# Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)

> SI-CERT reports that since 2019 ransomware attacks have shifted from random mass campaigns to targeted operations against victims seen as able to pay large ransoms. Attackers establish network access, target domain controllers, steal high-value data, destroy backups, then encrypt systems and threaten to publish the data.

- **Published:** 2026-11-04T09:11:47Z
- **Last reviewed:** 2026-11-04T09:11:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5224
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5224.png
- **ID:** TL-2026-5224
- **Severity:** HIGH (CVSS 8.8)
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2020-0688, CVE-2019-0708

## Description

SI-CERT, the Slovenian national CSIRT (handling ransomware reports since April 2012), describes a shift beginning in 2019 from random, high-volume ransomware campaigns to targeted operations against organizations the attackers judge able to pay substantial ransoms; demands can exceed EUR 100,000 and are set by the assessed value of the data and the business criticality of the victim. The article is general threat guidance, not a report on a single named actor or a new exploitation event. It names no actor, no ransomware family, and no IOCs.

The source describes a five-stage progression: (1) target selection; (2) initial access and installation of a Remote Administration Toolkit (RAT) after email compromise or RDP exploitation; (3) network reconnaissance, in which attackers monitor the network structure and use intrusion tools to obtain authentication data and access to further systems; (4) data assessment and theft, targeting domain controllers, locating backups, and exfiltrating sensitive and personal data; (5) deployment of the ransomware on as many systems as possible, destruction of backups, and extortion with a threat to publish the stolen data. Attacks are noted to be preferentially conducted on weekends to avoid detection.

Named initial-access vectors: insufficiently protected Remote Desktop Protocol (weak or recycled passwords, delayed patching) including the BlueKeep Windows RDP vulnerability (the article gives no CVE; BlueKeep is CVE-2019-0708, a pre-authentication RCE in Windows RDP on XP, Vista, 7, Server 2003/2008/2008 R2, listed in CISA KEV with known ransomware use) and CVE-2020-0688 in Microsoft Exchange Server; malicious email attachments or links delivering information stealers or RATs (the article illustrates the Pony Trojan in a fake DHL message); drive-by downloads from compromised sites; watering-hole attacks; infected USB devices; poorly protected WiFi; and physical network access.

CVE-2020-0688 (CVSS 3.1 8.8, CWE-287) is an Exchange Control Panel flaw: every installation shared the same static validationKey/decryptionKey in web.config, so an authenticated attacker can submit a crafted ViewState that the server deserializes, giving code execution as SYSTEM. It affects Exchange 2010 SP3, 2013, 2016 and 2019, was patched in February 2020, has public PoCs (ZDI-20-258, Exploit-DB 48168), and was added to the CISA KEV catalog on 2021-11-03.

SI-CERT recommends: anti-virus and firewalls; server-side mail filtering and VPN; IDS/IPS, NIDS/HIDS and SIEM; network segmentation with restricted data exchange; off-network backups on a separate device, with integrity scanning and recovery drills; a Disaster Recovery Plan; user education; and policies restricting personal devices and external USB media. Status is MONITORING and severity is an analyst judgment, since the source provides no CVSS score for the campaign itself.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1091 Replication Through Removable Media
- T1204.002 User Execution: Malicious File
- T1021.001 Remote Services: Remote Desktop Protocol
- T1056.001 Input Capture: Keylogging
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1018 Remote System Discovery
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5224 Exchange ECP Worker Process Spawning Shell (CVE-2020-0688 ViewState RCE)** (`TL-2026-5224-SPL-001`)

