WALLSTREET Ransomware Gang: 2 New US Victims Posted — Manufacturing & Technology Sector Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Briefing Date: 2026-08-10 | Source: ransomware.live monitoring of WALLSTREET .onion leak site

Executive Summary

WALLSTREET's dark web leak site published two new victims on 2026-08-10: Black Hills Bentonite (Manufacturing, US) and T.RAD North America (Technology, US). Both postings appeared on the same day, suggesting either a coordinated publication push or batch processing of intrusions from a prior access window. The targeting of US-based manufacturing and technology firms aligns with the group's historical preference for mid-market industrial organizations with weak edge security posture and high operational-downtime sensitivity.

1. Threat Actor Profile — WALLSTREET

Analyst note: WALLSTREET's profile overlaps heavily with the broader ransomware-as-a-service ecosystem even if closed. Defenders should treat the CVE set below as the likely access surface.

2. Current Campaign Analysis

Sector Targeting

• Manufacturing (1/2): Black Hills Bentonite — industrial minerals producer. Manufacturing remains the #1 ransomware target sector globally due to OT/IT convergence, downtime intolerance, and historically under-resourced security teams.
• Technology (1/2): T.RAD North America — automotive thermal systems technology. Technology-sector subsidiaries of industrial firms are attractive because they hold IP (CAD files, designs, supplier contracts) with high extortion value.

Geographic Concentration

• 100% United States. This matches WALLSTREET's observed pattern of focusing on US mid-market organizations where cyber-insurance coverage makes payment more likely and legal/regulatory exposure amplifies extortion pressure.

Victim Profile

• Mid-market industrial companies, estimated revenue range $50M–$500M.
• Organizations with distributed facilities, legacy VPN concentrators, and lean IT security staffing.
• Both victims are US operations of firms with industrial supply-chain roles — suggesting deliberate targeting of organizations where operational disruption translates quickly into payment pressure.

Posting Frequency / Escalation

• 2 postings in the current 100-post window, both on 2026-08-10. Same-day batch publication is a classic pattern: intrusions conducted weeks apart are published together to maximize media impact and create urgency across victims simultaneously.
• Defenders should assume the intrusions behind these postings occurred 1–3 weeks prior — other organizations scanned/exploited in the same campaign window may be compromised and not yet encrypted.

CVE Correlation — Likely Initial Access Surface

The following CISA KEV entries (all confirmed ransomware-associated) map directly to WALLSTREET's assessed access methods:

Priority action: If you run Check Point Security Gateway, treat CVE-2026-50751 as the probable entry point for this campaign and hunt for IKEv1 anomalies immediately.

3. Detection Engineering

Sigma Rules

---
title: WALLSTREET Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 8f3a1c2e-7b4d-4e9a-a1f5-ws20260001
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, or bcdedit — a near-universal pre-encryption behavior observed in WALLSTREET and peer ransomware operations.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.impact
  - attack.t1490
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete shadows /all'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance scripts
  - System administrators resizing shadow storage
---
title: WALLSTREET Ransomware - Lateral Movement via PsExec or Remote Service Creation
id: 8f3a1c2e-7b4d-4e9a-a1f5-ws20260002
status: experimental
description: Detects remote service creation and PsExec-style execution used by WALLSTREET operators to push ransomware payloads across hosts after initial compromise of VPN/edge access.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
logsource:
  product: windows
  service: system
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1021.002
detection:
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\PSEXESVC'
      - '.exe -accepteula'
      - 'cmd.exe /c'
  filter_legit:
    ServiceName|startswith:
      - 'SCCM'
      - 'BigFix'
  condition: selection_service and not filter_legit
falsepositives:
  - Enterprise software distribution tools (SCCM, BigFix, PDQ)
---
title: WALLSTREET Ransomware - Data Staging and Exfiltration Tool Execution
id: 8f3a1c2e-7b4d-4e9a-a1f5-ws20260003
status: experimental
description: Detects execution of Rclone, MEGAsync, and 7z archive staging with password protection — consistent with WALLSTREET's double-extortion exfiltration phase before encryption.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
logsource:
  category: process_creation
  product: windows
level: medium
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.collection
  - attack.t1560.001
detection:
  selection_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\FileZilla.exe'
      - '\winscp.exe'
  selection_archive:
    Image|endswith: '\7z.exe'
    CommandLine|contains:
      - ' -p'
      - ' a -m'
  condition: selection_tools or selection_archive
falsepositives:
  - Legitimate cloud backup workflows using rclone
  - End-user compression tools

KQL — Microsoft Sentinel Hunt Query

Hunt for pre-ransomware staging behavior consistent with WALLSTREET's playbook: edge/VPN logon anomalies followed by LOLBin lateral movement and shadow copy tampering within a 14-day window.

// WALLSTREET pre-ransomware staging hunt — correlate VPN logons, lateral movement, and anti-recovery behavior
let lookback = 14d;
let suspicious_vpn =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where AppDisplayName has_any ("VPN", "Check Point", "SSLVPN")
    | where ResultType == 0
    | summarize VPNLogons=count(), SourceIPs=make_set(IPAddress)
        by UserPrincipalName, bin(TimeGenerated, 1h)
    | where array_length(SourceIPs) > 1;  // same user, multiple IPs in 1h window
let lolbin_lateral =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("psexec.exe", "wmic.exe", "net.exe", "nltest.exe", "psexesvc.exe")
    | where ProcessCommandLine has_any ("\\", "admin$", "group", "domain controllers")
    | summarize LolbinEvents=count(), Hosts=dcount(DeviceName),
        Commands=make_set(ProcessCommandLine, 10)
        by InitiatingProcessAccountName, bin(TimeGenerated, 1h);
let antirecovery =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete",
        "recoveryenabled no", "resize shadowstorage")
    | project AntiRecoveryTime=TimeGenerated, DeviceName,
        Account=InitiatingProcessAccountName, ProcessCommandLine;
antirecovery
| join kind=leftouter (lolbin_lateral) on $left.Account == $right.InitiatingProcessAccountName
| join kind=leftouter (suspicious_vpn) on $left.Account == $right.UserPrincipalName
| project AntiRecoveryTime, DeviceName, Account, ProcessCommandLine,
    LolbinEvents, Hosts, VPNLogons, SourceIPs
| order by AntiRecoveryTime desc;

PowerShell — Rapid Triage Script

Run on suspected hosts or via your EDR's remote shell. Checks RDP exposure, scheduled tasks created in the last 7 days, shadow copy status, and suspicious new local admins.

# WALLSTREET Rapid Triage — run elevated. Outputs to C:\IR-Triage\
$out = "C:\IR-Triage\$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm')"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1. RDP exposure check
"=== RDP STATUS ===" | Out-File "$out\triage.txt"
$fDeny = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
"RDP Enabled: $(if ($fDeny -eq 0) {'YES - EXPOSED'} else {'No'})" | Out-File "$out\triage.txt" -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Out-File "$out\triage.txt" -Append

# 2. Scheduled tasks created in last 7 days
"=== RECENT SCHEDULED TASKS (7d) ===" | Out-File "$out\triage.txt" -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-List | Out-File "$out\triage.txt" -Append

# 3. Volume Shadow Copy status
"=== SHADOW COPIES ===" | Out-File "$out\triage.txt" -Append
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Out-File "$out\triage.txt" -Append }
else { "WARNING: No shadow copies present — possible anti-recovery tampering" | Out-File "$out\triage.txt" -Append }

# 4. New local admin accounts (14d)
"=== LOCAL ADMINS ===" | Out-File "$out\triage.txt" -Append
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
  Select-Object Name, ObjectClass | Out-File "$out\triage.txt" -Append
Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-14) } |
  Select-Object Name, Enabled, PasswordLastSet | Out-File "$out\triage.txt" -Append

# 5. Suspicious exfil/staging processes
"=== EXFIL TOOL PROCESSES ===" | Out-File "$out\triage.txt" -Append
Get-Process | Where-Object { $_.Name -match 'rclone|megasync|filezilla|winscp|7z' } |
  Select-Object Name, Id, Path | Out-File "$out\triage.txt" -Append

Write-Host "Triage complete: $out\triage.txt"

4. Incident Response Priorities — WALLSTREET Playbook

T-Minus Detection Checklist (Before Encryption Fires)

