Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)

Key facts for SI-CERT targeted ransomware

Detection coverage for SI-CERT targeted ransomware

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5224 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5224 Exchange ECP Worker Process Spawning Shell (CVE-2020-0688 ViewState RCE)

Detects the Exchange Control Panel IIS worker (w3wp.exe, MSExchangeECPAppPool) spawning a command interpreter or LOLBin. CVE-2020-0688 (static validationKey/decryptionKey, crafted __VIEWSTATE) yields code execution as SYSTEM on Exchange 2010 SP3/2013/2016/2019 and is a named initial-access vector in the SI-CERT targeted-ransomware advisory. The ECP app pool should essentially never launch interactive shells. The child shell (cmd.exe T1059.003, PowerShell T1059.001) is the execution stage of the exploit chain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.001, T1059.003
• Data sources: sysmon, windows_security
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" ParentCommandLine="*MSExchangeECPAppPool*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe")
| eval threat="TL-2026-5224 CVE-2020-0688 Exchange ECP ViewState RCE"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host ParentImage Image threat
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe" and InitiatingProcessCommandLine has "MSExchangeECPAppPool"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","whoami.exe","net.exe","net1.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: Exchange ECP Worker Process Spawning Shell - CVE-2020-0688
id: 7c1e5d2a-3b94-4f6e-8a1d-5e2f9b0c4a11
status: experimental
description: Detects w3wp.exe running the MSExchangeECPAppPool spawning a shell or LOLBin, indicating exploitation of CVE-2020-0688 (Exchange ECP static-key ViewState deserialization).
references:
  - https://www.cert.si/en/advanced-ransomware-attacks/
  - https://nvd.nist.gov/vuln/detail/CVE-2020-0688
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - cve.2020.0688
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: 'MSExchangeECPAppPool'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Exchange management scripts or third-party monitoring agents invoked through ECP (rare)
level: high

Known false positives:

• Legitimate Exchange admin tooling or health-check scripts launched via the ECP app pool
• Vendor backup or AV agents that shell out from w3wp.exe on Exchange servers

Tuning notes: Scope to Exchange servers only. Allow-list known admin script command lines after a 14-day baseline. Pair with the IIS __VIEWSTATE request detection (TL-2026-5224-SIG-001). Verify the February 2020 Exchange security update is applied.

• 🔒 TL-2026-5224 Mail Client or Office App Launching Payload (DHL-Themed Pony/RAT Lure) · unlock with TL Creds
• 🔒 TL-2026-5224 Credential Dumping, Password Store Enumeration and Keylogging Tooling · unlock with TL Creds
• 🔒 TL-2026-5224 Unapproved Remote Administration Toolkit Execution and Beaconing · unlock with TL Creds
• 🔒 TL-2026-5224 Exchange ECP __VIEWSTATE Exploitation Request (CVE-2020-0688) · unlock with TL Creds
• 🔒 TL-2026-5224 Domain Controller and Remote System Discovery Burst · unlock with TL Creds
• 🔒 TL-2026-5224 Bulk Data Staging and Exfiltration Tooling (rclone, Password-Protected Archives, MEGA) · unlock with TL Creds
• 🔒 TL-2026-5224 Backup and Recovery Destruction Before Ransomware Encryption · unlock with TL Creds
• 🔒 TL-2026-5224 External or Off-Hours RDP Logon (BlueKeep / Weak-Password RDP Intrusion) · unlock with TL Creds

Indicators of compromise for SI-CERT targeted ransomware

As of 2026-11-04, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5224.

How SI-CERT targeted ransomware works

SI-CERT, the Slovenian national CSIRT (handling ransomware reports since April 2012), describes a shift beginning in 2019 from random, high-volume ransomware campaigns to targeted operations against organizations the attackers judge able to pay substantial ransoms; demands can exceed EUR 100,000 and are set by the assessed value of the data and the business criticality of the victim. The article is general threat guidance, not a report on a single named actor or a new exploitation event. It names no actor, no ransomware family, and no IOCs.

The source describes a five-stage progression: (1) target selection; (2) initial access and installation of a Remote Administration Toolkit (RAT) after email compromise or RDP exploitation; (3) network reconnaissance, in which attackers monitor the network structure and use intrusion tools to obtain authentication data and access to further systems; (4) data assessment and theft, targeting domain controllers, locating backups, and exfiltrating sensitive and personal data; (5) deployment of the ransomware on as many systems as possible, destruction of backups, and extortion with a threat to publish the stolen data. Attacks are noted to be preferentially conducted on weekends to avoid detection.

Named initial-access vectors: insufficiently protected Remote Desktop Protocol (weak or recycled passwords, delayed patching) including the BlueKeep Windows RDP vulnerability (the article gives no CVE; BlueKeep is CVE-2019-0708, a pre-authentication RCE in Windows RDP on XP, Vista, 7, Server 2003/2008/2008 R2, listed in CISA KEV with known ransomware use) and CVE-2020-0688 in Microsoft Exchange Server; malicious email attachments or links delivering information stealers or RATs (the article illustrates the Pony Trojan in a fake DHL message); drive-by downloads from compromised sites; watering-hole attacks; infected USB devices; poorly protected WiFi; and physical network access.

CVE-2020-0688 (CVSS 3.1 8.8, CWE-287) is an Exchange Control Panel flaw: every installation shared the same static validationKey/decryptionKey in web.config, so an authenticated attacker can submit a crafted ViewState that the server deserializes, giving code execution as SYSTEM. It affects Exchange 2010 SP3, 2013, 2016 and 2019, was patched in February 2020, has public PoCs (ZDI-20-258, Exploit-DB 48168), and was added to the CISA KEV catalog on 2021-11-03.

