SPACEBEARS Ransomware: Global Surge in Tech & Business Services — CVE-Driven Attacks & Detection Engineering

---
title: Potential Check Point IKEv1 Exploitation (CVE-2026-50751)
id: 41b8835c-2f1a-4a5e-9f3d-1b2c3d4e5f6a
description: Detects potential exploitation attempts against Check Point Security Gateway IKEv1 vulnerabilities associated with SPACEBEARS operations.
status: experimental
author: Security Arsenal Research
date: 2026/07/21
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: checkpoint
detection:
    selection:
        product: 'VPN'
        type: ' decryption_failure' or type: 'ike_failure'
    filter_main_version:
        vpn_version|contains: 'IKEv1'
    filter_main_payload:
        payload_size|gt: 1000 # Anomaly often associated with exploit payloads
    condition: selection and filter_main_version and filter_main_payload
falsepositives:
    - Misconfigured VPN clients
level: high
---
title: Suspicious ConnectWise ScreenConnect Web Request (CVE-2024-1708)
id: 5c2a9947-3e2b-4b6f-a0e1-c2d3e4f5a6b7
description: Detects path traversal patterns in ConnectWise ScreenConnect logs indicative of authentication bypass attempts.
status: experimental
author: Security Arsenal Research
date: 2026/07/21
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..'
            - '%2e%2e'
    selection_app:
        cs-host|contains: 'ScreenConnect'
    condition: all of selection_*
falsepositives:
    - Web vulnerability scanning
level: critical
---
title: SPACEBEARS Lateral Movement via WMI
id: 6d3b0058-4f3c-5d7g-b1f2-d3e4f5g6a7b8
description: Identifies lateral movement patterns consistent with SPACEBEARS using WMI for remote process creation.
status: experimental
author: Security Arsenal Research
date: 2026/07/21
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\wmiprvse.exe'
        ParentProcessName|endswith: '\svchost.exe'
    filter_legit_spooler:
        CommandLine|contains: 'Print' # Filter print spooler noise
    condition: selection and not filter_legit_spooler
falsepositives:
    - Legitimate system administration
level: medium

// Hunt for PowerShell processes spawned by ScreenConnect host service
DeviceProcessEvents
| where InitiatingProcessFileName =~ "ScreenConnect.ClientService.exe"
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "DownloadString", "IEX")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

<#
.SYNOPSIS
    SPACEBEARS Triage Script
.DESCRIPTION
    Checks for scheduled tasks created in the last 48h and suspicious Volume Shadow Copy activity.
#>

Write-Host "[*] SPACEBEARS Triage: Checking for persistence and encryption precursors..." -ForegroundColor Cyan

$DateCutoff = (Get-Date).AddHours(-48)

# Check for recently created scheduled tasks (Common persistence mechanism)
Write-Host "[+] Checking for Scheduled Tasks created/modified in last 48h..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | ForEach-Object {
    $TaskInfo = $_ | Get-ScheduledTaskInfo
    Write-Host "ALERT: Task found - $($_.TaskName)" -ForegroundColor Red
    Write-Host "   Last Run: $($TaskInfo.LastRunTime) | Author: $($_.Author)" -ForegroundColor DarkGray
}

# Check for vssadmin deletion attempts (Shadow Copy destruction)
Write-Host "[+] Checking Security Event Log for Process Creation (vssadmin)..." -ForegroundColor Yellow
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} -ErrorAction SilentlyContinue |
           Where-Object {$_.TimeCreated -gt $DateCutoff -and $_.Message -match 'vssadmin.exe' -and $_.Message -match 'delete'}

if ($Events) {
    Write-Host "CRITICAL: vssadmin delete commands detected." -ForegroundColor Red
    $Events | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "No vssadmin deletion events found in last 48h." -ForegroundColor Green
}