Bulletin date: 2026-08-31
Source: ransomware.live monitoring of WALLSTREET .onion leak site; CISA KEV correlation
Confidence: Moderate-high for victimology; moderate for CVE linkage pending victim-specific telemetry.
Threat Actor Profile — WALLSTREET
WALLSTREET operates as a financially motivated ransomware crew with leak-site branding consistent with a closed or semi-private RaaS cell rather than a broad affiliate marketplace. Aliases are limited in open reporting; defenders should track the brand, onion service, negotiation handles, wallet addresses and payload hashes rather than rely on a single name. The group follows a double-extortion model: steal regulated or operationally sensitive data first, then encrypt and threaten publication. Ransom pressure typically scales to victim sector, cyber-insurance posture and downtime tolerance; healthcare and education victims are often pushed toward rapid payment because patient care, safety systems and academic calendars create high availability requirements.
Typical initial access patterns for crews in this ecosystem include perimeter exploitation against VPN/security gateways, exposed or weakly monitored RDP, valid accounts purchased from access brokers, phishing that drops loaders or abused RMM tooling, and exploitation of remote monitoring and management software already trusted by IT. Dwell time is usually measured in days rather than months: gain access, enumerate AD, stage data, disable recovery, then detonate during low-staffing windows. Expect hands-on-keyboard activity after initial tooling, with Cobalt Strike-style beacons, PsExec/WMI movement and attempts to delete Volume Shadow Copies before encryption.
Current Campaign Analysis
The last 100 WALLSTREET postings show two recent victims: Cedar County Memorial Hospital, US healthcare, published 2026-08-31; and Andover, US education, published 2026-08-30. Sector concentration is US-only in this window, with healthcare and education indicating deliberate selection of organizations holding sensitive personal data and facing public-service uptime pressure. Cedar County Memorial Hospital implies a regional provider profile: modest enterprise security staffing, legacy clinical apps, vendor remote access, and high value placed on PHI, billing and continuity. Andover implies a public-sector education profile with identity sprawl, student data, budget constraints and seasonal operational deadlines.
Posting frequency is low-volume but back-to-back across two days, suggesting either a focused intrusion set or batch publication after parallel intrusions. Escalation pattern to watch: initial leak posts naming the victim, then countdown timers, sample data, then full dump if negotiation stalls. CVE correlation is circumstantial but actionable. CVE-2026-50751 in Check Point Security Gateway fits edge-device initial access. CVE-2024-1708 in ConnectWise ScreenConnect and CVE-2026-48027 in Nx Console align with trusted-tool/supply-chain execution. CVE-2025-60710 supports privilege escalation on Windows hosts, while CVE-2023-21529 supports authenticated Exchange attack chains in email-heavy school and hospital environments. Treat these as prioritized exposure hypotheses, not confirmed root cause for the named victims.
Detection Engineering
---
title: WALLSTREET - Perimeter VPN or Security Gateway Exploit Followed by Suspicious Child Process
id: 9c2f6f11-6b51-4f95-9a11-wallstreet0001
status: experimental
description: Detects suspicious process spawn from VPN/security gateway services after exploitation patterns consistent with edge-device intrusion.
author: Security Arsenal
date: 2026/08/31
references:
- https://securityarsenal.com/darkside
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection_parent:
ParentImage|endswith:
- '/cpwd'
- '/fw'
- '/vpn'
- '/ScreenConnect.Service.exe'
- '/ScreenConnect.ClientService.exe'
selection_child:
Image|endswith:
- '/cmd.exe'
- '/powershell.exe'
- '/pwsh.exe'
- '/wscript.exe'
- '/rundll32.exe'
- '/whoami.exe'
- '/net.exe'
condition: selection_parent and selection_child
falsepositives:
- Managed RMM scripts launched by approved administrators
level: high
tags:
- attack.initial_access
- attack.t1190
- attack.t1059
---
title: WALLSTREET - Pre-Ransomware Staging via WMI PsExec and Shadow Copy Tampering
id: 1a7f7bd7-5b32-4cf6-a61d-wallstreet0002
status: experimental
description: Detects lateral movement and recovery sabotage often observed immediately before ransomware detonation.
author: Security Arsenal
date: 2026/08/31
logsource:
category: process_creation
product: windows
detection:
selection_lateral:
Image|endswith:
- '/psexec.exe'
- '/psexesvc.exe'
- '/wmic.exe'
CommandLine|contains:
- 'process call create'
- '/node:'
- '\\'
selection_sabotage:
Image|endswith:
- '/vssadmin.exe'
- '/wbadmin.exe'
- '/bcdedit.exe'
- '/powershell.exe'
CommandLine|contains:
- 'delete shadows'
- 'resize shadowstorage'
- 'delete catalog'
- 'recoveryenabled no'
- 'Get-WmiObject Win32_Shadowcopy'
condition: 1 of selection_*
falsepositives:
- Backup administrators during maintenance windows
level: critical
tags:
- attack.lateral_movement
- attack.t1021
- attack.t1490
- attack.impact
---
title: WALLSTREET - Exchange Deserialization or Windows Link-Following Abuse Artifacts
id: 60d15537-a82f-44de-8bd9-wallstreet0003
status: experimental
description: Detects web shell writes under Exchange paths and suspicious shortcut/link execution used for privilege escalation or persistence.
author: Security Arsenal
date: 2026/08/31
logsource:
category: file_event
product: windows
detection:
selection_exchange:
TargetFilename|contains:
- 'Program Files/Microsoft/Exchange Server'
- 'FrontEnd/HttpProxy'
- 'ClientAccess'
TargetFilename|endswith:
- '.aspx'
- '.ashx'
- '.asmx'
selection_lnk:
TargetFilename|endswith: '.lnk'
TargetFilename|contains:
- 'Users/Public'
- 'AppData/Local/Temp'
- 'ProgramData'
condition: selection_exchange or selection_lnk
falsepositives:
- Exchange cumulative updates and approved admin shortcuts
level: high
tags:
- attack.persistence
- attack.t1505.003
- attack.privilege_escalation
- attack.t1547
let Lookback = 14d;
let SuspiciousTools = dynamic(['psexec.exe','psexesvc.exe','wmic.exe','vssadmin.exe','wbadmin.exe','bcdedit.exe','rclone.exe','7z.exe','winrar.exe','curl.exe']);
let EdgeOrRMM = dynamic(['ScreenConnect','vpn','checkpoint','exchange','iis','w3wp.exe']);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ (SuspiciousTools) or InitiatingProcessFileName has_any (EdgeOrRMM)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId),
(DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemotePort in (3389,5985,5986,445,443,8443) or RemoteUrl has_any ('pastebin','transfer.sh','mega.nz','t.me')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, ReportId)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 10), Processes=make_set(FileName, 10), RemoteIPs=make_set(RemoteIP, 10) by DeviceName, AccountName=coalesce(AccountName, InitiatingProcessFileName)
| where Events >= 5 or Processes has_any ('vssadmin.exe','psexec.exe','rclone.exe')
| order by LastSeen desc;
# Rapid triage for suspected WALLSTREET pre-detonation activity. Run elevated on critical servers and DCs.
$days = 7
$since = (Get-Date).AddDays(-$days)
Write-Output '=== Exposed RDP / SMB listeners ==='
Get-NetTCPConnection -State Listen | Where-Object {$_.LocalPort -in 3389,445,5985,5986} | Select-Object LocalAddress,LocalPort,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
Write-Output '=== Scheduled tasks created or changed recently ==='
Get-ScheduledTask | Where-Object {$_.Date -ge $since} | Select-Object TaskName,TaskPath,State,Date
Write-Output '=== Shadow copies and sabotage markers ==='
vssadmin list shadows
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$since} -ErrorAction SilentlyContinue | Where-Object {$_.Message -match 'vssadmin|bcdedit|wbadmin|delete shadows|recoveryenabled'} | Select-Object TimeCreated,Message | Format-List
Write-Output '=== New local admins and RDP logons ==='
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$since} -ErrorAction SilentlyContinue | Where-Object {$_.Message -match 'Logon Type:\s*(3|10)'} | Select-Object TimeCreated,Message | Format-List
Write-Output '=== Recently dropped executables in writable paths ==='
Get-ChildItem 'C:/Users/Public','C:/ProgramData',$env:TEMP -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.lnk -ErrorAction SilentlyContinue | Where-Object {$_.CreationTime -ge $since -or $_.LastWriteTime -ge $since} | Select-Object FullName,CreationTime,LastWriteTime,Length
Incident Response Priorities
T-minus detection checklist: unexpected authentication to VPN, Exchange or RMM from new ASN; first-time admin logon outside change windows; new service creation; PsExec service binaries; WMI remote process creation; mass 7z/rar/rclone activity; file enumeration across shares; unusual outbound 443 to rare domains; vssadmin, bcdedit or wbadmin execution; EDR tamper attempts; sudden disablement of backup agents; spikes in Security 4624 type 3/10 and 4672 events; Exchange web shell writes; creation of .lnk files in temp/public paths.
Critical assets this profile typically prioritizes for exfiltration: EHR exports, PHI/PII databases, billing and insurance files, student records, HR and payroll, donor/finance data, email archives, backup catalogs, domain controller ntds.dit, network diagrams, vendor remote-access configurations and cyber-insurance documents. Assume clinical and student data are the leverage material.
Containment ordered by urgency: isolate affected hosts from the network without powering off if memory capture is feasible; disable compromised identities and revoke sessions/tokens; block egress by IP/domain and temporarily restrict server outbound internet; shut down exposed RDP, unused VPN profiles and ScreenConnect-style unattended access; preserve firewall, VPN, EDR, AD and backup logs; protect backups by taking immutable copies offline and disabling backup deletion rights; reset krbtgt twice after DC confidence is restored; notify legal/privacy for HIPAA or FERPA exposure; communicate a single approved status line to clinical/academic operations.
Hardening Recommendations
Immediate 24h: patch or compensating-control Check Point IKEv1 authentication exposure CVE-2026-50751; remove or gateway-wrap ConnectWise ScreenConnect and verify no unauthorized instances for CVE-2024-1708; audit developer endpoints and CI for malicious Nx Console versions tied to CVE-2026-48027; apply Exchange cumulative updates and monitor for deserialization exploitation tied to CVE-2023-21529; deploy mitigations for Windows link-following privilege escalation CVE-2025-60710. Enforce phishing-resistant MFA on VPN, RDP, OWA, M365 and RMM; block inbound RDP from internet; require just-in-time admin; disable PowerShell v2; constrain wmic/PsExec; enable tamper protection; alert on shadow-copy deletion; turn on ASR rules; block Office macros from internet; centralize logs in Sentinel with 90-day hot retention.
Short-term 2 weeks: segment clinical devices, student networks and backup infrastructure from general user VLANs; move backups to immutable, isolated, MFA-protected storage with separate credentials; deploy EDR to servers and domain controllers with identity threat detection; implement application allowlisting on servers; create an access-broker watchlist for your org names and domains; baseline egress and deny direct server internet except approved update paths; use tiered admin and gMSA; run purple-team validation against the Sigma/KQL above; pre-stage ransom decision governance, outside counsel and clinical downtime procedures.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.