DRAGONFORCE Ransomware: Global Campaign Targets Manufacturing & Business Services — Detection & Mitigation Guide

---
title: Potential DragonForce Ransomware Initial Access via VPN Exploitation
description: Detects suspicious VPN authentication patterns often associated with DragonForce ransomware initial access
author: Security Arsenal
status: experimental
date: 2026/07/15
references:
    - https://securityarsenal.com/threat-research/dragonforce
tags:
    - attack.initial_access
    - attack.t1078
    - attack.t1190
    - dragonforce
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624|4625
        LogonType: 10|8|2
    filter:
        SubjectUserName|startswith: 'DWM-'
        SubjectUserName|endswith: 'AUDIT'
    timeframe: 2h
    condition: selection and not filter | count() > 20
falsepositives:
    - Legitimate remote workers with unstable connections
level: high
---
title: DragonForce Lateral Movement via PsExec
description: Detects execution of PsExec which is frequently used by DragonForce for lateral movement
author: Security Arsenal
status: experimental
date: 2026/07/15
references:
    - https://securityarsenal.com/threat-research/dragonforce
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.s0078
    - dragonforce
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\PsExec.exe'
        CommandLine|contains:
            - '-accepteula'
            - '-s'
            - '-d'
    condition: selection
falsepositives:
    - System administration activities
    - Legitimate software deployment
level: high
---
title: DragonForce Data Staging via Rclone
description: Detects execution of rclone, a tool frequently used by DragonForce for data exfiltration staging
author: Security Arsenal
status: experimental
date: 2026/07/15
references:
    - https://securityarsenal.com/threat-research/dragonforce
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.s1022
    - dragonforce
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\rclone.exe'
        CommandLine|contains:
            - 'config'
            - 'copy'
            - 'sync'
    filter:
        CommandLine|contains:
            - 'update'
            - 'version'
    condition: selection and not filter
falsepositives:
    - Legitimate backup operations using rclone
level: high


Microsoft Sentinel KQL Query:
kql
// DragonForce Lateral Movement and Pre-Encryption Staging Hunt
let Timeframe = 7d;
let SuspiciousProcesses = datatable(ProcessName:string, Description:string) [
    "PsExec.exe", "Remote execution tool used by DragonForce for lateral movement",
    "rclone.exe", "Data transfer tool used for exfiltration staging",
    "mimikatz.exe", "Credential theft tool commonly used by DragonForce",
    "procdump.exe", "Process dump tool used for LSASS extraction",
    "rar.exe", "Archive tool used for data staging",
    "7z.exe", "Archive tool used for data staging"
];
let SuspiciousCommands = datatable(Command:string, Description:string) [
    "vssadmin", "Volume shadow manipulation",
    "wmic shadowcopy", "Volume shadow manipulation",
    "wbadmin", "Backup manipulation",
    "bcdedit", "Boot configuration manipulation",
    "wevtutil cl", "Event log clearing",
    "cipher /w", "Disk wiping preparation"
];
let ProcessCreationEvents =
    DeviceProcessEvents
    | where Timestamp > ago(Timeframe)
    | join kind=inner (SuspiciousProcesses) on ProcessName
    | project Timestamp, DeviceName, ProcessName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let CommandLineEvents =
    DeviceProcessEvents
    | where Timestamp > ago(Timeframe)
    | extend Command = tostring(ProcessCommandLine)
    | join kind=inner (SuspiciousCommands) on $left.Command contains $right.Command
    | project Timestamp, DeviceName, ProcessName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
union ProcessCreationEvents, CommandLineEvents
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, ProcessName, AccountName
| where Count > 3
| order by Count desc, LastSeen desc


Rapid Response PowerShell Script:
powershell
# DragonForce Post-Compromise Assessment Script
# Run this script on potentially compromised systems to identify common DRAGONFORCE TTPs

Write-Host "[+] DragonForce Post-Compromise Assessment" -ForegroundColor Yellow
Write-Host "[+] Starting assessment at $(Get-Date)" -ForegroundColor Yellow

# Check for suspicious scheduled tasks added in the last 7 days
Write-Host "\n[*] Checking for recently added scheduled tasks (last 7 days)..." -ForegroundColor Cyan
$suspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and 
    ($_.Actions.Execute -match 'powershell|cmd|rundll32' -or $_.Actions.Arguments -match '-enc|EncodedCommand')
}
if ($suspiciousTasks) {
    Write-Host "[!] Found $($suspiciousTasks.Count) suspicious scheduled tasks:" -ForegroundColor Red
    $suspiciousTasks | Format-List TaskName, Date, Actions, Author
} else {
    Write-Host "[-] No suspicious scheduled tasks found." -ForegroundColor Green
}

# Check for recently modified Volume Shadow Copies
Write-Host "\n[*] Checking for Volume Shadow Copy manipulation..." -ForegroundColor Cyan
$vssCheck = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ShadowCopy/Operational'; ID=14} -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) }
if ($vssCheck) {
    Write-Host "[!] Volume Shadow Copies recently modified/recommended for deletion:" -ForegroundColor Red
    $vssCheck | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No recent Volume Shadow Copy manipulation detected." -ForegroundColor Green
}

# Check for RDP exposure
Write-Host "\n[*] Checking for RDP exposure..." -ForegroundColor Cyan
$rdpStatus = Get-Service -Name TermService -ErrorAction SilentlyContinue
if ($rdpStatus -and $rdpStatus.Status -eq 'Running') {
    Write-Host "[!] RDP service is running. Verify it is not exposed to the internet." -ForegroundColor Red
    $rdpListeners = Get-NetTCPConnection -State Listen -LocalPort 3389 -ErrorAction SilentlyContinue
    if ($rdpListeners) {
        Write-Host "[!] RDP is listening on:" -ForegroundColor Red
        $rdpListeners | Format-List LocalAddress, LocalPort, State, OwningProcess
    }
} else {
    Write-Host "[-] RDP service is not running." -ForegroundColor Green
}

# Check for common DRAGONFORCE artifacts in common directories
Write-Host "\n[*] Checking for DRAGONFORCE artifacts..." -ForegroundColor Cyan
$dragonforceArtifacts = @("dragonforce", "readme_dragonforce", "how_to_decrypt", "restore_files", "encrypted_files")
$commonPaths = @("C:\Users\Public\", "C:\Windows\Temp\", "C:\Temp\")
foreach ($path in $commonPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | Where-Object {
            $dragonforceArtifacts | Where-Object { $_.Name -like "*$_*" }
        } | ForEach-Object {
            Write-Host "[!] Potential DragonForce artifact found: $($_.FullName)" -ForegroundColor Red
        }
    }
}

Write-Host "\n[+] Assessment completed at $(Get-Date)" -ForegroundColor Yellow