THEGENTLEMEN Ransomware: 15 New Victims Posted — Manufacturing & Telecom Targeting Spike

---
title: Potential Exchange Server Deserialization Exploit (CVE-2023-21529)
id: 8c7e8b0c-4a3b-4f9d-8c6a-1e4b2c3d4e5f
description: Detects potential exploitation of Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability.
status: experimental
date: 2026/05/10
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: exchange
detection:
    selection:
        EventID: 4 # Or specific Exchange log ID for backend errors
        Message|contains:
            - 'deserialization'
            - 'ObjectDeserializer'
            - 'LosFormatter'
    condition: selection
falsepositives:
    - Legitimate Exchange administration scripts
level: critical
---
title: SmarterMail Suspicious File Upload Activity (CVE-2025-52691)
id: 9d8f9c1d-5b4c-0e1e-9d7b-2f5c3d4e5f6a
description: Detects potential exploitation of SmarterMail Unrestricted Upload of File with Dangerous Type.
status: experimental
date: 2026/05/10
author: Security Arsenal Research
logsource:
    category: web
detection:
    selection_uri:
        cs-uri-stem|contains: '/Mail/'
    selection_ext:
        cs-uri-extension|contains:
            - 'aspx'
            - 'ashx'
            - 'asmx'
    selection_method:
        cs-method: 'POST'
    selection_status:
        sc-status: 200
    condition: all of selection_
falsepositives:
    - Legitimate file attachments via web interface
level: high
---
title: Cisco FMC Management Center Anomaly (CVE-2026-20131)
id: 0e1f2a3b-6c5d-7e8f-9a0b-1c2d3e4f5a6b
description: Detects suspicious process execution or management access patterns associated with Cisco FMC exploitation.
status: experimental
date: 2026/05/10
author: Security Arsenal Research
logsource:
    product: cisco
    service: fmc
detection:
    selection_cli:
        CommandLine|contains:
            - 'inject'
            - 'deserialize'
    selection_access:
        EventID|contains:
            - '112005' # User logged in
            - '112006' # User logged out
    timeframe: 1m
    condition: selection_cli or selection_access
falsepositives:
    - Administrative configuration changes
level: critical

// Hunt for SmarterMail and Exchange Anomalies associated with THEGENTLEMEN access
// Focus on unusual POST requests and user agents
union withsource = TableName *
| where TimeGenerated > ago(7d)
| where isnotempty(SrcIpAddress) and isnotempty(DstIpAddress)
// Filter for known vulnerable paths
| where Uri has "/Mail/" or Uri has "/ecp/" or Uri has "/owa/" 
| where HttpMethod in ("POST", "PUT")
// Look for indicators of exploitation attempts (Shell extensions, Deserialization strings)
| where Uri has ".aspx" or Uri has ".ashx" or Uri has ".jsp" or Uri has "LosFormatter"
// Exclude known internal scanners
| where SrcIpAddress !in ("192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12") 
| summarize RequestCount = count(), UniqueUserAgents = dcount(UserAgent) by Bin(TimeGenerated, 1h), SrcIpAddress, DstIpAddress, Uri, UserAgent
| where RequestCount > 5 or UniqueUserAgents > 1
| order by RequestCount desc
| extend Reason = "High frequency POST to vulnerable mail path"

<#
.SYNOPSIS
    Checks for evidence of ransomware precursors and recent access anomalies.
.DESCRIPTION
    This script checks for recent scheduled tasks (lateral movement),
    VSS shadow copy deletions (anti-forensics), and unusual network connections.
#>

Write-Host "[+] Initiating T-Minus Ransomware Hunt..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 24 hours
$Date = (Get-Date).AddDays(-1)
Write-Host "[!] Checking for Scheduled Tasks created/modified since $Date..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt $Date -or $_.LastRunTime -gt $Date} | Select-Object TaskName, TaskPath, Date, LastRunTime, Author

# 2. Check Volume Shadow Copy Service Status (VSS) Events
Write-Host "[!] Checking for VSS Shadow Copy Deletion Events (Event ID 140)..." -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=140; StartTime=$Date} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message | Format-List

# 3. Check for established PowerShell network connections (potential C2)
Write-Host "[!] Checking for established PowerShell network connections..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established -OwningProcess (Get-Process powershell -ErrorAction SilentlyContinue).Id | Select-Object LocalAddress, LocalPort, RemoteAddress, RemoteAddress, OwningProcess

Write-Host "[+] Hunt Complete." -ForegroundColor Green


---