WANNACRY Resurgence: Critical Infrastructure Assault & 2026 Exploit Campaign Analysis

title: Potential SmarterMail Authentication Bypass or Exploit Attempt
description: Detects potential exploitation of SmarterMail CVE-2025-52691 or CVE-2026-23760 involving suspicious URI patterns or file uploads.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/04/30
status: stable
logsource:
    category: webserver
    product: iis, apache, nginx
detection:
    selection:
        cs-uri-query|contains:
            - '/Services/MailDir.asmx/'
            - '/Utility/HTMLSanitizer/'
            - 'Runtime.aspx'
        cs-uri-query|contains:
            - '..%2f'
            - '..\\'
            - 'file='
    condition: selection
falsepositives:
    - Legitimate administrative access to SmarterMail
level: high
tags:
    - attack.initial_access
    - attack.web_shell
    - cve.2025.52691
    - cve.2026.23760
    - wannacry
---
title: Microsoft Exchange Deserialization Exploitation Indicator
description: Detects suspicious deserialization patterns or anomalous EWS activity associated with CVE-2023-21529.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/04/30
status: stable
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140 or 5145
    filter:
        ShareName|contains: 'Exchange'
        RelativeTargetName|contains: 
            - '.__'
            - '.config'
            - '.dll'
    condition: selection and filter
falsepositives:
    - Legitimate admin file copies
level: medium
tags:
    - attack.initial_access
    - attack.t1059
    - cve.2023.21529
    - wannacry
---
title: Suspicious Process Spawn via Web Server or Management Console
description: Detects execution of shells or network tools via web server processes (IIS/Tomcat) or Cisco FMC management processes, common post-exploitation for web shells.
references:
    - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal Research
date: 2026/04/30
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\java.exe' # Tomcat/FMC often runs on Java
            - '\sfmgr.exe' # Cisco FMC related
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\bash.exe' # WSL
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate administrative debugging
level: high
tags:
    - attack.execution
    - attack.persistence
    - wannacry

// Hunt for SmarterMail and Exchange Exploitation Indicators
// Focuses on web logs and process creation
let TimeFrame = 1d;
let SuspiciousPaths = dynamic(["Services/MailDir.asmx", "Runtime.aspx", "..%2f", "owa/auth.owa"]);
// Web Logs Hunt
W3CIISLog
| where TimeGenerated > ago(TimeFrame)
| where csUriQuery has_any(SuspiciousPaths) 
   or csUriStem has_any(SuspiciousPaths)
| extend Score = iff(csUriQuery contains ".." or csUriQuery contains "file=", 10, 5)
| project TimeGenerated, sSiteName, cIP, csUriStem, csUriQuery, scStatus, Score
| order by Score desc
| join kind=innerunique (
    SecurityEvent 
    | where TimeGenerated > ago(TimeFrame) 
    | where EventID in (4624, 4625) 
    | project Account, TargetLogonId, TimeGenerated, Computer
) on $left.cIP == $right.IpAddress
| distinct TimeGenerated, cIP, csUriStem, Account, Computer

<#
.SYNOPSIS
    WANNACRY Response Script - Checks for IOCs and hardens IIS/SmarterMail.
.DESCRIPTION
    Checks for recent suspicious file modifications in web roots 
    and checks for the presence of vulnerable SmarterMail versions.
#>

Write-Host "[!] Initiating WANNACRY IOC Sweep and Hardening..." -ForegroundColor Cyan

# 1. Check for recently created ASPX/ASP files in common web roots (last 24h)
$webRoots = @("C:\inetpub\wwwroot", "C:\Program Files\SmarterTools\SmarterMail", "C:\Program Files (x86)\SmarterTools")
$cutOff = (Get-Date).AddHours(-24)

Write-Host "[*] Scanning for recently modified web scripts..." -ForegroundColor Yellow
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asmx,*.ashx,*.config -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $cutOff } | 
        Select-Object FullName, LastWriteTime, Length | 
        Format-Table -AutoSize
    }
}

# 2. Check SmarterMail Version (Basic String Check)
$smPath = "C:\Program Files\SmarterTools\SmarterMail\"
if (Test-Path $smPath) {
    Write-Host "[!] SmarterMail Detected. Checking version info..." -ForegroundColor Red
    # Note: Specific version check logic depends on specific build numbers for CVE-2025-52691
    Get-ItemProperty "$smPath\*.exe" | Select-Object Name, VersionInfo | Format-List
} else {
    Write-Host "[-] SmarterMail default path not found." -ForegroundColor Gray
}

# 3. Check for suspicious Scheduled Tasks (Common persistence)
Write-Host "[*] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author

Write-Host "[+] Scan Complete. If IOCs found, isolate the host immediately." -ForegroundColor Green