SI-CERT recommends: anti-virus and firewalls; server-side mail filtering and VPN; IDS/IPS, NIDS/HIDS and SIEM; network segmentation with restricted data exchange; off-network backups on a separate device, with integrity scanning and recovery drills; a Disaster Recovery Plan; user education; and policies restricting personal devices and external USB media. Status is MONITORING and severity is an analyst judgment, since the source provides no CVSS score for the campaign itself.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1056.001 Input Capture: Keylogging; T1555 Credentials from Password Stores

Collection

T1005 Data from Local System

Discovery

T1018 Remote System Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Initial Access

T1091 Replication Through Removable Media; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

Execution

T1204.002 User Execution: Malicious File

Command and Control

T1219 Remote Access Tools

Impact

T1490 Inhibit System Recovery

Remediation for SI-CERT targeted ransomware

Patches

• Microsoft Exchange security update, February 2020 (CVE-2020-0688)
• Microsoft Windows RDP security update for CVE-2019-0708 (BlueKeep)

Immediate actions

• Apply the February 2020 Microsoft security update for CVE-2020-0688 on all Exchange servers
• Apply the Microsoft update for CVE-2019-0708 (BlueKeep) and do not expose RDP (TCP/3389) to the internet
• Replace weak or recycled passwords on RDP-reachable and Exchange accounts
• Verify that backups are stored off-network on a separate device and that their integrity is scanned

Workarounds

• Place RDP behind a VPN
• Use server-side mail filtering and anti-virus on mail flow
• Monitor and alert on weekend administrative and RDP activity

Longer-term hardening

• Segment the network and restrict data exchange between segments
• Deploy IDS/IPS, NIDS/HIDS and a SIEM to detect intrusion tooling and credential theft
• Run regular data recovery drills and maintain a Disaster Recovery Plan
• Train users on malicious attachments and links
• Restrict personal devices and external USB media by policy

Affected and fixed versions

• Microsoft — Exchange Server
  Vulnerable versions: 2010 SP3 Update Rollup 30; 2013 CU23; 2016 CU14 and CU15; 2019 CU3 and CU4
  Fixed in: Versions with the February 2020 security update applied
• Microsoft — Windows Remote Desktop Services (BlueKeep, CVE-2019-0708)
  Vulnerable versions: Windows XP; Windows Vista; Windows 7; Windows Server 2003; Windows Server 2008; Windows Server 2008 R2
  Fixed in: Versions with the Microsoft CVE-2019-0708 update applied

Timeline of SI-CERT targeted ransomware

• 2011-01-01 locked-ioc-7 (locked-ioc-6) credential stealer and downloader first observed in the wild (year-level date per public analysis; cited by locked-ioc-5 as an example email-borne stealer).
• 2012-04-01 locked-ioc-5 began handling ransomware incident reports (April 2012; day approximate).
• 2019-01-01 locked-ioc-5 observes ransomware operations shifting from random mass campaigns to targeted attacks on victims able to pay (year-level date, 'since 2019').
• 2019-06-17 CISA issues alert AA19-168A on the BlueKeep (CVE-2019-0708) Windows RDP vulnerability.
• 2019-11-01 Active in-the-wild exploitation of BlueKeep confirmed by November 2019 (day approximate).
• 2020-02-11 CVE-2020-0688 (Exchange static ECP keys, CVSS 8.8) published and patched by Microsoft.
• 2020-02-24 Zero Day Initiative publishes technical write-up of CVE-2020-0688; public PoCs follow.
• 2021-01-19 locked-ioc-5 publishes 'Advanced Ransomware Attacks' describing targeted ransomware stages, vectors and mitigations.
• 2021-11-03 CVE-2020-0688 added to the CISA KEV catalog (action due 2022-05-03).

Sources cited for SI-CERT targeted ransomware

• Advanced Ransomware Attacks - SI-CERT cert.si · Advisory · 2021-01-19
• NVD - CVE-2020-0688 NVD (NIST) · Advisory · 2020-02-11
• CISA Alert AA19-168A: Microsoft Operating Systems BlueKeep Vulnerability CISA · Government advisory · 2019-06-17
• ZDI: CVE-2020-0688 Remote Code Execution on Microsoft Exchange Server Through Fixed Cryptographic Keys zerodayinitiative.com · Research · 2020-02-24
• MITRE ATT&CK S0453 - Pony MITRE · Research
• Exploit-DB 48168 - CVE-2020-0688 PoC exploit-db.com · Proof of concept
• MrTiz/CVE-2020-0688 PoC repository GitHub · Code repository
• Duo Decipher: Into the Great Wide Open with CVE-2020-0688 duo.com · Blog
• Picus Security: What Is Pony Malware? Analysis of the Fareit Credential Stealer picussecurity.com · Blog
• Security Affairs: DHS also issued an alert for the Windows BlueKeep flaw securityaffairs.com · News · 2019-06-17

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Other reports on CVE-2020-0688

• September 2026 APT Group Threat Report (AhnLab ASEC): DPRK, China, Russia, Iran/Pakistan-linked activity incl. supply-chain and legitimate-service C2 abuse
• September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation
• NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
• MuddyWater Operation Olalampo — Iran MOIS-Nexus APT Deploys New Malware Variants with Telegram Bot C2 Targeting Middle Eastern Governments and Critical Infrastructure
• Static Tundra ICS Attacks on Polish Energy Infrastructure with DynoWiper
• Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy Infrastructure

Other reports on CVE-2019-0708

• BlueKeep (CVE-2019-0708) RDP exploitation observed in the wild delivering cryptocurrency miner
• LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
• BlueKeep (CVE-2019-0708) Windows RDP Use-After-Free Exploited In the Wild to Deploy Monero Cryptominer

Previous and next in ransomware

• Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak Previous report
• Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims Next report