WORLDLEAKS Ransomware: Global Business Services Surge — CISA KEV Exploitation & Detection Engineering

Threat Actor Profile — WORLDLEAKS

Alias & Operations: WORLDLEAKS operates as a aggressive Ransomware-as-a-Service (RaaS) entity. While relatively newer to the ecosystem compared to legacy cartels, their rapid posting cadence suggests a highly efficient affiliate model.

Operational Model: They employ a standard double-extortion playbook, encrypting victim environments while exfiltrating sensitive corporate data to pressure non-payers. Ransom demands vary significantly based on victim revenue but typically range from $500,000 to $5 million USD.

Initial Access Vectors: Intelligence indicates a heavy reliance on external remote services (VPN/Firewall appliances) and IT management software. The group exploits vulnerabilities in perimeter security (Check Point, Cisco) and remote access tools (ConnectWise ScreenConnect) to gain a foothold without relying solely on phishing.

Dwell Time: WORLDLEAKS affiliates demonstrate a short dwell time, often moving laterally and detonating payloads within 3 to 5 days of initial access, minimizing the window for defenders to detect reconnaissance activity.

Current Campaign Analysis

Targeted Sectors: The latest data confirms a distinct pivot towards Business Services (75% of recent victims) and Consumer Services. This targeting is likely opportunistic, as these sectors often rely heavily on remote management tools (like ScreenConnect) that are currently vulnerable to known exploits.

Geographic Concentration: The campaign is globally dispersed with recent victims in Pakistan (PK), Brazil (BR), United States (US), and Italy (IT). This suggests a distributed affiliate network rather than a region-specific operation.

Victim Profile: Victims such as "Service IT" and "Treet Group" indicate a focus on mid-market organizations—companies large enough to pay significant ransoms but often lacking the dedicated 24/7 security monitoring capabilities of large enterprises.

Posting Frequency: WORLDLEAKS posted 4 victims within a 48-hour window (July 1–2, 2026). This clustering suggests a coordinated wave of exploits leveraging recently disclosed CVEs before patches are widely applied.

CVE Correlation: The recent victimology correlates strongly with the active exploitation of the following CISA KEVs:

• CVE-2024-1708 (ConnectWise ScreenConnect): Highly likely used for initial access in the "Business Services" sector victims where MSP tools are prevalent.
• CVE-2026-50751 (Check Point Security Gateway): A probable vector for perimeter breach, allowing attackers to bypass VPN authentication.
• CVE-2026-20131 (Cisco Secure Firewall): Used to undermine firewall integrity and gain network center management access.

Detection Engineering

The following detection logic is designed to identify the specific TTPs associated with WORLDLEAKS' current campaign, focusing on the exploitation of remote access services and lateral movement.

SIGMA Rules

---
title: Potential ConnectWise ScreenConnect Authentication Bypass (CVE-2024-1708)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability leading to authentication bypass.
status: experimental
author: Security Arsenal Research
date: 2026/07/04
tags:
  - attack.initial_access
  - cve.2024.1708
  - worldleaks
logsource:
  category: web
definition: 'Require fields: cs_uri_stem, cs_uri_query, c_ip, sc_status'
detection:
  selection:
    cs_uri_stem|contains: '/App_Extensions/'
    cs_uri_query|contains: 'Authorization='
  filter:
    sc_status:
      - 200
      - 500
  condition: selection and filter
falsepositives:
  - Legitimate administrative debugging
level: high
---
title: Suspicious IKEv1 Handshake Anomalies (Check Point CVE-2026-50751)
id: b2c3d4e5-6789-01ab-cdef-234567890abc
description: Identifies suspicious IKEv1 key exchange patterns indicative of the improper authentication vulnerability in Check Point Security Gateways.
status: experimental
author: Security Arsenal Research
date: 2026/07/04
tags:
  - attack.initial_access
  - cve.2026.50751
  - worldleaks
logsource:
  product: firewall
definition: 'Require fields: action, protocol, vpn_feature'
detection:
  selection:
    action: 'accept'
    protocol: 'ike'
    vpn_feature: 'ikev1'
  condition: selection | count() by src_ip > 50
  timeframe: 1m
falsepositives:
  - High volume legitimate VPN re-keying
level: critical
---
title: WORLDLEAKS Lateral Movement via PsExec
id: c3d4e5f6-7890-12ab-cdef-345678901bcd
description: Detects the use of PsExec for lateral movement, a common technique observed in WORLDLEAKS hands-on-keyboard activity following initial access.
status: experimental
author: Security Arsenal Research
date: 2026/07/04
tags:
  - attack.lateral_movement
  - worldleaks
  - attack.execution
logsource:
  category: process_creation
definition: 'Require fields: OriginalFileName, CommandLine, ParentImage'
detection:
  selection:
    OriginalFileName|contains: 'psexec.exe'
    CommandLine|contains:
      - '-accepteula'
      - '\\'
  condition: selection
falsepositives:
  - Administrative IT tasks
level: medium

KQL (Microsoft Sentinel)

This query hunts for rapid lateral movement patterns and mass file modifications indicative of ransomware staging.

let TimeFrame = 1h;
let ProcessSet = dynamic(["psexec.exe", "wmic.exe", "powershell.exe"]);
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ (ProcessSet)
| where ProcessCommandLine has "\\" or ProcessCommandLine has "Invoke-"
| summarize count() by DeviceName, AccountName, bin(Timestamp, 5m)
| where count_ > 10
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where ActionType == "FileModified"
    | summarize ModifiedFilesCount = count() by DeviceName, bin(Timestamp, 5m)
) on DeviceName
| where ModifiedFilesCount > 100
| project DeviceName, AccountName, Timestamp, ModifiedFilesCount

PowerShell Hardening Script

This script performs a rapid triage to identify evidence of WORLDLEAKS staging activities, specifically checking for RDP anomalies and recent Shadow Copy manipulations.

<#
.SYNOPSIS
    WORLDLEAKS Triage - RDP & VSS Check
.DESCRIPTION
    Checks for active non-local RDP sessions and recent Volume Shadow Copy deletions/modifications.
#>

Write-Host "[+] Checking for suspicious RDP sessions..."
$query = "query user"
$users = query user
if ($users) {
    foreach ($line in $users) {
        if ($line -match "rdp-tcp" -and $line -notmatch "console") {
            Write-Host "[!] Suspicious RDP Session Found: $line" -ForegroundColor Red
        }
    }
} else {
    Write-Host "[-] No RDP sessions detected."
}

Write-Host "[+] Checking for recent Volume Shadow Copy activity..."
$vss = vssadmin list shadows
if ($vss -match "No shadow copies") {
    Write-Host "[-] No Shadow Copies exist (potential deletion)." -ForegroundColor Yellow
} else {
    Write-Host "[+] Shadow Copies present."
    $events = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='VSS'; ID=12345} -MaxEvents 5 -ErrorAction SilentlyContinue
    if ($events) {
        Write-Host "[!] Recent VSS Deletion events found:" -ForegroundColor Red
        $events | Format-List TimeCreated, Message
    }
}

Write-Host "[+] Checking for ScreenConnect services..."
$scService = Get-Service -Name "ScreenConnect*" -ErrorAction SilentlyContinue
if ($scService) {
    Write-Host "[!] ScreenConnect Service Detected. Ensure patch for CVE-2024-1708 is applied." -ForegroundColor Yellow
    $scService | Select-Object Name, Status, StartType
}

Incident Response Priorities

Based on the WORLDLEAKS playbook observed in this campaign, IR teams should prioritize the following:

1. T-minus Detection Checklist:

   • Inspect VPN logs (specifically Check Point) for successful authentications from impossible travel locations or anomalies in IKEv1 handshakes.
   • Audit ConnectWise ScreenConnect logs for path traversal attempts (/App_Extensions/.
   • Look for unusual PsExec or WMI execution chains originating from servers hosting IT management tools.

2. Critical Asset Prioritization:

   • WORLDLEAKS aggressively targets Active Directory database files (ntds.dit) for credential dumping.
   • HR and Finance directories are prioritized for exfiltration to maximize extortion leverage.

3. Containment Actions:

   • Immediate: Disconnect all VPN concentrators and ScreenConnect servers from the network if compromise is suspected.
   • Secondary: Isolate the Business Services VLANs where the lateral movement is currently propagating.
   • Tertiary: Suspend all domain admin accounts and force a password reset for privileged accounts from a clean known-good source.

Hardening Recommendations

Immediate (24h):

• Patch Critical Perimeter: Apply the patch for CVE-2026-50751 on all Check Point Security Gateways immediately.
• Update Management Tools: Ensure ConnectWise ScreenConnect instances are updated to the latest secure build to mitigate CVE-2024-1708.
• Disable Unused VPNs: Temporarily disable IKEv1 in favor of IKEv2 if not immediately required for legacy operations.

Short-term (2 weeks):

• Network Segmentation: Isolate IT management tools (RMM, ScreenConnect) into a dedicated administrative VLAN with strict egress filtering.
• MFA Enforcement: Implement phishing-resistant MFA (FIDO2) on all VPN and remote access entry points.
• Audit Shadow Copies: Implement monitoring alerts for any deletion or modification events on Volume Shadow Copies (VSS).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub