DRAGONFORCE Ransomware: Critical Campaign Targeting Healthcare & Business Services

title: Potential SmarterMail Authentication Bypass Exploit (CVE-2026-23760)
id: c7a9b8d1-3f4e-4a5c-9b1d-0e2f3a4b5c6d
description: Detects potential exploitation of SmarterMail authentication bypass vulnerability via suspicious URL patterns or authentication anomalies.
status: experimental
date: 2026/04/18
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Services/MailBox.asmx'
            - '/Runtime/Execute'
    filter:
        cs-method|contains: 'POST'
        sc-status: 200
    condition: selection and filter
falsepositives:
    - Legitimate administrative access to SmarterMail
level: critical
tags:
    - attack.initial_access
    - cve.2026.23760
    - dragonforce
---
title: Cisco FMC Deserialization Exploit Attempt (CVE-2026-20131)
id: d8e0c9e2-4g5f-5b6d-0c2e1f3a4b5c6d
description: Detects suspicious deserialization activity or API calls to Cisco FMC indicative of CVE-2026-20131 exploitation.
status: experimental
date: 2026/04/18
author: Security Arsenal Research
logsource:
    product: cisco
detection:
    selection:
        message|contains:
            - 'java.io.ObjectInputStream'
            - 'Apache Commons Collections'
            - 'Caused by: java.lang.ClassNotFoundException'
    condition: selection
falsepositives:
    - Java application errors unrelated to exploit
level: high
tags:
    - attack.defense_evasion
    - cve.2026.20131
    - dragonforce
---
title: DragonForce Typical Ransomware Pre-Encryption Activity
id: e9f1d0e3-5h6g-6c7e-1d3f2g4h5i6j7k
description: Detects patterns consistent with DragonForce prep, including mass file copying using rclone or robocopy and VSS shadow copy deletion via vssadmin.
status: experimental
date: 2026/04/18
author: Security Arsenal Research
logsource:
    category: process_creation
detection:
    selection_tools:
        Image|endswith:
            - '\rclone.exe'
            - '\robocopy.exe'
    selection_vss:
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'wmic shadowcopy delete'
    condition: 1 of selection*
falsepositives:
    - Legitimate backup operations (check context)
level: high
tags:
    - attack.impact
    - attack.t1490
    - dragonforce

// Hunt for DragonForce lateral movement and staging
// Looks for unusual network connections and powershell encoding
let TimeFrame = 1d;
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemotePort in (445, 3389, 5985, 5986) or RemotePort >= 40000 and RemotePort <= 49999 // Common SMB/RDP/WinRM and dynamic RPC ports
| where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessFileName =~ "wmiapsrv.exe"
| summarize Count = count(), RemoteIPs = make_set(RemoteIP) by DeviceName, InitiatingProcessCommandLine
| where Count > 10 // Threshold for suspicious frequency
| project-away Count
| join kind=inner (
    DeviceProcessEvents 
    | where Timestamp > ago(TimeFrame) 
    | where FileName in-("vssadmin.exe", "wbadmin.exe", "bcdedit.exe") // Pre-encryption checks
) on DeviceName

<#
.SYNOPSIS
    DragonForce Indicator Hunter - Checks for signs of staging and persistence.
.DESCRIPTION
    Scans for recent scheduled tasks, unusual processes, and VSS shadow copy status.
#>

function Invoke-DragonForceCheck {
    Write-Host "[+] Checking for DragonForce Indicators..." -ForegroundColor Cyan

    # 1. Check for recently created Scheduled Tasks (Persistence)
    $schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
    if ($schTasks) {
        Write-Host "[!] WARNING: Scheduled tasks created in the last 7 days:" -ForegroundColor Red
        $schTasks | Select-Object TaskName, Date, Author | Format-Table
    } else {
        Write-Host "[-] No suspicious recent scheduled tasks found." -ForegroundColor Green
    }

    # 2. Check for Shadow Copy Deletion Attempts (Impact)
    $vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=12343} -MaxEvents 5 -ErrorAction SilentlyContinue
    if ($vssEvents) {
        Write-Host "[!] WARNING: Recent Volume Shadow Copy deletion events found." -ForegroundColor Red
    }

    # 3. Check for Rclone or suspicious backup tools (Exfil/Stage)
    $procs = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -like "*rclone*" -or $_.ProcessName -like "*mimikatz*" }
    if ($procs) {
        Write-Host "[!] CRITICAL: Suspicious process running (rclone/mimikatz)!!!" -ForegroundColor Red
        $procs | Format-Table Id, ProcessName, Path
    }

    # 4. Check for SmarterMail anomalies (CVE-2026-23760)
    $iisLogs = Get-ChildItem "C:\inetpub\logs\LogFiles\*\*.log" -ErrorAction SilentlyContinue | 
        Select-String -Pattern "Services/MailBox.asmx" | Select-Object -Last 5
    if ($iisLogs) {
        Write-Host "[!] INFO: SmarterMail API activity detected in IIS logs." -ForegroundColor Yellow
    }
}

Invoke-DragonForceCheck


---