WALLSTREET Gang: Critical Infrastructure Sweep via Firewall & RMM Exploits

The WALLSTREET ransomware operation has escalated its activity on July 4, 2026, posting four new victims to its dark web leak site. This campaign demonstrates a sharp pivot towards critical infrastructure and public sector entities within the United States, alongside manufacturing targets. Intelligence analysis suggests the group is actively exploiting recently disclosed vulnerabilities in perimeter security appliances (Check Point, Cisco) and remote management tools (ConnectWise ScreenConnect) to gain initial access.

Threat Actor Profile — WALLSTREET

• Aliases: WST, The Street
• Operational Model: RaaS (Ransomware-as-a-Service) with a core development team and multiple affiliates.
• Ransom Demands: Typically ranges from $500,000 to $5 million, varying based on victim revenue and encryption speed.
• Initial Access: Primarily external-facing services. Recent intelligence confirms heavy reliance on exploiting CVEs in VPNs, Firewalls, and Remote Monitoring and Management (RMM) software. Phishing is used but is secondary to vulnerability exploitation.
• Double Extortion: Strict adherence to data theft prior to encryption. Victims failing to pay receive their data published on the TOR site.
• Average Dwell Time: 3–10 days. The group moves rapidly from lateral movement to impact once internal access is established.

Current Campaign Analysis

Sector and Geographic Focus

The latest posting batch indicates a targeted, rather than opportunistic, spray-and-pray approach:

• Targeted Sectors: Healthcare (50%), Public Sector (25%), Manufacturing (25%)
• Geographic Concentration: 75% of victims are US-based. The inclusion of Asisken (EC) suggests the affiliate network may be casting a wider net or utilizing supply chain compromises.

Victim Profile

• Baraga County Memorial Hospital (Healthcare): Likely revenue <$100M. High urgency target due to patient care impact.
• Edgewood Police Department (Public Sector): Small to mid-sized municipal agency. Highly sensitive data exposure risk.
• Gold Standard Automotive (Manufacturing): Operational technology (OT) disruption likely.

Exploited Vulnerabilities & TTP Mapping

The timing of these postings correlates with the availability of exploits for the following CISA KEV-listed CVEs:

• CVE-2026-50751 (Check Point Security Gateway): Likely used for initial perimeter bypass in corporate environments.
• CVE-2026-20131 (Cisco Secure Firewall FMC): Provides deep network access and disablement of security controls, facilitating lateral movement.
• CVE-2024-1708 (ConnectWise ScreenConnect): A common vector for MSPs and IT helpdesks, allowing remote code execution (RCE) as a service.

Escalation Patterns

The group is posting victims in batches of 4, suggesting a "weekend warrior" or holiday release strategy (US Independence Day) to maximize pressure on understaffed IT teams.

Detection Engineering

Sigma Rules

---
title: Potential ConnectWise ScreenConnect Path Traversal Exploit
id: 5a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects potential exploitation of CVE-2024-1708 in ConnectWise ScreenConnect via suspicious URI patterns.
status: experimental
author: Security Arsenal Intel
date: 2026/07/04
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.wallstreet
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/App_Extensions/'
            - '/Bin/'
        cs-method: 'POST'
    filter:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access
level: critical
---
title: WALLSTREET Lateral Movement via PsExec
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects execution of PsExec with specific parameters often used by WALLSTREET affiliates for spreading.
status: experimental
author: Security Arsenal Intel
date: 2026/07/04
tags:
    - attack.lateral_movement
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\psexec.exe'
        CommandLine|contains:
            - '-accepteula'
            - '-s'
    condition: selection
falsepositives:
    - Legitimate admin automation
level: high
---
title: Check Point IKEv1 Improper Authentication
id: 2c3d4e5f-6a7b-8c9d-0e1f-1a2b3c4d5e6f
description: Identifies suspicious IKEv1 negotiation attempts indicative of CVE-2026-50751 exploitation.
status: experimental
author: Security Arsenal Intel
date: 2026/07/04
tags:
    - attack.initial_access
    - cve.2026.50751
logsource:
    product: checkpoint
    service: vpn
detection:
    selection:
    - type: 'ike_phase_1'
      ike_version: '1'
      result: 'failure'
    filter:
      src_ip:
        - 'trusted_gateway_ip_1'
        - 'trusted_gateway_ip_2'
    condition: selection and not filter
level: medium

KQL Hunt Query (Microsoft Sentinel)

Hunts for staging behavior common in WALLSTREET operations prior to encryption.

DeviceProcessEvents
| where Timestamp > ago(3d)
| where FileName in~ ("robocopy.exe", "rar.exe", "7z.exe", "vssadmin.exe", "wbadmin.exe")
| where ProcessCommandLine contains "delete" or ProcessCommandLine contains "shadow" or ProcessCommandLine contains "/copyall"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

PowerShell Response Script

Rapid triage script to identify persistence mechanisms often established by this group.

# Check for Scheduled Tasks created in the last 7 days
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
    Select-Object TaskName, TaskPath, State, LastRunTime | 
    Format-Table -AutoSize

# Check for unusual recent shadow copy deletions
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | 
    Where-Object {$_.Message -like '*vssadmin*' -or $_.Message -like '*delete*'} | 
    Select-Object TimeCreated, Id, Message

Incident Response Priorities

T-Minus Detection Checklist

1. VPN/Firewall Logs: Scrutinize Check Point and Cisco FMC logs for authentication failures or abnormal admin sessions (CVE-2026-50751, CVE-2026-20131).
2. RMM Audit: Immediate audit of ConnectWise ScreenConnect logs for webshell creation or anomalous file access (CVE-2024-1708).
3. Active Directory: Look for sudden spikes in Service Principal Name (SPN) modifications or unusual Kerberos ticket requests.

Critical Assets Prioritized for Exfiltration

• PII/PHI databases (Healthcare targets).
• Evidence management systems (Law Enforcement targets).
• CAD/CAM schematics and IP (Manufacturing).

Containment Actions

1. Isolate: Disconnect the VPN infrastructure and internet-facing FMC devices immediately if anomalies are detected.
2. Suspend: Suspend all service accounts associated with ConnectWise ScreenConnect.
3. Revoke: Revoke all privileged access credentials stored in password managers accessed during the breach window.

Hardening Recommendations

Immediate (24h)

• Patch: Apply patches for CVE-2024-1708 (ScreenConnect), CVE-2026-50751 (Check Point), and CVE-2026-20131 (Cisco FMC) immediately.
• MFA: Enforce MFA on all VPN and remote access portals; reject push notifications if possible (use FIDO2).
• Block: Block internet access to RMM tools at the firewall level unless strictly necessary via specific IP allow-lists.

Short-term (2 weeks)

• Network Segmentation: Isolate high-value assets (Patient records, CAD servers) from the general network and internet-facing management segments.
• EDR Policy: Update EDR policies to detect and block PsExec and WMI execution endpoints from non-admin workstations.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub