THEGENTLEMEN Ransomware: Global Surge Targeting Healthcare & Tech — Critical CVEs & Detection Rules

title: Potential ConnectWise ScreenConnect Authentication Bypass CVE-2024-1708
id: 85c0278a-8b2f-4c8a-9f5d-1a1b2c3d4e5f
status: experimental
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability leading to RCE.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/08
tags:
    - cve.2024.1708
    - initial.access
    - ransomware
logsource:
    category: web
    product: screenconnect
detection:
    selection:
        cs-method|contains: 'POST'
        c-uri|contains: "/App_Extensions/"
    filter:
        cs-user-agent|contains: 'Mozilla'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access
level: high
---
title: SmarterMail Unrestricted File Upload CVE-2025-52691
id: 9d1e38f7-9c3d-4d9e-0e6f-2b3c4d5e6f7a
status: experimental
description: Detects suspicious file upload patterns on SmarterMail servers indicative of CVE-2025-52691 exploitation.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/08
tags:
    - cve.2025.52691
    - initial.access
    - webshell
logsource:
    category: web
    product: smartertools
detection:
    selection_uri:
        c-uri|contains: "/Services/Mail.asmx"
    selection_ext:
        c-uri|endswith:
            - '.aspx'
            - '.ashx'
    condition: selection_uri and selection_ext
falsepositives:
    - Legitimate email client interactions
level: critical
---
title: Suspicious PowerShell Encoded Command with Base64
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the use of EncodedCommand in PowerShell often used by ransomware gangs like THEGENTLEMEN for obfuscation.
author: Security Arsenal
date: 2026/06/08
tags:
    - attack.execution
    - attack.t1059.001
    - ransomware
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: ' -Enc '
        CommandLine|contains: ' -EncodedCommand '
    filter_legit:
        ParentImage|contains:
            - '\System32\'
            - '\SysWOW64\'
    condition: selection and not filter_legit
falsepositives:
    - System management software
level: medium

// Hunt for lateral movement and potential Cobalt Strike activity often associated with THEGENTLEMEN
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in ("powershell.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe")
| where ProcessCommandLine has "-enc" or ProcessCommandLine has "downloadstring" or ProcessCommandLine has "iex"
// Specific focus on network connections spawned by these processes
| join kind=inner (DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemotePort in (443, 80, 8080) // Common C2 ports
| summarize count() by DeviceId, RemoteUrl, RemoteIP
) on DeviceId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessFileName
| extend IOCLink = pack_all()

<#
.SYNOPSIS
    Hunt for Ransomware Staging Indicators (THEGENTLEMEN Context)
.DESCRIPTION
    Checks for suspicious scheduled tasks (often used for persistence), 
    recent VSS shadow copy deletions (pre-encryption), and large mass file modifications.
#>

Write-Host "[!] Hunting for THEGENTLEMEN Indicators of Compromise..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 3 days (Persistence)
$DateCutoff = (Get-Date).AddDays(-3)
$SuspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff -and $_.Author -notlike "*Microsoft*" -and $_.Author -notlike "*System*"}

if ($SuspiciousTasks) {
    Write-Host "[ALERT] Found suspicious scheduled tasks created recently:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Author, Date | Format-Table
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# 2. Check for VSS Shadow Copy Deletions (Event ID 140) in last 24h
$VSSEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=140; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue

if ($VSSEvents) {
    Write-Host "[ALERT] Volume Shadow Copy Service deletions detected in last 24h!" -ForegroundColor Red
    $VSSEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[OK] No VSS shadow copy deletions detected." -ForegroundColor Green
}

# 3. Check for massive file count changes in User Profiles (Encrypted file extensions)
# Note: This is a basic check, in real incident response, use FSChangey or similar tools.
Write-Host "[INFO] Please review user profile directories for mass extension changes (e.g., .locked, .gentlemen)."