UNSAFE Ransomware Gang: 3 New Victims in 72 Hours — Tech & Manufacturing Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Published: 2026-08-11 | Source: Dark web leak site monitoring via ransomware.live, CISA KEV correlation

Executive Summary

The UNSAFE ransomware operation posted three new victims to its dark web leak site between 2026-08-09 and 2026-08-10, indicating an active intrusion wave concentrated against Technology and Manufacturing organizations in the United States and India. Posting cadence (3 victims in ~72 hours) suggests multiple simultaneous intrusions rather than opportunistic single-target activity. The temporal correlation between this campaign and five CISA KEV entries with confirmed ransomware use — including Check Point, Cisco FMC, and ConnectWise ScreenConnect vulnerabilities — strongly indicates perimeter-device exploitation as the dominant initial access vector.

Organizations running Check Point Security Gateway, Cisco FMC/SCD, ConnectWise ScreenConnect, or Microsoft Exchange in hybrid configurations should treat this briefing as an immediate action item.

Threat Actor Profile — UNSAFE

Analyst Note: UNSAFE's victim selection — a SaaS presentation platform, an app development firm, and a homebuilder ERP vendor — indicates a deliberate focus on organizations holding customer PII, source code, and project/financial data with high extortion leverage and historically immature backup segmentation.

Current Campaign Analysis

Sector Targeting

• Technology (2/3 victims): Presentations.AI (US SaaS), DECK APP TECHNOLOGIES PTE. LTD (IN software development). Technology targets yield source code, API keys, customer databases, and downstream supply-chain leverage.
• Manufacturing (1/3 victims): Constellation HomeBuilder Systems (US) — a vertical software/ERP provider to construction manufacturing. Compromise of a vertical vendor creates downstream risk to its entire customer base.

Geographic Concentration

• United States (2/3), India (1/3). The US/IN pairing is consistent with targeting software development and SaaS delivery organizations with cross-border operations — a profile that maximizes both data value and regulatory-pressure leverage (US breach notification statutes, India's DPDP Act).

Victim Profile

• Size range: SMB to mid-market (estimated 50–500 employees; $10M–$150M annual revenue band based on sector norms). This is the classic UNSAFE sweet spot: large enough to pay, small enough to lack 24/7 SOC coverage.

Posting Frequency / Escalation

• 3 postings within a ~72-hour window (2026-08-09 → 2026-08-10). Two victims posted on the same day (2026-08-10) indicates a batched publication cycle — a hallmark of an operation processing multiple concurrent intrusions. Expect further postings in the next 7–14 days as un-remediated perimeter footholds mature.

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries with confirmed ransomware exploitation align with this campaign window:

Assessment: The mix of perimeter CVEs plus a developer-tool supply-chain CVE mirrors the victim sector split exactly. Treat unpatched instances of any of the above as assumed-compromised until proven otherwise.

Detection Engineering

Sigma Rules

---
title: UNSAFE Ransomware - VPN/Perimeter Anomalous Authentication Post-Exploitation
id: 8f2a1c4e-unsafe-0001-2026-a1b2c3d4e501
status: experimental
description: Detects successful VPN authentication from unusual geographies or at unusual hours followed by internal RDP/SMB session initiation, consistent with UNSAFE's perimeter-exploit-to-internal-pivot playbook (CVE-2026-50751 pattern).
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/08/11
logsource:
  category: authentication
  product: vpn
detection:
  selection_geo:
    source_country|contains:
      - 'RU'
      - 'CN'
      - 'KP'
      - 'IR'
  selection_hours:
    event_time_hour:
      - 0
      - 1
      - 2
      - 3
      - 4
      - 5
  condition: selection_geo or selection_hours
falsepositives:
  - Legitimate traveling executives; offshore contractors — tune allowlists per org
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: UNSAFE Ransomware - Pre-Encryption Staging and VSS Tampering
id: 8f2a1c4e-unsafe-0002-2026-a1b2c3d4e502
status: experimental
description: Detects volume shadow copy deletion, backup catalog tampering, or boot config modification — the final pre-detonation step in the UNSAFE playbook.
author: Security Arsenal Threat Intel
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_vss
falsepositives:
  - Backup software maintenance windows — correlate with change tickets
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: UNSAFE Ransomware - RMM and Lateral Movement Tool Execution (ScreenConnect/PsExec/WMI)
id: 8f2a1c4e-unsafe-0003-2026-a1b2c3d4e503
status: experimental
description: Detects execution of remote access and lateral movement tooling abused by UNSAFE affiliates, including ScreenConnect artifacts (CVE-2024-1708 aftermath), PsExec service installation, and remote WMI process creation.
author: Security Arsenal Threat Intel
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\remcom.exe'
  selection_screenconnect:
    CommandLine|contains:
      - 'screenconnect'
      - 'connectwise'
      - '.setup.msi'
  selection_wmi_remote:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'process call create'
      - '/node:'
  condition: 1 of selection_*
falsepositives:
  - Admin tooling — baseline approved admin hosts and alert on execution elsewhere
level: high
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1219

