto' -or $_.PathName -match 'screenconnect|connectwise|anydesk|teamviewer|splashtop|atera|ninja|datto' } | Select-Object Name,State,StartMode,PathName

$report.KevPatchSpotCheck = [ordered]@{
  CheckPointGatewayEdge = 'Manually verify gateway hotfix and IKEv1 exposure outside this endpoint script'
  ScreenConnect = 'Confirm server/client build is patched for CVE-2024-1708 and remove unauthorized instances'
  Exchange = 'Run Get-ExchangeServer and HealthChecker on mail infrastructure'
  Windows = 'Confirm cumulative update coverage for link-following privilege escalation fixes'
}

$report | ConvertTo-Json -Depth 6

Incident Response Priorities

T-minus detection checklist — before encryption fires:

1. Sudden Check Point VPN log anomalies around IKEv1, especially success after repeated failures or impossible-travel source ASN shifts.
2. New or unauthorized ScreenConnect/RMM services, outbound sessions from servers, or RMM parent processes spawning cmd, PowerShell, rundll32 or mshta.
3. Security 4688 bursts containing vssadmin, wmic shadowcopy delete, bcdedit recoveryenabled no, wbadmin delete catalog or diskshadow.
4. SMB/3389/WinRM fan-out from one workstation to many servers within minutes, followed by file writes to admin shares.
5. Mass file renames, entropy spikes, suspicious note files, or staged archives named for exfil such as backup, export, legal, mail, phi or finance.
6. Exchange IIS worker process anomalies, unexpected PowerShell remoting into Exchange, or new mailbox export requests.

Critical assets historically attractive for exfiltration in this sector mix: customer and payment-adjacent databases, order/export platforms, e-commerce admin panels, document management and client matter files, email archives, EHR/PHI stores, imaging repositories, HR files, finance shares, backups and cloud storage sync roots.

Containment actions ordered by urgency:

1. Isolate affected subnets and disable VPN/RMM inbound access at the edge; preserve gateway and RMM logs before rotation.
2. Block outbound egress to unknown ASNs and suspend newly created admin/service accounts; force password and Kerberos ticket resets where lateral movement is suspected.
3. Snapshot evidence, then protect backups: disable deletion permissions, enable immutability and verify restore before broad shutdowns.
4. Kill identified staging processes, quarantine hosts showing anti-recovery commands, and prioritize domain controllers, file servers, Exchange and hypervisors.
5. Prepare notification tracks early for US state breach laws, client-contract duties for legal data and GDPR/HIPAA-like obligations where PHI or EU resident data may be involved.

Hardening Recommendations

Immediate — next 24 hours:

• Patch or isolate Check Point Security Gateways exposed to IKEv1; disable IKEv1 where business-feasible and alert on legacy proposals.
• Remove unauthorized ScreenConnect instances; constrain approved RMM by allow-list, MFA, session recording and egress-only server rules.
• Apply Exchange and Windows updates mapped to CVE-2023-21529 and CVE-2025-60710; restrict local admin and interactive logon on servers.
• Audit Nx Console/developer extension versions, pin packages, block untrusted marketplace installs and inspect build-agent outbound traffic.
• Create high-fidelity alerts for shadow copy deletion, backup catalog deletion, bcdedit recovery changes and RMM-spawned shells.

Short-term — within 2 weeks:

• Move remote access behind phishing-resistant MFA and conditional access; replace flat VPN-to-internal reachability with ZTNA segmentation.
• Separate backup control planes, enforce immutable snapshots and test restores for domain, file, database and mail tiers.
• Deploy tiered administration and just-enough local admin; monitor additions to Administrators, Domain Admins and RMM policy groups.
• Add canary files and decoy shares on high-value data stores; alert on open/rename before bulk encryption begins.
• Build a leak-site response playbook covering evidence capture, negotiation/legal coordination, regulator mapping and executive decision gates.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub