DRAGONFORCE Ransomware: 15-Victim Surge — Cross-Sector Blitz & Critical CVE Exploitation

title: Potential DragonForce ScreenConnect Exploitation CVE-2024-1708
id: a1b2c3d4-e5f6-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of ConnectWise ScreenConnect authentication bypass or path traversal vulnerabilities associated with DragonForce activity.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/28
tags:
    - attack.initial_access
    - cve.2024.1708
    - dragonforce
logsource:
    category: web
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'SetupWizard'
            - 'Target='
            - '.aspx'
        cs-method: 'POST'
    filter:
        sc-status: 200
    condition: selection and filter
falsepositives:
    - Legitimate administrative setup (rare in production)
level: critical
---
title: DragonForce Mass Data Staging via Rclone
description: Detects the use of rclone for data exfiltration, a common tool in DRAGONFORCE double extortion playbooks.
id: b2c3d4e5-f6a7-4b5c-9d7e-2f3g4h5i6j7k
status: experimental
author: Security Arsenal Research
date: 2026/05/28
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rclone.exe'
            - '\rc.exe'
    condition: selection
level: high
tags:
    - attack.exfiltration
    - dragonforce
---
title: DragonForce Lateral Movement via PsExec
description: Detects PsExec execution patterns consistent with ransomware spread.
id: c3d4e5f6-a7b8-4c5d-0e8f-3g4h5i6j7k8l
status: experimental
author: Security Arsenal Research
date: 2026/05/28
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
        CommandLine|contains:
            - '-accepteula'
            - '\\'
    condition: selection
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002


**KQL (Microsoft Sentinel)**
kql
// Hunt for DragonForce lateral movement and staging
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
// Look for common ransomware tools and obfuscation
| where ProcessName has_any ("rclone", "powershell", "cmd", "wmi", "psexec", "wbadmin")
// Specific DragonForce indicators: massive file copies or VSS deletion attempts
| where ProcessCommandLine has_any ("delete", "shadow", "copy", "sync", "config", "-enc") 
or ProcessCommandLine contains "C:\\Windows\\Temp"
// Filter for suspicious parent processes (often abused utilities)
| where InitiatingProcessFileName in ("mshta.exe", "excel.exe", "word.exe", "winword.exe", "powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc


**PowerShell Response Script**
powershell
<#
.SYNOPSIS
    DragonForce Incident Response - Pre-Encryption Triage
.DESCRIPTION
    Checks for signs of DragonForce activity: Scheduled tasks, Rclone,
    recent Shadow Copy manipulations, and unusual SMB connections.
#>

Write-Host "[+] Starting DragonForce Triage Check..." -ForegroundColor Cyan

# 1. Check for Rclone (Data Exfil)
Write-Host "\n[!] Checking for Rclone presence..." -ForegroundColor Yellow
$Paths = @("C:\Windows\Temp\", "C:\Users\Public\", $env:USERPROFILE + "\Downloads\")
$FoundRclone = $false
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        $Items = Get-ChildItem -Path $Path -Filter "rclone*.exe" -Recurse -ErrorAction SilentlyContinue
        if ($Items) {
            Write-Host "[ALERT] Rclone found at: $($Items.FullName)" -ForegroundColor Red
            $FoundRclone = $true
        }
    }
}
if (-not $FoundRclone) { Write-Host "[OK] No Rclone executables found in common paths." -ForegroundColor Green }

# 2. Check Scheduled Tasks created in last 24h (Persistence)
Write-Host "\n[!] Checking for recently created Scheduled Tasks..." -ForegroundColor Yellow
$Date = (Get-Date).AddDays(-1)
Get-ScheduledTask | Where-Object {$_.Date -gt $Date} | 
    Select-Object TaskName, Date, Author, Actions | Format-Table -AutoSize

# 3. Check Volume Shadow Copy Status (Pre-Encryption)
Write-Host "\n[!] Checking Volume Shadow Copy Storage Usage..." -ForegroundColor Yellow
$vss = vssadmin list shadowstorage
if ($vss -match "No Shadow Copy Storage") {
    Write-Host "[OK] No Shadow Copy Storage found." -ForegroundColor Green
} else {
    Write-Host "[INFO] Current Shadow Copy Storage Status:" -ForegroundColor Cyan
    Write-Host $vss
}

# 4. Check for recent PsExec/WMI Executions (Lateral Movement)
Write-Host "\n[!] Checking Security Event Log for ID 4688 (PsExec/WMI)..." -ForegroundColor Yellow
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($Events) {
    $Suspicious = $Events | Where-Object {$_.Message -match 'psexec' -or $_.Message -match 'wmic' -or $_.Message -match '-accepteula'}
    if ($Suspicious) {
        Write-Host "[ALERT] Suspicious process execution found:" -ForegroundColor Red
        $Suspicious | Select-Object TimeCreated, Message | Format-List
    } else {
        Write-Host "[OK] No obvious PsExec/WMI execution patterns detected." -ForegroundColor Green
    }
}

Write-Host "\n[+] Triage Complete." -ForegroundColor Cyan