DRAGONFORCE Ransomware Gang: Multi-Sector Attack Campaign — Detection Engineering & Threat Intel Briefing

---
title: Potential Nx Console Exploitation - DRAGONFORCE Initial Access
id: df-1001
description: Detects potential exploitation of Nx Console vulnerability (CVE-2026-48027) commonly used by DRAGONFORCE ransomware gang
status: experimental
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/05/29
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.48027
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\nx-console.exe'
        CommandLine|contains: 
            - '--download'
            - '--execute'
            - '--install'
    condition: selection
falsepositives:
    - Legitimate Nx Console usage
level: high
---
title: DRAGONFORCE Lateral Movement via PsExec
id: df-1002
description: Detects suspicious PsExec usage patterns associated with DRAGONFORCE ransomware lateral movement
status: experimental
author: Security Arsenal Research
date: 2026/05/29
tags:
    - attack.lateral_movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\psexec.exe'
        CommandLine|contains:
            - '-accepteula'
            - '\\\'
    filter:
        ParentProcessName|contains:
            - '\System32\'
            - '\Windows\'
            - '\Program Files\'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative tasks
level: high
---
title: DRAGONFORCE Data Staging - Mass File Archiving
id: df-1003
description: Detects potential data staging activity before exfiltration by DRAGONFORCE ransomware gang
status: experimental
author: Security Arsenal Research
date: 2026/05/29
tags:
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith:
            - '\7z.exe'
            - '\winrar.exe'
            - '\tar.exe'
        CommandLine|contains:
            - '-a'
            - '-m0'
            - '-m5'
            - 'archive'
    timeframe: 5m
    condition: selection | count() > 3
falsepositives:
    - Legitimate system backup activities
level: medium

// Hunt for DRAGONFORCE lateral movement indicators
let TimeRange = ago(7d);
let SuspiciousProcesses = dynamic(["psexec.exe", "wmic.exe", "wmi.exe", "powershell.exe", "cmd.exe"]);
// Look for processes spawned from suspicious parents
DeviceProcessEvents
| where Timestamp >= TimeRange
| where InitiatingProcessFileName in (SuspiciousProcesses) or FileName in (SuspiciousProcesses)
| where InitiatingProcessCommandLine has "-encodedCommand" or InitiatingProcessCommandLine has "Invoke-" 
or CommandLine has "-encodedCommand" or CommandLine has "Invoke-"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

# DRAGONFORCE Ransomware Detection Script
# This script checks for indicators of DRAGONFORCE ransomware activity
$Results = @()
# Check for recent suspicious scheduled tasks
Write-Host "Checking for recently added scheduled tasks..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($RecentTasks) {
    $Results += "RECENT TASKS FOUND: $($RecentTasks.Count) tasks created in the last 7 days"
    foreach ($Task in $RecentTasks) {
        $Results += "Task: $($Task.TaskName), Created: $($Task.Date), Action: $($Task.Actions.Execute)"
    }
} else {
    $Results += "No suspicious scheduled tasks found in the last 7 days"
}
# Check for modified Volume Shadow Copies
Write-Host "Checking for modified Volume Shadow Copies..." -ForegroundColor Yellow
try {
    $VSSChanges = vssadmin list shadows | Select-String "Shadow Copy Volume"
    $RecentShadows = $VSSChanges | Where-Object { $_ -match (Get-Date).ToString("MM/dd/yyyy") }
    if ($RecentShadows) {
        $Results += "RECENT VSS CHANGES FOUND: Multiple shadow copies created today"
        $Results += $RecentShadows
    } else {
        $Results += "No unusual Volume Shadow Copy activity detected"
    }
} catch {
    $Results += "Could not check Volume Shadow Copy status: $_"
}
# Check for unusual network connections
Write-Host "Checking for suspicious network connections..." -ForegroundColor Yellow
try {
    $Connections = Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -eq 4444 -or $_.RemotePort -eq 8080 }
    if ($Connections) {
        $Results += "SUSPICIOUS NETWORK CONNECTIONS FOUND:"
        foreach ($Conn in $Connections) {
            $Results += "Remote: $($Conn.RemoteAddress):$($Conn.RemotePort), PID: $($Conn.OwningProcess)"
        }
    } else {
        $Results += "No suspicious network connections detected on common C2 ports"
    }
} catch {
    $Results += "Could not check network connections: $_"
}
# Display results
Write-Host "`n==== SCAN RESULTS ====" -ForegroundColor Cyan
foreach ($Result in $Results) {
    if ($Result -match "FOUND|DETECTED") {
        Write-Host $Result -ForegroundColor Red
    } else {
        Write-Host $Result -ForegroundColor Green
    }
}