Detects the Exchange Control Panel IIS worker (w3wp.exe, MSExchangeECPAppPool) spawning a command interpreter or LOLBin. CVE-2020-0688 (static validationKey/decryptionKey, crafted __VIEWSTATE) yields code execution as SYSTEM on Exchange 2010 SP3/2013/2016/2019 and is a named initial-access vector in the SI-CERT targeted-ransomware advisory. The ECP app pool should essentially never launch interactive shells. The child shell (cmd.exe T1059.003, PowerShell T1059.001) is the execution stage of the exploit chain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.001, T1059.003
- **Data sources:** sysmon, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" ParentCommandLine="*MSExchangeECPAppPool*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe")
| eval threat="TL-2026-5224 CVE-2020-0688 Exchange ECP ViewState RCE"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host ParentImage Image threat
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe" and InitiatingProcessCommandLine has "MSExchangeECPAppPool"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","whoami.exe","net.exe","net1.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Exchange ECP Worker Process Spawning Shell - CVE-2020-0688
id: 7c1e5d2a-3b94-4f6e-8a1d-5e2f9b0c4a11
status: experimental
description: Detects w3wp.exe running the MSExchangeECPAppPool spawning a shell or LOLBin, indicating exploitation of CVE-2020-0688 (Exchange ECP static-key ViewState deserialization).
references:
  - https://www.cert.si/en/advanced-ransomware-attacks/
  - https://nvd.nist.gov/vuln/detail/CVE-2020-0688
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - cve.2020.0688
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: 'MSExchangeECPAppPool'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Exchange management scripts or third-party monitoring agents invoked through ECP (rare)
level: high

```

**Known false positives:**

- Legitimate Exchange admin tooling or health-check scripts launched via the ECP app pool
- Vendor backup or AV agents that shell out from w3wp.exe on Exchange servers

**Tuning notes:** Scope to Exchange servers only. Allow-list known admin script command lines after a 14-day baseline. Pair with the IIS __VIEWSTATE request detection (TL-2026-5224-SIG-001). Verify the February 2020 Exchange security update is applied.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5224 Mail Client or Office App Launching Payload (DHL-Themed Pony/RAT Lure) (locked: unlock with TL Creds)
- TL-2026-5224 Credential Dumping, Password Store Enumeration and Keylogging Tooling (locked: unlock with TL Creds)
- TL-2026-5224 Unapproved Remote Administration Toolkit Execution and Beaconing (locked: unlock with TL Creds)
- TL-2026-5224 Exchange ECP __VIEWSTATE Exploitation Request (CVE-2020-0688) (locked: unlock with TL Creds)
- TL-2026-5224 Domain Controller and Remote System Discovery Burst (locked: unlock with TL Creds)
- TL-2026-5224 Bulk Data Staging and Exfiltration Tooling (rclone, Password-Protected Archives, MEGA) (locked: unlock with TL Creds)
- TL-2026-5224 Backup and Recovery Destruction Before Ransomware Encryption (locked: unlock with TL Creds)
- TL-2026-5224 External or Off-Hours RDP Logon (BlueKeep / Weak-Password RDP Intrusion) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Advanced Ransomware Attacks - SI-CERT](https://www.cert.si/en/advanced-ransomware-attacks/)
- [NVD - CVE-2020-0688](https://nvd.nist.gov/vuln/detail/CVE-2020-0688)
- [ZDI: CVE-2020-0688 Remote Code Execution on Microsoft Exchange Server Through Fixed Cryptographic Keys](https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys)
- [Duo Decipher: Into the Great Wide Open with CVE-2020-0688](https://duo.com/decipher/into-the-great-wide-open-with-cve-2020-0688)
- [Exploit-DB 48168 - CVE-2020-0688 PoC](https://exploit-db.com/exploits/48168)
- [MrTiz/CVE-2020-0688 PoC repository](https://github.com/MrTiz/CVE-2020-0688)
- [CISA Alert AA19-168A: Microsoft Operating Systems BlueKeep Vulnerability](https://us-cert.cisa.gov/ncas/alerts/AA19-168A)
- [Security Affairs: DHS also issued an alert for the Windows BlueKeep flaw](https://securityaffairs.com/87253/security/dhs-cisa-bluekeep-alert.html)
- [MITRE ATT&CK S0453 - Pony](https://attack.mitre.org/software/S0453)
- [Picus Security: What Is Pony Malware? Analysis of the Fareit Credential Stealer](https://www.picussecurity.com/resource/blog/what-is-pony-malware-analysis-of-the-fareit-credential-stealer)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5224