Loading story…
ShroudCloud released a set of Windows Sigma detections focused on ransomware operators’ use of native lateral-movement primitives: WMI, Task Scheduler, Service Control Manager, WinRM, SMB, and RDP. Its highest-priority experimental correlation identifies a target receiving activity from two or more remote-execution methods within 60 seconds—a pattern associated with automated ransomware spread modules, including activity attributed to TheGentlemen. Supporting rules detect anonymous SMB share staging through null-session configuration changes, remote schtasks execution, WMI process creation, WinRM-launched living-off-the-land binaries, and remote scheduled-task creation via WinRM.
The detection set also covers precursor and follow-on behaviors commonly seen in ransomware intrusions: burst endpoint and domain enumeration, clustered suspicious commands across hosts, Windows Defender tampering, LSASS dumping through comsvcs.dll, Volume Shadow Copy manipulation, and scripted WinSCP transfers that may support exfiltration. Organizations should correlate source and target telemetry rather than rely on tool names, prioritize rapid multi-primitive activity as a potential ransomware-in-progress condition, and baseline sanctioned administration, fleet-management tools, backup jobs, and enterprise file-transfer workflows to reduce false positives.
See real exploitation activity before you spend the cycle.
17 events from the most recent confirmed update back to the earliest known activity.
ShroudCloud published the experimental “Per-Target Primitive Co-occurrence (Ransomware Spread - Module Signature)” Sigma correlation rule. It triggers when two or more of WMI, Task Scheduler, SCM, and WinRM indicators occur against the same target host within 60 seconds.
ShroudCloud published the experimental “Anonymous Share Staging (Null-Session Payload Pull)” Sigma rule for a pattern attributed to TheGentlemen activity. It detects anonymous-share permission grants, null-session registry changes, and broadly accessible share creation, and recommends correlation of multiple signals within 120 seconds.
ShroudCloud published the experimental, high-severity “Native schtasks Remote Task Creation with UNC Target” Sigma rule. It detects schtasks.exe /S remote-task creation when paired with SYSTEM execution or a UNC-path task command.
ShroudCloud published “Operator Playbook Part 1,” identifying WMI, Task Scheduler, SCM, WinRM, RDP/SSH, and SMB staging as principal Windows ransomware movement mechanisms. It highlighted TheGentlemen’s reported parallel use of multiple execution primitives and recommended per-target correlation within 60 seconds.
ShroudCloud published the stable “Clustered Endpoint Enumeration” Sigma correlation rule. The rule detects more than one qualifying discovery command on a host within 10 minutes to identify burst-style endpoint and domain reconnaissance.
ShroudCloud published the experimental, critical-severity “Clustered Suspicious Process Creation Across Multiple Hosts” correlation rule. It flags at least three suspicious process events by one user across two or more hosts within 30 minutes.
ShroudCloud published the stable, high-severity “Remote Scheduled Task Creation via WinRM” Sigma rule. It detects suspicious chains in which unverified WinRM host processes spawn schtasks.exe with task-management arguments.
ShroudCloud published the stable, high-severity “Shadow Copy Access via LOLbin Parents” Sigma rule. It detects suspicious LOLBin activity involving shadow-copy deletion or access, credential extraction, and recovery inhibition.
ShroudCloud published the stable, high-severity “WMI Remote Process Execution via Native Binaries” Sigma rule. The rule detects wmic.exe /node process-call-create usage and remote Invoke-WmiMethod or Invoke-CimMethod commands targeting Win32_Process.Create.
ShroudCloud published the stable, high-severity “Remote Execution via WinRM Abuse” Sigma rule. It detects wsmprovhost.exe or winrshost.exe spawning selected reconnaissance, persistence, credential-access, or execution binaries.
ShroudCloud published the stable, high-severity “LSASS Memory Dump via Comsvcs.dll” Sigma rule. It detects rundll32.exe invoking comsvcs.dll to dump LSASS memory, including command lines containing comsvcs.dll and lsass or lsass.dmp.
