THEGENTLEMEN Ransomware Gang: Global Manufacturing & Energy Surge — Detection Engineering & Critical IOCs

---
title: Suspicious Check Point VPN Authentication Failures
id: 45f9e36a-8b4c-4e9e-8c1a-3e1d4f5b9a1c
status: experimental
description: Detects potential brute force or exploitation attempts against Check Point Security Gateways associated with CVE-2026-50751
author: Security Arsenal
date: 2026/06/17
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - attack.credential_access
    - cve.2026.50751
logsource:
    product: firewall
    service: vpn
detection:
    selection:
        vendor: 'Check Point'
        product: 'Security Gateway'
        event_type: 'authentication_failure'
        failure_reason:
            - 'authentication_failed'
            - 'invalid_credentials'
            - 'ikev1_error'
    condition: selection and |count(src_ip) > 20
    timeframe: 5m
falsepositives:
    - Legitimate users with incorrect credentials
    - VPN connection issues
level: high
---
title: ConnectWise ScreenConnect Remote Code Execution
id: 67d9c32e-9a5d-4f7a-8b2c-4e3f5g6h7i8j
status: experimental
description: Detects suspicious web request patterns associated with CVE-2024-1708 exploitation on ConnectWise ScreenConnect servers
author: Security Arsenal
date: 2026/06/17
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
    - https://www.connectwise.com/trust/security-bulletins
tags:
    - attack.initial_access
    - attack.execution
    - cve.2024.1708
logsource:
    category: webserver
detection:
    selection:
        cs_host|contains: 'ScreenConnect'
        cs_uri_query|contains:
            - 'WebService.asmx'
            - 'Host.ashx'
        cs_uri_query|contains:
            - '../'
            - '..\\'
            - '%2e%2e'
            - '%2e%2e%2f'
        cs_method: 'POST'
    filter_legitimate:
        cs_user_agent|contains:
            - 'ScreenConnect'
            - 'ConnectWise'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate testing of the application
    - Authorized security assessments
level: critical
---
title: Suspicious Volume Shadow Copy Manipulation
id: 78e0d43f-0b6e-5g8b-9c3d-5f4g6h7i8j9k
status: experimental
description: Detects commands related to Volume Shadow Copy manipulation, deletion, or suspicious access patterns common in ransomware operations
author: Security Arsenal
date: 2026/06/17
tags:
    - attack.defense_evasion
    - attack.impact
    - attack.t1490
logsource:
    product: windows
    service: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'Delete Shadows'
            - 'Delete ShadowStorage'
            - 'Resize ShadowStorage'
    selection_powershell_vss:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'Get-WmiObject Win32_ShadowCopy'
            - 'gwmi Win32_ShadowCopy'
            - 'Remove-WmiObject Win32_ShadowCopy'
            - 'rwmi Win32_ShadowCopy'
    selection_wmic_vss:
        Image|endswith: '\wmic.exe'
        CommandLine|contains:
            - 'shadowcopy delete'
            - 'shadowcopy call delete'
    selection_diskshadow:
        Image|endswith: '\diskshadow.exe'
    filter_legitimate:
        User|contains:
            - 'AUTHORI'
            - 'ADMINI'
    condition: (selection_vssadmin or selection_powershell_vss or selection_wmic_vss or selection_diskshadow) and not filter_legitimate
falsepositives:
    - System administrator backup management
    - Legitimate disk management operations
level: high

