THEGENTLEMEN Ransomware: Global Surge Targeting Gov, Tech & Manufacturing — Intel & Detection

---
title: Potential Check Point Gateway IKEv1 Auth Bypass (CVE-2026-50751)
id: 82c9a3b1-1f4e-4c2b-9a8e-1c3d4e5f6a7b
status: experimental
description: Detects potential exploitation of CVE-2026-50751 involving improper authentication in IKEv1 key exchange on Check Point Security Gateways.
author: Security Arsenal
date: 2026/07/30
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: checkpoint
detection:
    selection:
        product|contains: 'VPN'
        action|contains: 'key_exchange'
        protocol|contains: 'ikev1'
        details|contains: 'aggressive_mode'
    filter:
        src_ip:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter
falsepositives:
    - Legacy VPN configurations from trusted internal ranges
level: critical
tags:
    - attack.initial_access
    - cve.2026.50751
    - thegentlemen
---
title: Suspicious VSS Shadow Copy Deletion via WMI or PowerShell
id: 9d3e4f5a-6b7c-8d9e-0f1a-2b3c4d5e6f7a
status: experimental
description: Detects commands often used by THEGENTLEMEN and similar groups to delete Volume Shadow Copies to prevent system recovery.
author: Security Arsenal
date: 2026/07/30
logsource:
    product: windows
    service: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\vssadmin.exe'
            - '\wmic.exe'
    selection_cli:
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'shadowstorage delete'
    condition: all of selection_*
falsepositives:
    - System administration maintenance (rare)
level: high
tags:
    - attack.impact
    - thegentlemen
---
title: Cisco FMC Deserialization Anomaly (CVE-2026-20131)
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2026-20131 on Cisco Secure Firewall Management Center via suspicious deserialization patterns or malformed API requests.
author: Security Arsenal
date: 2026/07/30
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: cisco
detection:
    selection:
        http_method|contains: 'POST'
        uri|contains: '/api/fmc_config/v1'
        response_code|contains: '500'
    timeframe: 5m
    condition: selection | count() > 3
falsepositives:
    - Misconfigured API integration scripts
level: critical
tags:
    - attack.initial_access
    - cve.2026.20131
    - thegentlemen

// Hunt for lateral movement and staging activity associated with THEGENTLEMEN
// Focuses on PsExec, WMI, and high-volume file modifications common in their campaigns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("psexec.exe", "psexec64.exe", "wmiprvse.exe") or 
   ProcessCommandLine contains "New-Item" and ProcessCommandLine contains "-ItemType Directory" // Potential staging
| where FileName !~ "explorer.exe"
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

# Rapid Response: Check for VSS Shadow Copy Manipulation and Scheduled Task Persistence
# Usage: Run as Administrator on suspect endpoints
Write-Host "Checking for recent VSS Shadow Copy deletions..." -ForegroundColor Yellow
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12343} -MaxEvents 10 -ErrorAction SilentlyContinue
if ($VssEvents) {
    Write-Host "WARNING: VSS Shadow Copy deletion events found!" -ForegroundColor Red
    $VssEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "No VSS deletion events found." -ForegroundColor Green
}

Write-Host "`nChecking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$Date = (Get-Date).AddDays(-7)
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt $Date }
if ($SuspiciousTasks) {
    Write-Host "WARNING: Recently created Scheduled Tasks detected:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "No recently created tasks found." -ForegroundColor Green
}