THEGENTLEMEN Ransomware: 15 New Victims Posted — Global Manufacturing Sector Targeted via VPN & ScreenConnect Exploits

---
title: Potential THEGENTLEMEN Initial Access via ScreenConnect Auth Bypass
description: Detects potential exploitation of CVE-2024-1708 involving ScreenConnect path traversal leading to remote code execution. Monitoring for suspicious child processes spawned by the ScreenConnect service.
status: experimental
date: 2026/06/17
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\\ScreenConnect.WindowsClient.exe'
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\pwsh.exe'
            - '\\wscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use by IT staff
level: high
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware
---
title: THEGENTLEMEN Check Point VPN IKEv1 Anomaly
description: Detects indicators of CVE-2026-50751 exploitation involving improper authentication in IKEv1 key exchange on Check Point Security Gateways.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
    product: firewall
    service: checkpoint
detection:
    selection:
       |contains:
            - 'IKEv1'
            - 'vpn_trunk'
    filter_valid:
        src_ip_network:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection | not filter_valid
falsepositives:
    - Legacy VPN configurations
level: critical
tags:
    - attack.initial_access
    - cve.2026.50751
    - thegentlemen
---
title: THEGENTLEMEN Lateral Movement via PsExec
id: 4b0c4c6e-8c5e-4f3d-9c1f-2d4e5f6a7b8c
description: Detects the use of PsExec for lateral movement, a common technique observed in THEGENTLEMEN engagements prior to encryption.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\psexec.exe'
        CommandLine|contains:
            - '-accepteula'
            - '\\'
    condition: selection
falsepositives:
    - System administration
level: high
tags:
    - attack.lateral_movement
    - attack.execution
    - thegentlemen

// Hunt for suspicious process chains associated with ScreenConnect exploitation (CVE-2024-1708)
// and lateral movement tools common to THEGENTLEMEN
let SuspiciousTools = dynamic(['powershell.exe', 'cmd.exe', 'whoami.exe', 'nltest.exe', 'net.exe', 'taskkill.exe', 'rundll32.exe']);
let ScreenConnectParents = dynamic(['ScreenConnect.WindowsClient.exe', 'ScreenConnect.ClientService.exe', 'ConnectWise.Control.Client.exe']);
DeviceProcessEvents  
| where InitiatingProcessFileName in~ ScreenConnectParents 
| where FileName in~ SuspiciousTools
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

<#
.SYNOPSIS
    Rapid Response Script for THEGENTLEMEN Indicators.
.DESCRIPTION
    Checks for signs of CVE-2024-1708 exploitation, recent scheduled tasks,
    and abnormal service configurations associated with THEGENTLEMEN activity.
#>

Write-Host \"[*] Checking for recent suspicious Scheduled Tasks (Last 7 Days)...\" -ForegroundColor Cyan
$DateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {
    $_.Date -gt $DateCutoff -and 
    ($_.TaskName -like '*update*' -or $_.TaskName -like '*patch*' -or $_.TaskName -match '^[a-f0-9]{8,}')
} | Select-Object TaskName, Date, Author, Actions | Format-Table -AutoSize

Write-Host \"[*] Enumerating Services with Unusual Binary Paths (Potential Hijacking)...\" -ForegroundColor Cyan
Get-WmiObject Win32_Service | Where-Object {
    $_.PathName -match 'C:\\Users\\Public\' -or 
    $_.PathName -match 'C:\\Windows\\Temp\' -or
    $_.PathName -match '\.dll$' -and $_.StartMode -eq 'Auto'
} | Select-Object Name, DisplayName, PathName, StartMode | Format-Table -AutoSize

Write-Host \"[*] Checking for ScreenConnect Client Process Anomalies...\" -ForegroundColor Cyan
$Procs = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq 'cmd.exe' -or $_.Name -eq 'powershell.exe' }
foreach ($Proc in $Procs) {
    $Parent = Get-WmiObject Win32_Process | Where-Object { $_.ProcessId -eq $Proc.ParentProcessId }
    if ($Parent.Name -match 'ScreenConnect') {
        Write-Host \"[!] ALERT: Suspicious process spawned by ScreenConnect!\" -ForegroundColor Red
        Write-Host \"    Process: $($Proc.Name) | PID: $($Proc.ProcessId) | Parent: $($Parent.Name)\"
    }
}
Write-Host \"[*] Scan Complete.\" -ForegroundColor Green


---