THegentlemen Ransomware: Aggressive Campaign Targets Manufacturing & Critical Infrastructure — 19 New Victims Analyzed

---
title: Potential SmarterMail Exploitation CVE-2025-52691
description: Detects suspicious file upload patterns to SmarterMail web interface indicative of unrestricted file upload exploitation.
id: 3a0f5b9e-1c2d-4a5e-9f8b-1c2d3e4f5a6b
status: experimental
date: 2026/05/11
author: Security Arsenal Research
logsource:
  category: web
detection:
  selection:
    c-uri|contains: '/Services/MailBox.asmx'
    cs-method: 'POST'
    c-uri-query|contains|all:
      - '.aspx'
      - 'filename'
  condition: selection
falsepositives:
  - Legitimate administrative file management
level: high
tags:
  - attack.initial_access
  - cve.2025.52691
  - thegentlemen
---
title: Microsoft Exchange Deserialization Anomaly CVE-2023-21529
description: Detects potential deserialization attacks on Microsoft Exchange Server via suspicious cmdlet execution.
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
date: 2026/05/11
author: Security Arsenal Research
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|contains: '\Exchange Server\v15\'
    AccessMask|contains: '0x10080'  # WriteData/AddFile and DeleteChild
  filter:
    SubjectUserName|contains: 'MSExchange'
  condition: selection and not filter
falsepositives:
  - High administrative load
level: high
tags:
  - attack.initial_access
  - cve.2023.21529
  - thegentlemen
---
title: Ransomware Volume Shadow Copy Deletion
description: Detects commands used to delete Volume Shadow Copies, a common precursor to encryption by THegentlemen.
id: c2d3e4f5-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
date: 2026/05/11
author: Security Arsenal Research
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowstorage delete'
  condition: selection
falsepositives:
  - Legitimate system administration (rare)
level: critical
tags:
  - attack.impact
  - thegentlemen

// Hunt for THegentlemen lateral movement and staging
// Focuses on PowerShell and SMB activity often seen post-exploit
DeviceProcessEvents  
| where Timestamp >= ago(7d)  
| where FileName in~ ("powershell.exe", "powershell_ise.exe", "pwsh.exe", "cmd.exe")  
| where ProcessCommandLine has_any ("Invoke-Expression", "IEX", "DownloadString", "FromBase64String", "-enc", "-encodedcommand")  
| extend DecodedCommand = parse_command_line(ProcessCommandLine, "windows")  
| where isnotempty(DecodedCommand)  
| summarize Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine by FileName  
| join kind=inner (  
    DeviceNetworkEvents  
    | where Timestamp >= ago(7d)  
    | where RemotePort in (445, 139, 3389)  
    | summarize count() by DeviceName, RemoteIP, RemotePort  
) on DeviceName  
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort

# THegentlemen Pre-Encryption Hardening & Check Script
# Run as Administrator
Write-Host "[THegentlemen Response] Checking for indicators of staging..." -ForegroundColor Cyan

# 1. Check for abnormal scheduled tasks created in last 24h (Common persistence)
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-24) }
if ($suspiciousTasks) {
    Write-Host "[ALERT] New Scheduled Tasks Detected:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Status
$vss = vssadmin list shadows
if ($vss -match "No shadow copies found") {
    Write-Host "[WARNING] No Volume Shadow Copies exist. If backups are missing, encryption may be imminent." -ForegroundColor Yellow
} else {
    Write-Host "[OK] Volume Shadow Copies present." -ForegroundColor Green
}

# 3. Audit exposed RDP (If not needed)
$rdp = Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
if ($rdp) {
    Write-Host "[WARNING] RDP (Port 3389) is listening. THegentlemen uses RDP for lateral movement." -ForegroundColor Yellow
    $rdp | Select-Object LocalAddress, State
} else {
    Write-Host "[OK] RDP is not exposed." -ForegroundColor Green
}