DRAGONFORCE Ransomware Gang: 4 New Victims Posted in 24 Hours — Cross-Border Campaign Analysis & Detection Engineering

---
title: DragonForce - Suspicious Authentication Followed by Service Execution (VPN/RMM Intrusion Pattern)
id: 9f3a1c2e-7b4d-4e1f-a8c3-2026082501
status: experimental
description: Detects the DragonForce affiliate pattern of perimeter access (VPN/RMM) followed rapidly by remote service creation or PsExec-style execution, indicative of hands-on lateral movement post initial access via CVE-2026-50751 or CVE-2024-1708
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: process_creation
  service: security
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
      - '\csexec.exe'
  selection_service_create:
    EventID: 7045
    Service_File_Name|contains:
      - 'PSEXESVC'
      - '\Users\Public\'
      - '\ProgramData\'
      - 'ADMIN$'
  selection_lolbin_remote:
    Image|endswith:
      - '\wmic.exe'
      - '\wmiprvse.exe'
    CommandLine|contains:
      - 'process call create'
      - '/node:'
  condition: 1 of selection_*
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - ComputerName
falsepositives:
  - Legitimate administrative PsExec usage by IT teams
  - SCCM/Intune remote management activity
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1021.002
---
title: DragonForce - Data Staging and Archive Creation in Public Directories Pre-Encryption
id: 9f3a1c2e-7b4d-4e1f-a8c3-2026082502
status: experimental
description: Detects mass archive creation using 7-Zip/WinRAR or staging of collected data in public writable directories — a consistent pre-exfiltration behavior in DragonForce intrusions, typically 24-72 hours before ransomware detonation
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_archivers:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\7zg.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_staging_paths:
    CommandLine|contains:
      - '\Users\Public\'
      - '\ProgramData\'
      - 'C:\Temp\'
      - '\AppData\Local\Temp\'
  selection_bulk_flags:
    CommandLine|contains:
      - ' -r '
      - '-mx'
      - '-p'
      - 'a -t7z'
      - 'a -trar'
  filter_legit_backup:
    ParentImage|endswith:
      - '\svchost.exe'
    User|contains: 'SYSTEM'
  condition: selection_archivers and selection_staging_paths and 1 of selection_bulk_flags and not filter_legit_backup
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - TargetFilename
falsepositives:
  - Legitimate IT archiving scripts
  - Software packaging activity
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
---
title: DragonForce - Recovery Inhibition via Shadow Copy and Backup Deletion
id: 9f3a1c2e-7b4d-4e1f-a8c3-2026082503
status: experimental
description: Detects Volume Shadow Copy deletion, boot configuration tampering, and backup catalog destruction — the final pre-encryption step in the DragonForce/LockBit-derived encryptor playbook (T-minus minutes to detonation)
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic_shadow:
    Image|endswith:
      - '\wmic.exe'
      - '\WMIC.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'shadow'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
  selection_powershell_vss:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Win32_ShadowCopy | Remove-WmiObject'
      - 'vssadmin delete'
      - 'Get-CimInstance Win32_ShadowCopy'
  condition: 1 of selection_*
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - IntegrityLevel
falsepositives:
  - Legitimate storage administrators reclaiming shadow copy space
  - Some backup software managing its own snapshots
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

// Security Arsenal — DragonForce Pre-Ransomware Staging & Lateral Movement Hunt
// Microsoft Sentinel / Defender XDR | Recommended lookback: 14 days
// Hunts: remote service execution, archive staging, recovery inhibition, and anomalous outbound exfil volume
let Lookback = 14d;
let StagingPaths = dynamic(["\\Users\\Public\\", "\\ProgramData\\", "C:\\Temp\\", "\\AppData\\Local\\Temp\\"]);
let LateralMovement =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (FileName in~ ("psexec.exe", "psexesvc.exe", "paexec.exe", "csexec.exe"))
        or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("process call create", "/node:"))
    | project LateralTime = Timestamp, DeviceId, DeviceName, InitiatingProcessAccountName,
              FileName, ProcessCommandLine, InitiatingProcessFileName;
let ArchiveStaging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any (StagingPaths)
    | project StageTime = Timestamp, DeviceId, DeviceName, InitiatingProcessAccountName,
              ArchiveCmd = ProcessCommandLine;
let RecoveryInhibition =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "bootstatuspolicy"))
        or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete catalog")
    | project InhibitTime = Timestamp, DeviceId, DeviceName, InitiatingProcessAccountName,
              InhibitCmd = ProcessCommandLine;
let ExfilSignal =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteIPType == "Public"
    | where RemoteUrl has_any ("mega.nz", "dropbox", "gofile", "file.io", "temp.sh", "transfer.sh", "anonfiles", "rclone")
        or InitiatingProcessFileName in~ ("rclone.exe", "megacmd.exe", "curl.exe", "filezilla.exe")
    | summarize BytesOut = sum(todouble(1)), Connections = count(),
                FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
            by DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl;
LateralMovement
| join kind=fullouter ArchiveStaging on DeviceId
| join kind=fullouter RecoveryInhibition on DeviceId
| join kind=fullouter ExfilSignal on DeviceId
| extend SignalCount = count_of(LateralTime, StageTime, InhibitTime, FirstSeen)
| extend RiskScore = iff(InhibitTime > datetime(2000-01-01), 100,
                     iff(StageTime > datetime(2000-01-01) and FirstSeen > datetime(2000-01-01), 80,
                     iff(LateralTime > datetime(2000-01-01), 50, 20)))
| where SignalCount >= 1
| project DeviceName, RiskScore, SignalCount,
          LateralTime, FileName, ProcessCommandLine,
          StageTime, ArchiveCmd,
          InhibitTime, InhibitCmd,
          InitiatingProcessFileName, RemoteUrl,
          InitiatingProcessAccountName
| sort by RiskScore desc, LateralTime desc;

<#
.SYNOPSIS
  Security Arsenal — DragonForce Rapid Triage & Hardening Script
  Checks: exposed RDP, recently created scheduled tasks/services (7d),
  Volume Shadow Copy integrity, suspicious staging directories, RMM tools.
  Run elevated on servers and high-value workstations during IR or proactive hunts.
#>

$ReportPath = "C:\IR_Triage_$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
$Findings = @()

Write-Host "[*] DragonForce rapid triage starting on $(hostname)..." -ForegroundColor Cyan

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$rdpPort = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
if ($rdpEnabled -eq 0) {
    $Findings += "[HIGH] RDP is ENABLED on port $rdpPort. Verify it is not internet-exposed (check perimeter firewall/NAT rules immediately)."
}
$failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+10' } | Group-Object -Property @{Expression={($_.Message -split "`n") -match 'Source Network Address' | ForEach-Object { ($_ -split ':')[-1].Trim() }}} -ErrorAction SilentlyContinue
foreach ($grp in $failedLogons) {
    if ($grp.Count -gt 20) { $Findings += "[HIGH] RDP brute-force pattern: $($grp.Count) failed type-10 logons from $($grp.Name) in 7 days." }
}

# 2. Scheduled tasks created in last 7 days (persistence)
$recentTasks = Get-ScheduledTask | Where-Object {
    try { (Get-ScheduledTaskInfo $_).LastRunTime -gt (Get-Date).AddDays(-7) -and $_.Date -gt (Get-Date).AddDays(-7) } catch { $false }
} | Where-Object { $_.TaskPath -notlike '\Microsoft*' }
foreach ($t in $recentTasks) { $Findings += "[MED] Recently created non-Microsoft scheduled task: $($t.TaskPath)$($t.TaskName) — Action: $(($t.Actions | Select-Object -First 1).Execute)" }

# 3. Suspicious services created in last 7 days (PsExec/persistence)
$cutoff = (Get-Date).AddDays(-7)
Get-CimInstance Win32_Service | ForEach-Object {
    $svcPath = ($_.PathName -replace '"','') -split ' ' | Select-Object -First 1
    if ($svcPath -and (Test-Path $svcPath -ErrorAction SilentlyContinue)) {
        $created = (Get-Item $svcPath).CreationTime
        if ($created -gt $cutoff -and ($_.PathName -match 'Public|ProgramData|Temp|ADMIN\$')) {
            $Findings += "[CRITICAL] Service with binary in staging path created $($created): $($_.Name) -> $($_.PathName)"
        }
    }
}

# 4. Volume Shadow Copy integrity
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows -or $shadows.Count -eq 0) {
    $Findings += "[CRITICAL] NO Volume Shadow Copies present — either never configured or DELETED (T1490 indicator). Investigate vssadmin/wmic process history NOW."
} else {
    $Findings += "[INFO] $($shadows.Count) shadow copies present. Oldest: $((($shadows | Sort-Object InstallDate)[0]).InstallDate)"
}

# 5. RMM tooling sweep (ScreenConnect, etc. — CVE-2024-1708 relevance)
$rmmIndicators = @('ScreenConnect*', 'AnyDesk*', 'TeamViewer*', 'Atera*', 'Splashtop*', 'ConnectWise*')
foreach ($rmm in $rmmIndicators) {
    $svc = Get-Service -Name $rmm -ErrorAction SilentlyContinue
    if ($svc) { $Findings += "[MED] RMM tool present: $($svc.Name) ($($svc.Status)). Confirm it is authorized and patched." }
}

# 6. Staging directory sweep
$stagingDirs = @('C:\Users\Public', 'C:\ProgramData', 'C:\Temp')
foreach ($dir in $stagingDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Include *.7z,*.rar,*.zip -ErrorAction SilentlyContinue |
            Where-Object { $_.CreationTime -gt $cutoff -and $_.Length -gt 50MB } |
            ForEach-Object { $Findings += "[HIGH] Large archive created in last 7d: $($_.FullName) ($([math]::Round($_.Length/1MB)) MB)" }
    }
}

$Findings | Out-File $ReportPath
Write-Host "[+] Triage complete. $($Findings.Count) findings written to $ReportPath" -ForegroundColor Green
$Findings | ForEach-Object { Write-Host $_ }