Threat Summary
The pulse profiles DragonForce, a financially motivated ransomware operation that emerged in August 2023 and matured from a LockBit 3.0-builder affiliate program into a Conti v3-based Ransomware-as-a-Service cartel with white-label infrastructure. The operator set is opportunistic but enterprise-focused: manufacturing, professional services, real estate, transportation, retail, healthcare, technology, media and government entities across the US, UK, Australia, Canada and Italy. The practical chain is: internet edge exploitation or valid remote access, credential theft and lateral movement with Cobalt Strike/SystemBC/Mimikatz, then staged encryption using LockBit Black/Conti-derived payloads. Listed CVEs point to Log4Shell CVE-2021-44228, Ivanti Connect Secure CVE-2023-46805/CVE-2024-21887/CVE-2024-21893, and Windows SmartScreen bypass CVE-2024-21412 as initial-access or execution-bypass pathways. Objective is extortion at scale via affiliate revenue share, with MSP compromise tagged as a force multiplier.
Threat Actor / Malware Profile
DragonForce operates as RaaS with an advertised 80 percent affiliate share and a management panel, later pivoting to a cartel model that lets partners brand payloads and leak sites. Distribution is typically affiliate-driven: exposed edge services, stolen VPN/remote credentials, MSP tooling abuse, malicious links that bypass Mark-of-the-Web controls, and post-exploitation deployment after hands-on intrusion. Payload behavior is consistent with LockBit 3.0/Conti lineage: fast multi-threaded encryption, deletion of shadow copies, boot recovery tampering, service termination for databases/backups, and ransom-note creation across impacted hosts. C2 and staging commonly use Cobalt Strike beacons for interactive access and SystemBC as a SOCKS/proxy implant to tunnel tools and mask egress. Persistence is affiliate-dependent but usually includes run keys, services, scheduled tasks, webshells on compromised VPN appliances, or newly created local/domain accounts. Anti-analysis includes packed builders, environment checks, deletion of logs and backups, renaming to blend with legitimate binaries, and Living-off-the-Land execution through rundll32, regsvr32, WMI, PsExec-style service creation and signed LOLBins.
IOC Analysis
The sample contains file hashes in MD5, SHA1 and SHA256 plus CVE identifiers rather than network IOCs. Operationalize hashes by converting all formats into a single EDR blocklist, prioritizing SHA256 where available and treating MD5/SHA1 as weak corroborating indicators only. CVEs should not be blocked; map them to asset exposure: Log4j in Java estates, Ivanti Connect Secure/Pulse Secure at the perimeter, and Windows clients vulnerable to CVE-2024-21412 where internet shortcut handling can suppress SmartScreen. SOC teams should enrich hashes through sandbox detonation, VirusTotal/OTX lookup, EDR prevalence and retrohunt; tooling such as YARA, sigma-cli, Velociraptor, KAPE and Sentinel watchlists can decode or match artifacts. Because only 12 indicators are shown, assume the pulse is an analytic seed: pivot from malware family, CVE, ransom-note names and TTPs rather than waiting for complete C2 lists.
Detection Engineering
Sigma rules for the behaviors represented in this pulse are grouped below.
---
title: DragonForce LockBit Conti Ransomware Impact Execution
id: 7d2a1d30-6c9d-4a9e-9a11-drgnf0001a
status: experimental
description: Detects ransomware impact behaviors linked to DragonForce, LockBit 3.0 and Conti-derived payloads, including shadow-copy deletion, boot-recovery tampering and ransom-note or encrypted-file artifacts.
author: Security Arsenal
references:
- https://www.bitsight.com/blog/threat-actor-profile-dragonforce-ransomware-group
logsource:
product: windows
category: process_creation
detection:
sel_impact:
CommandLine|contains|any:
- 'vssadmin delete shadows'
- 'vssadmin Delete Shadows'
- 'wbadmin delete catalog'
- 'bcdedit /set {default} recoveryenabled No'
- 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'
- 'cipher.exe /w'
sel_note:
CommandLine|contains|any:
- 'readme'
- 'decrypt'
- 'restore-files'
- 'how_to_decrypt'
- '.dragonforce'
- '.lockbit'
- '.conti'
sel_mass:
Image|endswith:
- '\vssadmin.exe'
- '\wbadmin.exe'
- '\bcdedit.exe'
- '\cipher.exe'
condition: sel_mass and sel_impact and sel_note
fields:
- Image
- CommandLine
- ParentCommandLine
- User
falsepositives:
- Backup administrators running catalog pruning during maintenance windows
level: high
tags:
- attack.impact
- attack.t1486
- attack.t1490
---
title: Edge Exploitation Log4Shell Ivanti SmartScreen Initial Access
id: 7d2a1d30-6c9d-4a9e-9a11-drgnf0002b
status: experimental
description: Detects initial-access patterns associated with CVE-2021-44228 JNDI lookups, Ivanti Connect Secure exploitation chains and MOTW or SmartScreen bypass execution used before ransomware deployment.
