Classification: TLP:CLEAR | Publication Date: 2026-09-24 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

DRAGONFORCE Ransomware Gang: 4 New Victims Listed — Cross-Regional Campaign Analysis & Detection Engineering

Executive Summary

Security Arsenal's dark web monitoring observed 4 new victim postings on the DRAGONFORCE ransomware group's .onion leak site between 2026-09-23 and 2026-09-24. The gang claims to have compromised organizations in Taiwan, Thailand, France, and the United States, spanning manufacturing, healthcare, and other sectors. All four listings carry MULTI-SOURCE corroboration — meaning two independent leak-site crawlers observed the gang make these claims. This corroborates that the postings exist; it does not confirm that any breach occurred.

The organizations DRAGONFORCE has listed are:

• HEC Group (Other, TW) — published 2026-09-24
• Elite Industech Co., Ltd (Manufacturing, TH) — published 2026-09-23
• BMGP Groupe (Other, FR) — published 2026-09-23
• Arizona Vascular Medical Equipment, Inc (Healthcare, US) — published 2026-09-23

The geographic spread (two APAC, one EU, one US victim claimed in 48 hours) is consistent with DRAGONFORCE's opportunistic, initial-access-driven targeting model rather than a focused regional campaign. Defenders in manufacturing and healthcare — especially those with VMware vCenter, Check Point gateways, or Cisco FMC exposure — should treat this as a prompt to hunt, not panic.

Sourcing & Verification

• Corroboration breakdown: 4 of 4 listings in this reporting window were independently observed by a second leak-site crawler (MULTI-SOURCE tier); 0 appear on a single source only. This means two independent collection systems saw DRAGONFORCE publish these claims on its leak site.
• What inclusion means: Inclusion in this briefing reflects the threat actor's claim only. It is not confirmation of a breach, intrusion, or data theft. No corroboration tier in our data pipeline confirms a breach — only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question; our role is to report what criminal infrastructure claims, accurately labeled as such.
• Corrections: Security Arsenal will publish corrections to this briefing if new information emerges. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — DRAGONFORCE

Known Aliases & Model

DRAGONFORCE operates a Ransomware-as-a-Service (RaaS) program with an affiliate model, providing its encryptor, negotiation infrastructure, and leak site to partners in exchange for a revenue share (typically 20-30% to the core operators). The group has also marketed a white-label / "RaaS franchise" model, allowing affiliates to brand operations under their own names while using DRAGONFORCE infrastructure — a structure that complicates attribution and inflates apparent victim counts across the ecosystem. It has publicly feuded with and claimed compromise of rival RaaS infrastructure, signaling an aggressive posture within the underground.

Ransom Demands

Observed demands typically range from low six figures to multi-million USD, scaled to perceived victim revenue. DRAGONFORCE negotiators are known for aggressive countdown timers on the leak site, escalating from partial data teaser dumps to full publication when deadlines lapse.

Initial Access Methods (historical TTPs)

• Exploitation of internet-facing edge devices — VPN concentrators, firewalls, and virtualization management planes (consistent with the KEV-listed vulnerabilities discussed below)
• Phishing with malicious attachments/links delivering loaders and macro-based droppers
• Exposed RDP — brute force or purchased credentials from initial access brokers (IABs)
• IAB partnerships — purchasing ready access rather than self-sourcing intrusion

Double Extortion & Dwell Time

DRAGONFORCE practices double extortion: data exfiltration prior to encryption, with leak-site publication as leverage. Historical dwell time from initial access to detonation has been observed in the 1-3 week range, with a data-staging phase (often via Rclone or MEGAsync) typically occurring in the final 72 hours before encryption. This staging window is the defender's best detection opportunity.

Current Campaign Analysis

Sectors Targeted (per leak-site claims)

The four listings span Manufacturing (Elite Industech Co., Ltd, TH), Healthcare (Arizona Vascular Medical Equipment, Inc, US), and Other (HEC Group, TW; BMGP Groupe, FR). The manufacturing and healthcare inclusions are notable: both sectors carry high operational-disruption pressure and, in healthcare's case, regulatory exposure that ransomware actors explicitly exploit during negotiation.

Geographic Concentration

No single-region concentration: TW, TH, FR, US across four postings in a 48-hour window. This pattern is consistent with access-driven opportunism — affiliates hitting whatever edge-device or purchased-access inventory is available — rather than a deliberate geographic campaign.

Victim Profile

The listed organizations appear to be small-to-mid-market enterprises (roughly 50-500 employees, estimated revenue in the $10M-$250M range based on sector norms) — the classic RaaS sweet spot: large enough to pay, small enough to lack 24/7 SOC coverage and mature segmentation. A US-based medical equipment firm and an industrial manufacturer both hold data categories (PHI-adjacent records, CAD/IP, customer contracts) with high extortion value.

Posting Frequency & Escalation

Four listings in ~48 hours with 100% multi-source corroboration indicates an active leak-site pipeline, not a one-off dump. DRAGONFORCE historically posts in bursts following affiliate encryption events, then escalates with countdown timers and partial data teasers. Watch for follow-on postings in the next 7-14 days — burst activity often precedes a larger wave as affiliates clear their access backlog.

CVE Exposure Hypothesis (sector-level, not victim-attributed)

We have no evidence linking any specific CVE to any named listing above. However, DRAGONFORCE's documented preference for edge-device and management-plane exploitation makes the following CISA KEV entries (all confirmed ransomware-exploited) priority patch/hunt candidates for organizations in the targeted sectors:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise enables mass VM encryption — the highest-impact ransomware scenario.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08). VPN gateway compromise is a classic RaaS entry vector.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29). Management-plane takeover of the firewall estate.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05). CI/CD compromise enables supply-chain-style lateral spread and code signing abuse.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Developer workstation footholds via poisoned tooling.

Treat these as exposure hypotheses aligned to the gang's tradecraft, not confirmed intrusion vectors for the listed organizations.

Detection Engineering

The following Sigma rules target DRAGONFORCE's known tradecraft: RDP brute force and edge-access follow-on, PsExec/WMI lateral movement with Cobalt Strike-style named pipes, and pre-encryption data staging with shadow copy deletion.

---
title: Suspicious RDP Brute Force Followed by Successful Logon
description: Detects password-spray or brute-force patterns against RDP (multiple 4625 failures from a single source) followed by a successful 4625 type-10 logon — consistent with DRAGONFORCE affiliate initial access via exposed RDP
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
  product: windows
  service: security
detection:
  selection_fail:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_fail | selection_success
timeframe: 10m
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1078
falsepositives:
  - Legitimate user password typos from jump hosts
---
title: PsExec or WMI Remote Service Creation with Suspicious Named Pipe
description: Detects remote service installation (7045) with PsExec-style service names or Cobalt Strike default named pipe artifacts — DRAGONFORCE affiliates use PsExec/WMI for lateral movement and beacon deployment
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  filter_psexec:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
  filter_random_svc:
    ServiceFileName|contains:
      - '\ADMIN$\'
      - '\\127.0.0.1\'
      - 'rundll32'
  condition: selection and (filter_psexec or filter_random_svc)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
falsepositives:
  - Legitimate admin tools (SCCM, PDQ) — baseline known service names
---
title: Pre-Ransomware Data Staging and Shadow Copy Deletion
description: Detects vssadmin/wmic shadow copy deletion combined with known exfiltration tooling (rclone, megasync) execution — DRAGONFORCE's pre-detonation staging behavior
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled no'
  selection_exfil:
    Image|endswith:
      - '\rclone.exe'
      - '\megasync.exe'
      - '\FileZilla.exe'
  condition: selection_shadow or selection_exfil
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1567.002
falsepositives:
  - Backup administrators running legitimate shadow maintenance — scope by service accounts

Hunt query for Microsoft Sentinel — correlates pre-ransomware staging indicators across a 72-hour window, matching DRAGONFORCE's observed pre-detonation behavior:

// DRAGONFORCE pre-ransomware staging hunt: lateral movement + exfil staging + defense evasion
// Lookback aligned to observed ~72h staging window before detonation
let lookback = 72h;
let SuspiciousProcs = dynamic(["rclone.exe","megasync.exe","psexec.exe","paexec.exe","vssadmin.exe","nltest.exe","adfind.exe"]);
let ExfilHosts = dynamic(["mega.nz","mega.co.nz","dropbox.com","file.io","transfer.sh","anonfiles.com"]);
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (SuspiciousProcs)
        or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","/domain_trusts","dclist:")
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let Exfil =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (ExfilHosts)
        or (RemotePort == 443 and InitiatingProcessFileName in~ ("rclone.exe","megasync.exe"))
    | project ExfilTime=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, BytesSent;
let LateralAuth =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where IpAddress !startswith "10." == false or Account !endswith "$"
    | summarize LogonCount=count(), SourceIPs=make_set(IpAddress) by Account, Computer, bin(TimeGenerated, 1h)
    | where LogonCount > 5;
Staging
| join kind=leftouter Exfil on DeviceName
| join kind=leftouter (LateralAuth | project Computer, Account, LogonCount, SourceIPs) on $left.DeviceName == $right.Computer
| project DeviceName, AccountName, StagingTime, FileName, ProcessCommandLine, ExfilTime, RemoteUrl, BytesSent, LogonCount, SourceIPs
| sort by DeviceName asc, StagingTime asc

Rapid-response audit script — checks for exposed RDP, recently created scheduled tasks, shadow copy tampering, and suspicious staging tools. Run on any host suspected of DRAGONFORCE staging activity:

# DRAGONFORCE Rapid Triage — run elevated. Outputs consolidated findings.
# Checks: RDP exposure, new scheduled tasks (7d), VSS tampering, staging tool artifacts
Write-Host "=== DRAGONFORCE Rapid Triage: $env:COMPUTERNAME ===" -ForegroundColor Cyan

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
Write-Host "[RDP] Enabled: $rdpEnabled | Port: $rdpPort | NLA: $nla"
if ($rdpEnabled -and $nla -eq 0) { Write-Host "  [!] RDP enabled WITHOUT NLA — brute-force exposure" -ForegroundColor Red }

# 2. Scheduled tasks created in last 7 days (persistence/lateral movement)
$cutoff = (Get-Date).AddDays(-7)
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
if ($tasks) { Write-Host "[TASKS] Created in last 7 days:" -ForegroundColor Yellow; $tasks | Format-Table -AutoSize }
else { Write-Host "[TASKS] None created in last 7 days" }

# 3. Shadow copy tampering
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
Write-Host "[VSS] Shadow copies present: $(@($shadows).Count)"
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Volume Shadow Copy' }
$vssDelete = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-VSS/Operational'; StartTime=$cutoff} -ErrorAction SilentlyContinue
if (-not $shadows -and $vssDelete) { Write-Host "  [!] No shadows present but VSS activity logged — possible deletion" -ForegroundColor Red }

# 4. Staging/exfil tool artifacts
$toolPaths = @("$env:ProgramFiles\rclone","$env:LOCALAPPDATA\MEGAsync","$env:TEMP\rclone.exe","$env:ProgramData\rclone")
foreach ($p in $toolPaths) { if (Test-Path $p) { Write-Host "  [!] Staging tool artifact found: $p" -ForegroundColor Red } }

# 5. Recent failed logons (brute force indicator)
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
if (@($fails).Count -gt 50) { Write-Host "[!] $(@($fails).Count) failed logons in 24h — possible brute force" -ForegroundColor Red }

Write-Host "=== Triage complete ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

DRAGONFORCE's observed playbook gives defenders a detection window. Hunt these in order:

1. Recon tooling — AdFind, nltest, SharpHound/BloodHound output files (.csv drops in user temp directories), mass LDAP queries from a single workstation
2. Credential access — LSASS memory access by non-system processes, NTDS.dit access on domain controllers, DCSync replication events from non-DC hosts
3. Lateral movement burst — sudden 4624 type 3/10 spikes, 7045 service installs across multiple hosts, PsExec artifacts (PSEXESVC)
4. Staging indicators — Rclone/MEGAsync processes or configs, large outbound transfers to consumer cloud storage, archive creation (.7z, .rar) in bulk on file servers
5. Defense evasion — vssadmin delete shadows, bcdedit ... recoveryenabled no, mass EDR service stop attempts, clearing of event logs (1102)
6. vCenter/ESXi anomalies — new local ESXi users, SSH enabled on hypervisors, VM power-offs in bulk — the final step before mass encryption

Critical Assets Historically Prioritized for Exfiltration

• File servers and NAS — contracts, financials, HR records
• Domain controllers — NTDS.dit for credential theft and leverage
• Email/executive mailboxes — negotiation-sensitive communications
• IP repositories — CAD files, source code, design documents (particularly relevant to manufacturing victims)
• Backup infrastructure — targeted for destruction to force payment
• For healthcare-adjacent targets: patient/billing databases and imaging archives

Containment Actions (ordered by urgency)

1. Isolate, don't power off — network-quarantine affected hosts (EDR isolation or switch ACLs) to preserve volatile evidence; power-off destroys memory-resident indicators
2. Kill the staging channel — block rclone/MEGA/file-transfer egress at the proxy/firewall immediately; severing exfil removes the extortion leverage even if encryption proceeds
3. Credential scorched earth — force-reset domain admin, service, and krbtgt (twice) credentials; assume all tier-0 credentials are compromised
4. Disable edge access — shut down VPN/RDP ingress paths pending forensics; rotate any credentials that transited them
5. Protect backups — take backup infrastructure offline/air-gap it before it becomes the gang's destruction target; verify one known-good immutable restore point
6. Snapshot hypervisors — capture ESXi/vCenter state before remediation; ransomware crews routinely destroy forensic evidence at the virtualization layer
7. Engage IR and legal early — sector-specific disclosure obligations (particularly for US healthcare entities) have clocks that start on confirmation, not on leak-site posting

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV edge stack: VMware vCenter (CVE-2026-59310), Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), TeamCity (CVE-2026-63077). If patching is impossible, take the management interfaces off any internet-reachable path.
• Kill exposed RDP — no direct internet RDP; require VPN + MFA + NLA. Audit for non-standard RDP ports.
• Deploy the Sigma rules above to your SIEM and the triage script to your IR jump kit.
• Block known exfil destinations (MEGA, anonfiles, transfer.sh, rclone remotes) at the egress proxy and alert on consumer-cloud bulk uploads.
• Verify VSS protection — restrict vssadmin/wmic/bcdedit execution via AppLocker or WDAC for non-admin users; alert on any shadow deletion.
• Enforce phishing-resistant MFA on all remote access, VPN, and email — the cheapest single control against affiliate initial access.

Short-Term (2 Weeks)

• Segment tier-0: isolate domain controllers, backup infrastructure, and hypervisor management planes into dedicated enclaves with deny-by-default lateral traffic.
• Immutable/offline backups: at least one copy that ransomware operators cannot reach or encrypt from a compromised domain context; test a restore of a critical system end-to-end.
• EDR coverage audit: close gaps on servers, hypervisors (ESXi-specific sensors or log forwarding), and legacy endpoints — these are where dwell time hides.
• Attack surface management: continuous external scanning for forgotten VPN concentrators, test RDP gateways, and shadow-IT remote access — DRAGONFORCE affiliates find what you forgot.
• Deception: deploy canary files/credentials on file servers and honey service accounts; RaaS affiliates trip these reliably during staging.
• Tabletop the extortion scenario: legal, comms, and executives should rehearse the "data leaked but operations intact" decision tree before it happens.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub