DRAGONFORCE Ransomware: 2 New Victims Posted to Leak Site — Healthcare & SMB Targeting Analysis with Detection Engineering

Classification: TLP:CLEAR — Enterprise Defensive Intelligence Source: ransomware.live monitoring of DRAGONFORCE .onion leak site Report Date: 2026-09-16

Threat Actor Profile — DRAGONFORCE

DRAGONFORCE is an established Ransomware-as-a-Service (RaaS) operation that has maintained consistent leak site activity since emerging in the mid-2020s. The group operates a structured affiliate program, recruiting penetration-focused affiliates who execute intrusions while the core operators maintain the encryptor, negotiation portal, and data leak site (DLS) infrastructure.

Key profile characteristics:

• Model: RaaS with a broad affiliate base; the operation absorbed displaced affiliates following the 2025 collapse of competing RaaS programs, expanding its geographic and sectoral reach
• Extortion method: Classic double extortion — data theft precedes encryption, with victim names posted to the DLS as pressure leverage before full data dumps
• Ransom demands: Typically scaled to victim revenue; observed demands range from mid-five figures for SMBs to multi-million-dollar demands against mid-market enterprises, with negotiation flexibility of 20–40% off initial asks
• Initial access vectors: Exploitation of internet-facing edge devices (VPN concentrators, firewalls, remote management platforms), phishing with malicious attachments/links, exposed RDP, and abuse of remote monitoring & management (RMM) tooling
• Dwell time: Moderate — observed dwell of 3–10 days from initial access to detonation, with data staging often beginning within 48 hours of domain-level compromise
• Tooling: Living-off-the-land binaries (PsExec, WMI, nltest), Cobalt Strike or similar C2, RClone/MEGA for exfiltration, and VSS deletion via vssadmin/wmic prior to encryption

Current Campaign Analysis

Victim Postings (2026-09-16)

Sector & Geographic Targeting

This posting pair fits DRAGONFORCE's established pattern: small-to-mid-market organizations with high-value PII/PHI but limited security operations maturity. A UK optometry practice holds protected health records, payment data, and patient contact databases — compact, monetizable datasets. A US property management firm holds tenant PII, financial records, lease agreements, and bank details — equally attractive for extortion and resale.

• Geography: GB and US continue to dominate DRAGONFORCE targeting, consistent with English-speaking, high-insurance-penetration markets where victims historically pay
• Victim size: Both organizations are SMB-scale (estimated <200 employees, revenue under $25M), indicating affiliates are scanning for soft targets rather than conducting long campaigns against hardened enterprises
• Posting cadence: 2 postings in a single day is moderate for this DLS; volume spikes typically lag mass edge-device exploitation events by 2–4 weeks

CVE Correlation — Likely Initial Access Vectors

DRAGONFORCE affiliates are prolific edge-device exploiters. The following CISA KEV entries with confirmed ransomware use align directly with this gang's known playbook and should be treated as priority patch targets:

• CVE-2026-59310 — VMware vCenter Path Traversal: Network-accessible path traversal against vCenter. Direct relevance — DRAGONFORCE heavily targets ESXi/vCenter infrastructure and deploys Linux encryptors against hypervisors to maximize blast radius
• CVE-2026-20316 — Cisco Secure FMC Hard-coded Password: Trivial initial access against perimeter management planes
• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1): VPN gateway compromise, a hallmark DRAGONFORCE entry point
• CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal: RCE via RMM tooling; affiliate-favorite for SMB/MSP-adjacent victims matching today's victim profile
• CVE-2026-50751 / CVE-2026-20316 combination: Perimeter device compromise → credential harvesting → internal pivot is the dominant kill chain observed in this group's intrusions

Assessment: The SMB profile of today's victims strongly suggests opportunistic exploitation of unpatched edge/RMM infrastructure rather than targeted spearphishing campaigns.