author: Security Arsenal
references:
- https://www.bitsight.com/blog/threat-actor-profile-dragonforce-ransomware-group
logsource:
product: windows
category: process_creation
detection:
sel_jndi:
CommandLine|contains|any:
- '${jndi:ldap}'
- '${jndi:rmi}'
- '${jndi:dns}'
- 'jndi:ldap://'
- 'jndi:rmi://'
sel_ivanti:
CommandLine|contains|any:
- '/api/v1/totp/user-backup-code'
- '/api/v1/configuration'
- 'ds_store'
- 'compcheckresult'
- 'certutil -urlcache'
- 'bitsadmin /transfer'
sel_motw:
CommandLine|contains|any:
- '.url'
- 'InternetShortcut'
- 'rundll32.exe ieframe.dll,OpenURL'
- 'rundll32.exe url.dll,FileProtocolHandler'
- 'Zone.Identifier'
condition: 1 of sel_*
fields:
- Image
- CommandLine
- ParentImage
- ParentCommandLine
falsepositives:
- Vulnerability scanners and red teams validating exposure
level: high
tags:
- attack.initial-access
- attack.t1190
- attack.t1204
- attack.t1553.005
---
title: Cobalt Strike SystemBC Mimikatz Credential Theft And Tunneling
id: 7d2a1d30-6c9d-4a9e-9a11-drgnf0003c
status: test
description: Detects credential access, beacon staging and SOCKS tunneling behaviors commonly paired with DragonForce intrusions, including LSASS access, MiniDump via comsvcs, suspicious named pipes and proxy implants.
author: Security Arsenal
references:
- https://www.bitsight.com/blog/threat-actor-profile-dragonforce-ransomware-group
logsource:
product: windows
category: process_creation
detection:
sel_lsass:
CommandLine|contains|any:
- 'sekurlsa::'
- 'lsadump::'
- 'comsvcs.dll MiniDump'
- 'procdump'
- 'lsass.exe'
- 'mimikatz'
sel_c2:
CommandLine|contains|any:
- '\\.\pipe\MSSE-'
- '\\.\pipe\postex_'
- '\\.\pipe\status_'
- 'SystemBC'
- 'socks5'
- 'beacon'
- 'powershell -enc'
sel_persist:
CommandLine|contains|any:
- 'schtasks /create'
- 'sc create'
- 'New-Service'
- 'reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run'
- 'reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run'
condition: 2 of sel_*
fields:
- Image
- CommandLine
- ParentImage
- IntegrityLevel
- User
falsepositives:
- Administrative credential auditing, EDR tests and managed remote access
level: critical
tags:
- attack.credential-access
- attack.t1003
- attack.command-and-control
- attack.t1090
- attack.persistence
A Sentinel hunt can combine hash matches with the higher-fidelity behavior chain.
let Hashes = dynamic(['e10361a11f8a7f232ac3cb2125c1875a0a69a3e4','9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507','2915b3f8b703eb744fc54c81f4a9c67f']);
let ImpactTerms = dynamic(['vssadmin delete shadows','wbadmin delete catalog','recoveryenabled No','bootstatuspolicy ignoreallfailures','cipher.exe /w']);
let AccessTerms = dynamic(['${jndi:ldap}','jndi:rmi://','/api/v1/totp/user-backup-code','certutil -urlcache','Zone.Identifier','InternetShortcut','comsvcs.dll MiniDump','sekurlsa::','SystemBC','socks5','postex_','MSSE-']);
union withsource=src (DeviceProcessEvents | extend Artifact=ProcessCommandLine, Kind='process'), (DeviceFileEvents | extend Artifact=FolderPath, Kind='file'), (DeviceNetworkEvents | extend Artifact=tostring(RemoteUrl), Kind='network')
| where SHA256 in (Hashes) or SHA1 in (Hashes) or MD5 in (Hashes) or Artifact has_any (ImpactTerms) or Artifact has_any (AccessTerms) or FileName in~ ('vssadmin.exe','wbadmin.exe','bcdedit.exe','procdump.exe','mimikatz.exe')
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Sources=make_set(src), Files=make_set(FileName), Commands=make_set(Artifact, 20) by DeviceName, InitiatingProcessAccountName, SHA256, SHA1
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, SHA256, SHA1, Sources, Files, Commands
| order by LastSeen desc
Read-only host hunt for persistence, impact evidence and hash presence.
$ErrorActionPreference = 'SilentlyContinue'
$hashes = @('9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507','e10361a11f8a7f232ac3cb2125c1875a0a69a3e4','2915b3f8b703eb744fc54c81f4a9c67f')
$roots = @($env:TEMP,$env:ProgramData,$env:APPDATA,$env:LOCALAPPDATA,'C:\Users\Public')
Write-Output '[+] Hash sweep in high-risk staging paths'
Get-ChildItem $roots -Recurse -File -Force | Where-Object { $_.Length -lt 200MB } | ForEach-Object { $s=(Get-FileHash $_.FullName -Algorithm SHA256).Hash; $s1=(Get-FileHash $_.FullName -Algorithm SHA1).Hash; $m=(Get-FileHash $_.FullName -Algorithm MD5).Hash; if($hashes -contains $s -or $hashes -contains $s1 -or $hashes -contains $m){ [pscustomobject]@{Path=$_.FullName; SHA256=$s; SHA1=$s1; MD5=$m} } }
Write-Output '[+] Ransom note and encrypted-name artifacts'
Get-ChildItem $roots -Recurse -File -Force -Include '*decrypt*','*readme*','*restore*','*.dragonforce','*.lockbit','*.conti' | Select-Object FullName,Length,LastWriteTime
Write-Output '[+] Persistence hits mentioning DragonForce LockBit Conti SystemBC'
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' | Out-String | Select-String -Pattern 'dragonforce|lockbit|conti|systembc|beacon|update'
Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'dragonforce|lockbit|conti|systembc|beacon' -or $_.PathName -match 'Temp|AppData|ProgramData|rundll32|regsvr32|powershell -enc' } | Select-Object Name,State,PathName
Get-ScheduledTask | Where-Object { $_.TaskName -match 'dragonforce|lockbit|conti|systembc|update' -or ($_.Actions.Execute -match 'rundll32|regsvr32|powershell|wscript|mshta') } | Select-Object TaskName,TaskPath,State
Write-Output '[+] LSASS dumps and impact commands'
Get-ChildItem 'C:\Windows\Temp',$env:TEMP -Recurse -Force -Include '*lsass*','*.dmp' | Select-Object FullName,Length,LastWriteTime
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 5000 | Where-Object { $_.Message -match 'vssadmin delete shadows|wbadmin delete catalog|bcdedit|comsvcs.dll MiniDump|sekurlsa|jndi:ldap|certutil -urlcache' } | Select-Object TimeCreated,Message -First 100
Write-Output '[+] Recent outbound sessions to common tunnel ports'
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 443,8443,4444,9001,9050,1080 } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess
Response Priorities
- Immediate: push SHA256 first, then SHA1/MD5, into EDR and email/web controls; isolate hosts showing shadow-copy deletion, ransom notes, LSASS dumping or JNDI callbacks; capture memory before reimage; disable exposed Ivanti or unpatched Java services if compromise is plausible.
- 24h: because Mimikatz/Cobalt Strike are in scope, reset credentials for users on touched endpoints, revoke sessions and tokens, check for new admin accounts, abnormal VPN logins and impossible travel; validate MSP/RMM access and rotate shared service secrets.
- 1 week: patch or compensate for CVE-2021-44228, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893 and CVE-2024-21412; enforce MFA and phishing-resistant auth for remote access, block JNDI egress, restrict LOLBins and outbound SOCKS, segment backup control planes, and test restore from immutable copies.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.