ShroudCloud published the stable Sigma rule “Windows Defender Tampering via PowerShell,” which detects PowerShell and DISM attempts to disable Defender monitoring, add exclusions, or disable the Defender feature. The rule is mapped to MITRE ATT&CK T1562.001 and rated medium severity.
eSentire TRU reported that Hunters International used WinSCP as a fallback data-exfiltration mechanism when Rclone was its primary tool. The reporting described operators potentially pivoting to WinSCP when network controls block Rclone cloud-sync traffic.
ShroudCloud presented a stable Windows process-creation rule for detecting scripted or automated WinSCP transfers via command-line arguments and transfer commands. The rule is intended to identify potential ransomware-related exfiltration while accounting for legitimate scheduled enterprise file transfers.
ShroudCloud updated its detection-engineering analysis of ransomware lateral movement on Windows. The analysis continued to frame detection around six operating-system primitives rather than specific tools.
ShroudCloud published a detection-engineering analysis that organizes ransomware lateral movement around six Windows primitives: WMI, Task Scheduler, SCM, WinRM, RDP, and SMB. The analysis emphasizes detecting primitive-level artifacts rather than attacker-specific tool wrappers.
Sophos analyzed 413 selected incident-response and managed detection-and-response cases handled in 2024 for its Active Adversary Report. The dataset found compromised credentials, exploited vulnerabilities, and brute force to be leading intrusion causes, while ransomware accounted for 40% of combined cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
15 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourcenews.sophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that **DARKSIDE** operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion. The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities `Regsvcs` and `Regasm` under MITRE ATT&CK **`T1218.009`** to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through **Cobalt Strike** named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs **17** and **18** to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
Aug 15, 2026
Researchers detailed the **CSHARP-STREAMER** remote access trojan as a modular, memory-resident .NET malware used in ransomware intrusions, including cases tied to **Metaencryptor**, **REvil**, **LostTrust**, and **ALPHV/BlackCat**. In observed incidents, attackers launched the RAT through a heavily obfuscated PowerShell stager that performed an **AMSI bypass**, derived an XOR key, retrieved a payload disguised as a PNG, and loaded the .NET assembly directly into memory. The malware then communicated with command-and-control servers over **WebSockets** on multiple ports, with fallback to **ICMP**, using **RC4-encrypted** Protobuf packets. The RAT supports broad post-compromise activity, including command execution, file discovery and exfiltration, keylogging, credential theft, lateral movement, port scanning, process dumping, payload execution, and **Veeam** credential extraction. Investigators found it was often paired with external persistence such as scheduled tasks or services rather than maintaining persistence itself, and in one ransomware case it was used to relay traffic across segmented networks. Detection guidance highlighted forensic artifacts including **Windows Event ID 2004**, a `netsh` firewall rule opening inbound TCP port `6667`, PowerShell Script Block Logging evidence, memory-resident indicators, and the user agent string `websocket-sharp/1.0`, reinforcing assessments that the malware may be customized or provided as a service across multiple ransomware operations.
Aug 15, 2026
Play/PlayCrypt ransomware operators have used a repeatable double-extortion workflow beginning with compromised administrator credentials and RDP access. In two examined intrusions, the actors manually identified valuable data, archived it with WinRAR using the distinctive `-ep1 -scul -r0` options, and exfiltrated it through WinSCP. One operation was disrupted before encryption but continued data theft after defenders disabled an account; another reached encryption on more than 15 systems within roughly six hours, using PsExec to deploy distinct ransomware payloads from `C:\Users\Public\Music\`, disabling Windows protections, and deleting shadow copies. The group, active since 2022 and responsible for roughly 900 known victim entities as of May 2025, also gains entry through exposed applications, including FortiOS, Microsoft Exchange ProxyNotShell, and activity associated with SimpleHelp `CVE-2024-57727`. Its tooling includes Grixba for domain-wide discovery and inventory of security, backup, and remote-management products, plus a custom VSS utility that copies locked files from shadow snapshots before encryption. Defenders should prioritize MFA and rapid remediation of internet-facing vulnerabilities, while monitoring for the WinRAR command-line pattern, WinSCP transfers, Defender exclusions, random service creation, PsExec activity, and executable writes under the Public Music directory; offline immutable backups and network segmentation remain essential to limit impact.
Sep 20, 2026