DRAGONFORCE Ransomware: Global Campaign Targets Logistics & Tech via Critical Firewall & Mail Vulnerabilities

title: Potential ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: 6f3a1a2a-5d3b-4e3c-9a1f-1b2c3d4e5f6a
status: experimental
description: Detects potential path traversal attempts targeting ConnectWise ScreenConnect vulnerability CVE-2024-1708.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    category: web
detection:
    selection:
        cs-uri-query|contains:
            - '..%2f'
            - '..\\'
            - 'SetupCache'
        c-uri|contains: '/Login.aspx'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: SmarterMail Suspicious File Upload or Auth Bypass
id: 7a4b2b3b-6e4c-5f4d-0b2c-2c3d4e5f6a7b
status: experimental
description: Detects potential exploitation of SmarterMail vulnerabilities CVE-2025-52691 or CVE-2026-23760 via unusual file uploads or authentication methods.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    category: web
detection:
    selection_uri:
        c-uri|contains:
            - '/Services/Mail.asmx'
            - '/Migrate/default.aspx'
    selection_methods:
        cs-method: POST
    selection_ext:
        cs-uri-query|contains:
            - '.aspx'
            - '.ashx'
    filter:
        cs-user-agent|contains: 'Mozilla'
    condition: selection_uri and selection_methods and selection_ext and not filter
falsepositives:
    - Legitimate administrative migrations
level: high
---
title: Potential Ransomware Lateral Movement via PsExec
id: 8c5c3c4c-7f5d-0g5e-1c3d-3d4e5f6a7b8c
status: experimental
description: Detects the use of PsExec for lateral movement, often used by ransomware gangs including DRAGONFORCE for propagation.
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\psexec.exe'
        - OriginalFileName: 'psexec.exe'
    selection_cli:
        CommandLine|contains:
            - '-accepteula'
            - '\\'
    condition: selection_img and selection_cli
falsepositives:
    - Administrative IT tasks
level: high

// Hunt for lateral movement and data staging associated with DragonForce
// Looks for mass file copying or unusual SMB access followed by encryption processes
let ProcessCreationEvents = Materialize(
    DeviceProcessEvents 
    | where Timestamp > ago(7d)
);
ProcessCreationEvents
| where FileName in~ ("powershell.exe", "cmd.exe", "robocopy.exe", "rclone.exe", "vssadmin.exe")
| extend ProcessCommand = ProcessCommandLine 
| where ProcessCommand has "delete" 
    or ProcessCommand has "shadow" 
    or ProcessCommand has "copy" 
    or ProcessCommand has "smb" 
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommand, InitiatingProcessFileName
| join kind=leftanti (
    DeviceProcessEvents 
    | where FileName in~ ("msmpeng.exe", "sense.exe") // Common AV exclusions
) on DeviceName, Timestamp
| distinct Timestamp, DeviceName, AccountName, FileName, ProcessCommand
| order by Timestamp desc

# DragonForce Rapid Response Audit
# Checks for exposed RDP, unusual scheduled tasks, and VSS manipulation

Write-Host "[+] DRAGONFORCE THREAT HUNT - $(Get-Date)" -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in last 7 days (Common Persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($schTasks) {
    foreach ($task in $schTasks) {
        Write-Host "[!] SUSPICIOUS TASK FOUND: $($task.TaskName) (Created: $($task.Date))" -ForegroundColor Red
        Write-Host "    Action: $($task.Actions.Execute)" -ForegroundColor DarkGray
    }
} else {
    Write-Host "[-] No recent suspicious tasks found." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Service (VSS) Usage
Write-Host "\n[*] Checking for recent VSS manipulation events..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($vssEvents) {
    Write-Host "[!] WARNING: Recent VSS activity detected. Check for shadow copy deletions." -ForegroundColor Red
    $vssEvents | Select-Object TimeCreated, Message | Format-Table -Wrap
} else {
    Write-Host "[-] No critical VSS events in last 24 hours." -ForegroundColor Green
}

# 3. Audit Network Interfaces for RDP exposure
Write-Host "\n[*] Checking RDP Configuration..." -ForegroundColor Yellow
$rdpStatus = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpStatus.fDenyTSConnections -eq 0) {
    Write-Host "[!] WARNING: RDP is ENABLED. Ensure Firewall rules block external access." -ForegroundColor Red
} else {
    Write-Host "[-] RDP is Disabled." -ForegroundColor Green
}


---