Detection Engineering

Sigma Rules

---
title: DRAGONFORCE - Shadow Copy Deletion Pre-Encryption
id: 9f2e1a4b-drgn-4c01-9a11-dragonforce01
status: production
description: Detects Volume Shadow Copy deletion via vssadmin, wmic, or PowerShell — a consistent DRAGONFORCE pre-encryption anti-recovery action
author: Security Arsenal Threat Intel
date: 2026/09/16
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration (rare on endpoints)
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: DRAGONFORCE - RDP Brute Force Followed by Successful Logon
id: 1b7c3d2e-drgn-4e02-8b22-dragonforce02
status: production
description: Detects burst of failed RDP logons (Event 4625) followed by a successful logon (4624 Type 10) from the same source — indicative of DRAGONFORCE affiliate RDP brute forcing
author: Security Arsenal Threat Intel
date: 2026/09/16
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_fail:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_fail | count() by IpAddress > 10
  timeframe: 15m
falsepositives:
  - Misconfigured service accounts; correlate with source IP reputation
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1021.001
---
title: DRAGONFORCE - Data Staging via RClone or Archive Utility
id: 4a8f6c1d-drgn-4f03-7c33-dragonforce03
status: production
description: Detects RClone execution or mass archive creation with 7-Zip/WinRAR from server systems — DRAGONFORCE affiliates stage data for exfiltration 24-72h before encryption
author: Security Arsenal Threat Intel
date: 2026/09/16
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  filter_known_paths:
    Image|startswith:
      - 'C:\Program Files\BackupAgent\'
  condition: (selection_rclone or selection_archive) and not filter_known_paths
falsepositives:
  - Legitimate backup workflows; baseline and allowlist known backup tooling paths
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002

KQL — Microsoft Sentinel Hunt Query

Hunts for the DRAGONFORCE lateral movement + staging chain: suspicious remote execution (PsExec/WMI) followed by archive utility execution and large outbound transfers from server assets.

// DRAGONFORCE pre-ransomware staging & lateral movement hunt
// Lookback: 7 days | Focus: servers + hypervisor management systems
let lookback = 7d;
let lolbin_exec = dynamic(["psexec.exe","psexesvc.exe","wmic.exe","wmiprvse.exe","net.exe","nltest.exe","net1.exe"]);
let staging_tools = dynamic(["rclone.exe","7z.exe","rar.exe","megacmd.exe","winscp.exe","filezilla.exe"]);
let LateralMovement =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (lolbin_exec)
    | where ProcessCommandLine has_any ("\\\\", "cmd", "powershell", "/node:", "accepteula")
    | project LM_Time=TimeGenerated, DeviceName, AccountName, LM_Tool=FileName, LM_CmdLine=ProcessCommandLine, InitiatingProcessName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (staging_tools)
    | project ST_Time=TimeGenerated, DeviceName, AccountName, ST_Tool=FileName, ST_CmdLine=ProcessCommandLine;
Staging
| join kind=inner LateralMovement on DeviceName
| where ST_Time > LM_Time and (ST_Time - LM_Time) < 72h
| extend SequenceGapMinutes = datetime_diff("minute", ST_Time, LM_Time)
| project DeviceName, AccountName, LM_Time, LM_Tool, LM_CmdLine, ST_Time, ST_Tool, ST_CmdLine, SequenceGapMinutes
| sort by ST_Time asc;

PowerShell — Rapid Exposure & Staging Check

Run on domain controllers and file servers to catch DRAGONFORCE staging behavior before detonation.

# DRAGONFORCE Rapid Triage - run elevated on DCs / file servers
# Checks: shadow copies, recent scheduled tasks, suspicious staging tools, RDP exposure

Write-Host "=== [1] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$vss = vssadmin list shadows 2>$null
if (-not $vss) { Write-Host "[ALERT] No shadow copies found - possible anti-recovery action" -ForegroundColor Red }
else { $vss | Select-String "creation time" }

Write-Host "`n=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize

Write-Host "`n=== [3] Staging / Exfil Tool Artifacts (rclone, 7z, megacmd) ===" -ForegroundColor Cyan
$paths = @("$env:ProgramData", "$env:TEMP", "C:\Users\Public", "C:\Windows\Temp")
$tools = @("rclone*.exe","7z*.exe","rar.exe","megacmd*.exe","winscp*.exe","*.7z","*.rar","*.zip")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include $tools -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object FullName, Length, LastWriteTime
}

Write-Host "`n=== [4] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) {
  Write-Host "[WARN] RDP ENABLED. Recent Type-10 logons:" -ForegroundColor Yellow
  Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+10' } |
    Select-Object -First 15 TimeCreated, @{N='SrcIP';E={ if ($_.Message -match 'Source Network Address:\s+([\d\.]+)') { $Matches[1] } }}
}

Write-Host "`n=== [5] New Local Admin Accounts (Last 14 Days) ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass

Incident Response Priorities — DRAGONFORCE Playbook

T-Minus Detection Checklist (Before Encryption Fires)

1. vssadmin / wmic shadow deletion — the single highest-fidelity pre-detonation signal; alert and isolate immediately
2. RClone or MEGA sync processes on file servers, especially running as SYSTEM or newly created service accounts
3. New local/domain admin accounts or unexpected group membership changes (DRAGONFORCE affiliates create persistence accounts early)
4. PsExec service artifacts (PSEXESVC, randomly named 8-char services) on servers
5. bcdedit recovery disabling or wbadmin delete catalog execution
6. Mass file access by a single account — one identity touching thousands of files across shares in a short window
7. AV/EDR tampering — service stops, uninstall attempts, or exclusions added for C:\ProgramData or temp paths

Assets This Gang Prioritizes for Exfiltration

• Patient/customer databases (PHI/PII — directly applicable to today's healthcare victim)
• Financial records, payroll, and banking details (directly applicable to the property management victim)
• Legal documents, contracts, and insurance policies (used to gauge victim's ability to pay)
• Email archives from executive mailboxes for negotiation leverage
• Backup catalogs and credentials for backup infrastructure

Containment Actions — Ordered by Urgency

1. Isolate affected subnets/VLANs at the switch level — do not power off hosts (preserve memory artifacts)
2. Disable compromised accounts and force domain-wide credential reset (KRBTGT twice if DC compromise suspected)
3. Block egress to RClone/MEGA/cloud storage endpoints at the proxy/firewall immediately
4. Disable PsExec/SMB admin share writes from workstation-to-server segments via host firewall policy
5. Snapshot forensic evidence (memory, prefetch, USN journal, $MFT) before remediation wipes staging artifacts
6. Assume data theft occurred — engage legal/comms early; DRAGONFORCE posts victims within days of failed negotiation

Hardening Recommendations

Immediate (24 Hours)

• Patch edge devices: Apply fixes for CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), and CVE-2024-1708 (ScreenConnect). These are confirmed ransomware-exploited and map directly to DRAGONFORCE initial access
• Disable or MFA-gate all internet-facing RDP and VPN portals; audit for legacy IKEv1 configurations on Check Point gateways
• Block RClone, MEGAcmd, and unsanctioned cloud storage clients via application control (WDAC/AppLocker) and egress filtering
• Enable and verify VSS protection — alert on any shadow deletion command execution
• Audit scheduled tasks and local admin groups using the triage script above

Short-Term (2 Weeks)

• Segment hypervisor management (vCenter/ESXi) into a restricted management VLAN — DRAGONFORCE's Linux encryptor specifically targets ESXi; management interfaces must never be reachable from general user segments
• Deploy immutable/offline backups with a separate credential plane; test restoration, not just backup success
• Implement identity-tiering — no domain admin logons on member servers or workstations; deploy LAPS and gMSA
• Baseline and alert on data egress volume per server; staging activity generates anomalous outbound transfer patterns 24–72h before encryption
• Tabletop the double-extortion scenario — legal, comms, and executive stakeholders must have pre-approved decision trees for leak-site postings

This briefing is based on live monitoring of DRAGONFORCE's dark web leak site. Victim postings indicate claimed compromises; organizations named should be considered potentially breached. Indicators and rules should be tuned to your environment before production deployment.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub