WANNACRY Resurgence: 33-Victim Global Campaign Targets Public Sector & Critical Infrastructure

title: SmarterMail Authentication Bypass and Webshell Upload
id: 9e8b4a2d-1f3c-4d5e-8a9b-2c3d4e5f6a7b
description: Detects exploitation of CVE-2026-23760 (Auth Bypass) and CVE-2025-52691 (File Upload) on SmarterMail servers via suspicious URI patterns and file extensions.
author: Security Arsenal Research
date: 2026/04/28
status: experimental
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
    product: iis
    service:_smartermail: true
detection:
    selection_bypass:
        cs-uri-query|contains: 'MegaControl' # Suspicious path often associated with exploit attempts
    selection_upload:
        cs-uri-stem|contains: '.aspx'
        cs-method: 'POST'
    filter_legit:
        cs-uri-query|contains: 'ViewState' # Reduce FPs on legit ViewState usage
    condition: selection_bypass or (selection_upload and not filter_legit)
falsepositives:
    - Legitimate administrative access to SmarterMail
level: critical
tags:
    - attack.initial_access
    - attack.web_shell
    - cve-2026-23760
    - cve-2025-52691
    - wannacry
---
title: Microsoft Exchange Deserialization RCE (CVE-2023-21529)
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects suspicious deserialization activity or child process spawning from w3wp.exe associated with Exchange exploitation.
author: Security Arsenal Research
date: 2026/04/28
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\inetpub\wwwroot\bin\'
        ParentImage|endswith: 'w3wp.exe'
    selection_suspicious_child:
        Image|endswith:
            - 'powershell.exe'
            - 'cmd.exe'
            - 'powershell_ise.exe'
    filter_legit:
        User|contains: 'IUSR'
        CommandLine|contains: 'appcmd' # Allow legitimate IIS management tools
    condition: selection_parent and selection_suspicious_child and not filter_legit
falsepositives:
    - Exchange maintenance scripts
level: high
tags:
    - attack.initial_access
    - attack.execution
    - cve-2023-21529
    - wannacry
---
title: Suspicious Lateral Movement via PsExec and WMI
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects lateral movement typical of ransomware operators post-exploitation using PsExec or WMI for remote service creation.
author: Security Arsenal Research
date: 2026/04/28
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - 'psexec.exe'
            - 'psexec64.exe'
        CommandLine|contains: 'accepteula'
    selection_wmi:
        Image|endswith: 'wmic.exe'
        CommandLine|contains: 'process call create'
    selection_source:
        SubjectLogonId: '*' # Correlate with network logon
    condition: 1 of selection_*
falsepositives:
    - System administration tasks
level: high
tags:
    - attack.lateral_movement
    - attack.execution
    - wannacry


**KQL (Microsoft Sentinel) — Pre-Encryption Staging Hunt**

This query hunts for mass file encryption precursors (rapid modifications of shadow copies or unusual file access patterns) combined with the CVE exploitation indicators.

kql
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Hunt for Exchange Exploitation (CVE-2023-21529)
| where (FileName == "w3wp.exe" and ProcessCommandLine has "powershell") 
// Hunt for PsExec lateral movement (WANNACRY Gang TTP)
or (FileName has "psexec" and InitiatingProcessFileName != "services.exe")
// Hunt for SmarterMail exploitation indicators (Process spawning from MailService)
or (FolderPath contains "SmarterTools" and FileName == "cmd.exe")
| extend HostName = DeviceName, Account = AccountName
| project Timestamp, HostName, Account, FileName, ProcessCommandLine, InitiatingProcessFileName
| summarize count() by HostName, Account, FileName
| where count_ > 5 // Threshold for automated activity


**PowerShell — Rapid Response Hardening Script**

This script checks for the presence of web shells associated with the SmarterMail/Exchange CVEs and identifies suspicious scheduled tasks added in the last 24 hours.

powershell
<#
.SYNOPSIS
    WANNACRY Response Script: Check for Webshells and Scheduled Tasks.
.DESCRIPTION
    Checks IIS logs for SmarterMail exploit patterns (CVE-2026-23760) and enumerates suspicious scheduled tasks created recently.
#>

# 1. Check for recent Scheduled Tasks (Persistence mechanism)
Write-Host "Checking for suspicious scheduled tasks created in the last 24 hours..." -ForegroundColor Cyan
$DateThreshold = (Get-Date).AddDays(-1)
Get-ScheduledTask | Where-Object {$_.Date -gt $DateThreshold} | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize

# 2. Hunt for SmarterMail Web Shell Indicators in IIS Logs (Last 48 hours)
Write-Host "Scanning IIS logs for SmarterMail exploit patterns (CVE-2026-23760)..." -ForegroundColor Cyan
$logPath = "C:\inetpub\logs\LogFiles"
$pattern = "MegaControl|.aspx\?cmd="

if (Test-Path $logPath) {
    Get-ChildItem $logPath -Recurse -Filter "u_ex*.log" | 
    Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-2)} | 
    Select-String -Pattern $pattern -Path $_.FullName | Select-Object -First 10 Path, Line
} else {
    Write-Host "IIS Log path not found." -ForegroundColor Yellow
}

# 3. Check for Exchange Suspicious Processes (w3wp spawning cmd)
Write-Host "Checking for suspicious Exchange process spawning..." -ForegroundColor Cyan
Get-WmiObject Win32_Process | Where-Object {$_.Name -eq "cmd.exe" -and $_.ParentProcessId -ne 0} | 
ForEach-Object {
    $parent = Get-WmiObject Win32_Process | Where-Object {$_.ProcessId -eq $_.ParentProcessId}
    if ($parent.Name -eq "w3wp.exe") {
        Write-Host "ALERT: w3wp.exe spawned cmd.exe! PID: $($_.ProcessId) Parent: $($parent.ProcessId)" -ForegroundColor Red
    }
}


---