KQL — Microsoft Sentinel Hunt Query

Hunt for the pre-ransomware staging pattern: a burst of new scheduled tasks or service installations across multiple hosts within a short window — UNSAFE's mass-deployment preparation behavior.

// UNSAFE pre-detonation staging hunt: mass scheduled task/service creation burst
let Lookback = 7d;
let SuspiciousTasks =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID in (4698, 4697, 7045)  // scheduled task created, service created (sec log), service created (sysmon/system)
    | where Process !in~ ("svchost.exe", "MsMpEng.exe", "TrustedInstaller.exe")
    | extend HostKey = Computer
    | summarize FirstSeen=min(TimeGenerated), EventCount=count(),
                DistinctHosts=dcount(Computer), SampleCommands=make_set(CommandLine, 5)
      by Account, bin(TimeGenerated, 1h)
    | where EventCount >= 5 or DistinctHosts >= 3;
SuspiciousTasks
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin", "bcdedit", "wbadmin", "delete shadows", "cipher /w")
    | project VssTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
) on $left.Account == $right.InitiatingProcessAccountName
| project FirstSeen, Account, EventCount, DistinctHosts, SampleCommands, DeviceName, ProcessCommandLine, VssTime
| order by FirstSeen desc

PowerShell — Rapid Triage Script

Run on suspected patient-zero hosts and domain controllers to surface 7-day persistence and anti-recovery artifacts.

# UNSAFE rapid triage: 7-day persistence sweep + shadow copy integrity check
# Run elevated. Output: CSV bundle for IR review.
$cutoff = (Get-Date).AddDays(-7)
$out = "C:\IR_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm')"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1. Scheduled tasks created/modified in last 7 days
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TaskName   = $_.TaskName
        TaskPath   = $_.TaskPath
        Author     = $_.Author
        LastRun    = $info.LastRunTime
        Actions    = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join ' | '
    }
} | Where-Object { $_.LastRun -gt $cutoff -or $_.Actions -match 'powershell|cmd|wscript|mshta|rundll32' } |
  Export-Csv "$out\ScheduledTasks_7d.csv" -NoTypeInformation

# 2. Services installed in last 7 days (creation time via registry)
Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' | ForEach-Object {
    $img = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).ImagePath
    if ($img -and (Test-Path ($img -replace '"','' -split ' ')[0] -ErrorAction SilentlyContinue)) {
        $exe = ($img -replace '"','' -split ' ')[0]
        $wt = (Get-Item $exe -ErrorAction SilentlyContinue).CreationTime
        if ($wt -gt $cutoff) {
            [PSCustomObject]@{ Service=$_.PSChildName; ImagePath=$img; Created=$wt }
        }
    }
} | Export-Csv "$out\NewServices_7d.csv" -NoTypeInformation

# 3. Volume Shadow Copy integrity — ransomware deletes these pre-detonation
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "[ALERT] NO shadow copies present — possible vssadmin deletion (T1490)" |
    Out-File "$out\VSS_ALERT.txt" }
else { $shadows | Select-Object ID, InstallDate, VolumeName |
    Export-Csv "$out\ShadowCopies.csv" -NoTypeInformation }