// Hunt for suspicious lateral movement patterns associated with THEGENTLEMEN ransomware
// Focus on PsExec, WMI, and rapid account usage across systems
let TimeFrame = 7d;
let SuspiciousTools = datatable(Source:string)['PsExec.exe', 'psexec64.exe', 'psexecsvc.exe', 'wmic.exe', 'wmi.exe', 'powershell.exe'];
// Identify unusual administrative tool execution across multiple hosts
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in (SuspiciousTools)
| extend ToolType = case(
    FileName contains "psexec", "PsExec",
    FileName contains "wmic", "WMIC",
    FileName contains "powershell", "PowerShell",
    "Other"
)
// Look for processes spawned with credentials of another user
| where ProcessCommandLine has_any("/user", "/u:", "-u:", "-credential", "-cred")
// Filter for execution against remote systems
| where ProcessCommandLine has_any("\\\\", "\\\\\\\\", "-computer", "-target", "-node", "invoke-command", "icm")
| summarize 
    Count=count(),
    TargetHosts=make_set(InitiatingProcessAccountDomain, 10),
    Commands=take_any(ProcessCommandLine),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
    by DeviceId, DeviceName, FileName, ToolType, InitiatingProcessAccountName, InitiatingProcessAccountDomain
| where Count > 5
| where TargetHosts > 1
| order by Count desc
| project
    Timestamp=FirstSeen,
    DeviceName,
    ToolType,
    InitiatingProcessAccountName,
    InitiatingProcessAccountDomain,
    RemoteExecutionCount=Count,
    UniqueTargetHosts=array_length(TargetHosts),
    Commands,
    Severity=iff(Count > 20, "Critical", iff(Count > 10, "High", "Medium"))

<#
.SYNOPSIS
    THEGENTLEMEN Ransomware Detection Script
.DESCRIPTION
    Rapid response script to detect indicators of THEGENTLEMEN ransomware activity
.NOTES
    Author: Security Arsenal
    Date: 2026-06-17
    Version: 1.0
#>

# Check for exposed RDP
Write-Host "Checking for exposed RDP connections..." -ForegroundColor Yellow
$rdpConnections = Get-NetTCPConnection -State Established -LocalPort 3389 -ErrorAction SilentlyContinue
if ($rdpConnections) {
    Write-Host "WARNING: Active RDP connections found:" -ForegroundColor Red
    $rdpConnections | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Format-Table -AutoSize
} else {
    Write-Host "No active RDP connections detected" -ForegroundColor Green
}

# Enumerate scheduled tasks added in last 7 days
Write-Host "`nChecking for recently scheduled tasks (last 7 days)..." -ForegroundColor Yellow
$sevenDaysAgo = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $taskInfo = $task | Get-ScheduledTaskInfo
    if ($taskInfo.LastRunTime -gt $sevenDaysAgo -or $task.Date -gt $sevenDaysAgo) {
        Write-Host "Potential suspicious task: $($task.TaskName)" -ForegroundColor Red
        Write-Host "  Created: $($task.Date)" 
        Write-Host "  Last Run: $($taskInfo.LastRunTime)"
        Write-Host "  Author: $($task.Author)"
        Write-Host "  Command: $($task.Actions.Execute)"
    }
}

# Find recently modified Volume Shadow Copies
Write-Host "`nChecking for suspicious Volume Shadow Copy activity..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=$sevenDaysAgo} -ErrorAction SilentlyContinue
if ($vssEvents) {
    $suspiciousEvents = $vssEvents | Where-Object {$_.Message -match '(delete|remove|stop|abort)'}
    if ($suspiciousEvents) {
        Write-Host "WARNING: Suspicious VSS activity detected:" -ForegroundColor Red
        $suspiciousEvents | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-List
    }
}

# Check for suspicious process execution patterns
Write-Host "`nChecking for suspicious process execution..." -ForegroundColor Yellow
$suspiciousProcesses = @('psexec.exe', 'psexec64.exe', 'psexecsvc.exe', 'vssadmin.exe', 'diskshadow.exe', 'wbadmin.exe')
$suspiciousActivity = @()
foreach ($process in $suspiciousProcesses) {
    $events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$sevenDaysAgo} -ErrorAction SilentlyContinue | 
              Where-Object {$_.Message -match [regex]::Escape($process)}
    if ($events) {
        $suspiciousActivity += $events
    }
}
if ($suspiciousActivity) {
    Write-Host "WARNING: Suspicious process activity detected:" -ForegroundColor Red
    $suspiciousActivity | Select-Object TimeCreated, Id, Message | Format-List
}

# Summary
Write-Host "`nScan complete. Review any warnings above for potential THEGENTLEMEN ransomware activity." -ForegroundColor Cyan