THEGENTLEMEN Ransomware: 15 New Victims Posted — Surge in Healthcare & Tech Targeting via Cisco & ConnectWise

---
title: Potential ConnectWise ScreenConnect Path Traversal
id: 8f7c3f21-1a2b-3c4d-5e6f-7g8h9i0j1k2l
status: experimental
description: Detects potential path traversal attempts in ConnectWise ScreenConnect (CVE-2024-1708).
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/09
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '..'
            - '%2e%2e'
        c-uri|contains:
            - '/Host/'
            - '/Bin/'
        cs-method: POST
    condition: selection
falsepositives:
    - Legitimate scanning (rare)
level: critical
---
title: Cisco FMC Suspicious Java Deserialization Activity
id: b1d2e3f4-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects signs of potential deserialization attacks on Cisco FMC (CVE-2026-20131) via process logs.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/09
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/java'
        CommandLine|contains:
            - 'Runtime.getRuntime'
            - 'ProcessBuilder'
    filter_main:
        ParentImage|endswith:
            - '/opt/CSCOpx'
            - '/usr/local/sf/bin'
    condition: selection and not filter_main
falsepositives:
    - Administrative script execution
level: high
---
title: Ransomware Pre-Encryption Activity - VSS Deletion
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects deletion of volume shadow copies which is common pre-encryption behavior for THEGENTLEMEN.
author: Security Arsenal
date: 2026/06/09
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\vssadmin.exe'
            - '\\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'delete catalog'
    condition: selection
falsepositives:
    - System administrator maintenance
level: high

// Hunt for lateral movement and data staging associated with THEGENTLEMEN
// Look for massive file archive creation (7zip/WinRAR) on servers followed by SMB shares
DeviceProcessEvents  
| where Timestamp >= ago(7d)  
| where FileName in~ ("winrar.exe", "7z.exe", "powershell.exe", "cmd.exe")  
| where ProcessCommandLine contains any ("-a", "compress", "archive", "-enc")  
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")  
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName  
| order by Timestamp desc

<#
.SYNOPSIS
    Emergency Hardening & Detection Script for THEGENTLEMEN Indicators
.DESCRIPTION
    Checks for recent VSS shadow copy deletions and enumerates suspicious scheduled tasks added in the last 7 days.
#>

Write-Host "[+] Checking for VSS Shadow Copy Deletion Events (Last 7 Days)..." -ForegroundColor Cyan
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; ID=14098; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
if ($vssEvents) { 
    Write-Host "[ALERT] Found VSS deletion events!" -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[OK] No VSS deletion events found." -ForegroundColor Green
}

Write-Host "\n[+] Enumerating Scheduled Tasks created/modified in last 7 days..." -ForegroundColor Cyan
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($schTasks) {
    Write-Host "[ALERT] Found recently modified/created tasks:" -ForegroundColor Red
    $schTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[OK] No suspicious recent task activity." -ForegroundColor Green
}

Write-Host "\n[+] Checking for exposed RDP sessions (Non-Console)..." -ForegroundColor Cyan
$query = "SELECT * FROM Win32_LogonSession WHERE LogonType = 10"
Get-WmiObject -Query $query | Measure-Object | ForEach-Object { 
    if ($_.Count -gt 0) { Write-Host "[WARN] Active RDP sessions detected." -ForegroundColor Yellow } 
    else { Write-Host "[OK] No active RDP sessions." -ForegroundColor Green }
}