THEGENTLEMEN Ransomware: Global Surge Exploiting Cisco FMC & SmarterMail CVEs — Intel Brief

---
title: Potential Cisco FMC Deserialization Exploit CVE-2026-20131
id: c2d8e9f1-0a2b-4c5d-9e6f-1a2b3c4d5e6f
description: Detects potential exploitation attempts of Cisco Secure Firewall Management Center deserialization vulnerability via suspicious HTTP POST patterns.
author: Security Arsenal Research
date: 2026/04/19
status: experimental
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains: '/api/fmc_config/v1/domain/'
        c-method: POST
    filter_main:
        sc-status|contains:
            - 200
            - 404
            - 500
    condition: selection and filter_main
falsepositives:
    - Legitimate administrative API usage from known internal IP ranges
level: critical
---
title: SmarterMail Authentication Bypass CVE-2026-23760
id: e3f1a2b3-4c5d-6e7f-8a9b-0c1d2e3f4a5b
description: Detects suspicious authentication patterns or path traversal indicative of SmarterMail auth bypass exploitation.
author: Security Arsenal Research
date: 2026/04/19
status: experimental
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: smartertools
    service: smartermail
detection:
    selection_uri:
        c-uri|contains:
            - '/Runtime/'
            - '/Services/MailService.asmx'
    selection_method:
        c-method: POST
    condition: selection_uri and selection_method
falsepositives:
    - Unknown, investigation required
level: high
---
title: THEGENTLEMEN Lateral Movement PsExec and WMI
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Detects lateral movement patterns typically used by THEGENTLEMEN affiliates involving PsExec or WMI process creation.
author: Security Arsenal Research
date: 2026/04/19
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: '-accepteula'
    selection_wmi:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    condition: 1 of selection_*
falsepositives:
    - System administration activity
level: high

// Hunt for lateral movement and staging indicators associated with THEGENTLEMEN
let ProcessList = dynamic(["psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe", "cmd.exe"]);
let SuspiciousCommands = dynamic(["-enc", "-encodedcommand", "downloadstring", "iex", "invoke-expression"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ProcessList 
| where ProcessCommandLine has_any (SuspiciousCommands) or InitiatingProcessFileName in~ ProcessList
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, FolderPath
| order by Timestamp desc

<#
.SYNOPSIS
    Checks for RDP brute force indicators and recent Shadow Copy manipulation (Ransomware Prep).
.DESCRIPTION
    This script queries the Security Event Log for failed RDP logins (Event ID 4625) 
    and the System Event Log for Shadow Copy Deletion (Event ID 1 from volsnap). 
#>

$DateThreshold = (Get-Date).AddDays(-1)

# Check for excessive Failed RDP Logins (Possible Brute Force)
Write-Host "[INFO] Checking for Failed RDP Logins (Event ID 4625)..." -ForegroundColor Cyan
$FailedRDP = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=$DateThreshold} -ErrorAction SilentlyContinue |
              Group-Object -Property IpAddress |
              Where-Object {$_.Count -gt 10} |
              Select-Object Name, Count

if ($FailedRDP) {
    Write-Host "[ALERT] High frequency of failed RDP logins detected from the following IPs:" -ForegroundColor Red
    $FailedRDP | Format-Table -AutoSize
} else {
    Write-Host "[OK] No excessive failed RDP logins found." -ForegroundColor Green
}

# Check for Shadow Copy Deletion
Write-Host "[INFO] Checking for Shadow Copy Deletion events (Event ID 1 from volsnap)..." -ForegroundColor Cyan
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='volsnap'; ID=1; StartTime=$DateThreshold} -ErrorAction SilentlyContinue

if ($VssEvents) {
    Write-Host "[ALERT] Shadow Copy deletion events detected. Possible ransomware activity." -ForegroundColor Red
    $VssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[OK] No Shadow Copy deletions found." -ForegroundColor Green
}


---