# 4. RDP exposure check
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
$fw = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue |
      Where-Object Enabled -eq 'True'
[PSCustomObject]@{ RdpEnabled = ($rdp.fDenyTSConnections -eq 0); RdpFirewallRules = $fw.Count } |
  Export-Csv "$out\RDP_Exposure.csv" -NoTypeInformation

# 5. Suspicious recent logons (type 3/10 from external IPs in last 72h)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-72)} `
  -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match 'Logon Type:\s+(3|10)' -and $_.Message -notmatch 'Source Network Address:\s+(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'
} | Select-Object TimeCreated, @{n='Msg';e={$_.Message.Substring(0,[Math]::Min(400,$_.Message.Length))}} |
  Export-Csv "$out\ExternalLogons_72h.csv" -NoTypeInformation

Write-Host "[+] Triage bundle written to $out"

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. VSS deletion commands (vssadmin delete shadows, bcdedit recoveryenabled no) — the single highest-fidelity pre-detonation signal. Page the on-call IR lead on any hit.
2. Burst of scheduled task/service creation across ≥3 hosts within one hour — mass-deployment preparation.
3. Unexpected RMM binaries (ScreenConnect, AnyDesk, Atera) on servers — UNSAFE uses legitimate RMM for persistence and staging (ties to CVE-2024-1708 exploitation).
4. Large archive creation (7z/rar) in user profile or staging directories, followed by outbound transfer spikes to cloud storage or VPS IPs.
5. EDR/AV tampering events — service stops, exclusions added, or agent uninstalls.

Critical Assets UNSAFE Prioritizes for Exfiltration

• Customer databases and CRM exports (extortion leverage against your customers)
• Source code repositories and CI/CD secrets (Technology victims — treat any compromise as a secrets-rotation event)
• Financial/project data and contracts (Manufacturing/ERP victims)
• HR records and executive communications (pressure material)

Containment Actions — Ordered by Urgency

1. Isolate at the network layer, not the host layer — segment affected VLANs; do not power off (preserve memory for forensics).
2. Disable the suspected ingress path immediately — Check Point VPN, Cisco FMC, ScreenConnect, or Exchange hybrid endpoints.
3. Force-reset all domain credentials, prioritizing Tier-0 (DA, EA) and service accounts; revoke VPN sessions and issued certificates.
4. Rotate all secrets reachable from compromised dev tooling (Nx Console supply-chain scenario): API keys, npm/PAT tokens, cloud IAM keys.
5. Snapshot and isolate backups — verify offline/immutable copies before any restore decision; assume online backup catalogs were enumerated.
6. Engage IR retainer before any attacker communication; preserve leak-site screenshots and ransom notes as evidence.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the five KEV CVEs, priority order: CVE-2026-50751 (Check Point) → CVE-2026-20131 (Cisco FMC) → CVE-2024-1708 (ScreenConnect) → CVE-2023-21529 (Exchange) → CVE-2026-48027 (Nx Console — audit and reinstall dev tooling from clean sources).
• Disable IKEv1 on Check Point gateways where IKEv2 is viable.
• Audit for unauthorized RMM tools; block execution of non-approved remote access binaries via AppLocker/WDAC.
• Enable tamper protection on all EDR agents and alert on vssadmin delete shadows as a paging event.
• Verify backup immutability and test one restore today — assume attackers enumerated your backup catalog.

Short-Term (2 Weeks)

• Decommission internet-facing management planes (Cisco FMC, ScreenConnect server) behind VPN/ZTNA with device posture checks.
• Segment dev workstations and build infrastructure from production; enforce signed-package verification in CI/CD pipelines to blunt supply-chain vectors like CVE-2026-48027.
• Deploy tiered administration — no Tier-0 credentials on endpoints; gMSA for service accounts.
• Deploy the Sigma rules and KQL query above into your SIEM with automated isolation playbooks on critical-severity hits.
• Implement egress filtering and DLP alerting on multi-GB outbound transfers to non-corporate cloud storage — exfiltration precedes encryption by days; this is your cheapest detection win.

Security Arsenal continues to monitor the UNSAFE leak site. This briefing will be updated if posting cadence accelerates or new victim sectors emerge. Organizations matching the victim profile (mid-market Technology/Manufacturing, US/IN presence, unpatched perimeter appliances) should operate under heightened alert for the next 14 days.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub