THEGENTLEMEN Ransomware: Global Campaigns Targeting Manufacturing & Tech via Critical Infrastructure CVEs

---
title: Potential SmarterMail Unrestricted File Upload Exploit
description: Detects potential exploitation of CVE-2025-52691 in SmarterMail via suspicious file upload patterns or IIS logs.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
author: Security Arsenal Research
date: 2026/05/06
tags:
    - attack.initial_access
    - attack.web_application
    - cve.2025.52691
logsource:
    product: windows
    service: iis
    definition: 'Requirements: IIS Logs with fields cs-uri-stem and cs-method'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/Services/Mail.asmx'
            - '/Grid.ashx'
    filter_legit:
        cs-uri-query|contains: 'wsdl'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate admin usage of SmarterMail interfaces
level: high
---
title: Microsoft Exchange Deserialization Exploit Attempt
description: Detects suspicious PowerShell deserialization activity indicative of CVE-2023-21529 exploitation on Exchange Servers.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
author: Security Arsenal Research
date: 2026/05/06
tags:
    - attack.initial_access
    - attack.execution
    - cve.2023.21529
logsource:
    product: windows
    service: security
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_exchange:
        ProcessName|endswith: '\w3wp.exe'
    selection_suspicious:
        ScriptBlockText|contains:
            - 'System.Management.Automation.Serialization'
            - 'TypeConfidenceDelegate'
            - 'ExtendedTypeSystem'
    condition: all of selection_*
falsepositives:
    - Rare legitimate Exchange management scripts
level: critical
---
title: Ransomware Lateral Movement via PsExec
description: Detects the use of PsExec for lateral movement, a common TTP for THEGENTLEMEN affiliates after gaining initial access.
status: experimental
author: Security Arsenal Research
date: 2026/05/06
tags:
    - attack.lateral_movement
    - attack.execution
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
    selection_cli:
        CommandLine|contains:
            - '-accepteula'
            - '\\'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative activities
level: high

// Hunt for SmarterMail exploitation signs and subsequent lateral movement
// Join IIS logs with Process creation events to see webshells spawning processes
let IIS_Suspicious = IMWebEvent
| where UriPath has_any ("Services/Mail.asmx", "Grid.ashx", "AjaxPro/") 
| where HttpMethod == "POST"
| project TimeGenerated, SourceIP, UserAgent, UriPath, SiteName;
let Process_Spawn = SecurityEvent 
| where EventID == 4688 
| where NewProcessName in~ ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe") 
| where ParentProcessName has_any ("w3wp.exe", "svchost.exe")
| project TimeGenerated, Computer, Account, NewProcessName, ParentProcessName;
IIS_Suspicious 
| join kind=inner (Process_Spawn) on TimeGenerated 
| extend TimeDiff = Process_Spawn_TimeGenerated - TimeGenerated 
| where TimeDiff between (0s..1m) 
| project TimeGenerated, SourceIP, Computer, Account, UriPath, NewProcessName

<#
.SYNOPSIS
    Rapid Response Hardening & Hunt for THEGENTLEMEN Indicators
.DESCRIPTION
    Checks for scheduled task persistence (common for this gang) and 
    identifies deletion of Volume Shadow Copies which precedes encryption.
#>

Write-Host "[+] Checking for suspicious Scheduled Tasks created in last 7 days..." -ForegroundColor Cyan
$DateCutoff = (Get-Date).AddDays(-7)
$SuspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Date -ge $DateCutoff -and 
    $_.Author -notin ("Microsoft Corporation", "N/A", "System") -and 
    $_.TaskName -notmatch "Update" 
}

if ($SuspiciousTasks) {
    Write-Host "[!!!] WARNING: Suspicious tasks found:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Author, Date, Actions | Format-List
} else {
    Write-Host "[-] No obvious suspicious tasks found." -ForegroundColor Green
}

Write-Host "[+] Checking for Shadow Copy Manipulation (Vssadmin) in Security Logs..." -ForegroundColor Cyan
try {
    $VssEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=$DateCutoff} -ErrorAction Stop |
    Where-Object { $_.Message -match 'vssadmin.exe' -and $_.Message -match 'delete' -and $_.Message -match 'shadows' }
    
    if ($VssEvents) {
        Write-Host "[!!!] CRITICAL: Vssadmin deletion commands detected. Encryption likely imminent." -ForegroundColor Red
        $VssEvents | Select-Object TimeCreated, Id, Message | Format-List
    } else {
        Write-Host "[-] No Vssadmin deletion events found." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Error reading event logs (check permissions)." -ForegroundColor Yellow
}