• Edge/VPN anomalies: IKEv1 authentication failures followed by success on Check Point gateways; impossible-travel logons; logons from IPs with no prior history.
• New local/domain admin accounts or unexpected group membership changes (Event ID 4728/4732/4756).
• RMM tool presence: ScreenConnect, AnyDesk, or similar tools installed outside your software inventory.
• Recon commands: nltest /dclist, net group "Domain Admins", net localgroup administrators bursts from a single host.
• Staging directories: Large compressed archives in C:\ProgramData, C:\Users\Public, or user temp folders.
• Cloud sync processes: rclone/MEGAsync running on servers (never legitimate there).
• Shadow copy tampering (Event via Sigma rule above) — this is your final warning signal, typically minutes-to-hours before detonation.
• GPO or PsExec mass-push activity — WALLSTREET-style operators deploy encryption domain-wide in one burst.

Assets Historically Prioritized for Exfiltration

Based on manufacturing/technology victimology, prioritize monitoring egress from:

1. File servers hosting CAD/engineering drawings and IP
2. ERP/MRP databases (SAP, Epicor, etc.) — customer, pricing, supplier data
3. HR/payroll shares — PII for regulatory-pressure leverage
4. Executive and legal mailboxes (Exchange — see CVE-2023-21529)
5. Backup infrastructure (Veeam/Commvault servers) — targeted for destruction before encryption

Containment Actions — Ordered by Urgency

1. Isolate edge/VPN infrastructure: Force-terminate all active VPN sessions, disable IKEv1 if unpatched, rotate all VPN-authenticated credentials.
2. Kill C2 and lateral movement channels: Block identified Cobalt Strike/PSExec paths; disable SMB admin shares temporarily on non-critical hosts if mass-push is suspected.
3. Protect backups NOW: Take backup infrastructure offline or air-gap it; verify at least one immutable/offline restore point before touching anything else.
4. Disable suspect accounts: Any account showing impossible-travel or recon behavior — disable, don't just reset.
5. Egress throttling: Rate-limit or temporarily block outbound traffic to consumer cloud storage (Mega, etc.) to slow exfiltration.
6. Snapshot critical servers before remediation actions destroy forensic evidence.
7. Engage IR retainer and legal counsel before any threat-actor communication; document everything for potential OFAC/insurance review.

5. Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway against CVE-2026-50751. If patching is not possible, disable IKEv1 for remote access VPN communities and enable MFA on all gateway logins. This is the single highest-leverage action against this campaign.
• Patch/audit ConnectWise ScreenConnect (CVE-2024-1708) and inventory ALL remote access tools; block unauthorized RMM binaries via AppLocker/WDAC.
• Patch Exchange (CVE-2023-21529) and Cisco FMC (CVE-2026-20131).
• Enable MFA everywhere — VPN, RDP gateways, O365, backup consoles.
• Deploy the Sigma rules above to your SIEM and validate alerting on vssadmin delete shadows execution.
• Verify offline/immutable backups exist and test one restore today.
• Block outbound Mega/rclone endpoints at the proxy for server VLANs.

Short-Term (2 Weeks)

• Segment manufacturing/OT networks from corporate IT; ransomware in this sector spreads via flat networks from IT into production segments.
• Deploy EDR with ransomware behavioral blocking (canary files, shadow-copy protection) on all servers and engineering workstations.
• Implement LAPS and eliminate shared local admin passwords to break PsExec-style lateral movement.
• Stand up egress DLP alerting on bulk outbound transfers (>1GB/hour per host) from file servers and database hosts.
• Harden backup architecture: separate credentials, immutable storage tier, and a documented restore RTO for ERP and file services.
• Vendor/developer toolchain audit given CVE-2026-48027 (supply-chain): pin package versions, verify signatures on dev tools, especially for technology-sector engineering teams.
• Tabletop exercise a double-extortion scenario: exfil-first decision tree, disclosure obligations, and leak-site monitoring workflow.

Analyst Bottom Line

WALLSTREET's 2026-08-10 batch publication is a warning shot for every US mid-market manufacturer and technology firm running Check Point VPN infrastructure. The gap between initial compromise and leak posting means there are almost certainly additional victims in the pipeline right now who have not yet been encrypted. The 24-hour actions above — particularly CVE-2026-50751 remediation and shadow-copy tampering detection — are the difference between catching this group during staging and reading your company name on their leak site next week.

Security Arsenal continues to monitor WALLSTREET's .onion infrastructure. This briefing will be updated as new victims are posted.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub