DRAGONFORCE Ransomware: Global Surge Exploiting ScreenConnect & Mail Vulnerabilities — 16 New Victims

---
title: Potential ScreenConnect Auth Bypass and RCE Exploit (CVE-2024-1708)
id: 45d1c9e6-8f5a-4b1c-9e5a-3b4c5d6e7f8a
description: Detects potential exploitation of ConnectWise ScreenConnect authentication bypass and path traversal vulnerabilities leading to RCE.
author: Security Arsenal Research
date: 2026/05/26
status: experimental
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\ScreenConnect.ClientService.exe'
        NewProcessName|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    filter_legit:
        CommandLine|contains: 'update' # May trigger on legitimate updates, tune as needed
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative use via ScreenConnect
level: critical
---
title: SmarterMail Unrestricted File Upload Exploit (CVE-2025-52691)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects web shell-like activity or suspicious process execution stemming from SmarterMail web directory exploitation.
author: Security Arsenal Research
date: 2026/05/26
status: experimental
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
    product: iis
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/MigrateFrom'
            - 'SortOrder='
            - '.aspx' # Common web shell extension in this context
    selection_status:
        sc-status: 200
    condition: selection_uri and selection_status
falsepositives:
    - Legitimate mail server administration
level: high
---
title: DRAGONFORCE Ransomware Pre-Encryption Staging Activity
description: Detects common patterns observed prior to DRAGONFORCE encryption, including VSS shadow deletion and mass file renaming.
author: Security Arsenal Research
date: 2026/05/26
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        CommandLine|contains:
            - 'vssadmin.exe Delete Shadows'
            - 'wbadmin delete catalog'
    selection_recon:
        Image|endswith:
            - '\ping.exe'
            - '\systeminfo.exe'
    context:
        ParentImage|contains:
            - '\cmd.exe'
            - '\powershell.exe'
    condition: 1 of selection* and context
falsepositives:
    - Legitimate system administration (backup tasks)
level: critical

// Hunt for lateral movement and staging often associated with DRAGONFORCE affiliates
// Looks for SMB connections to multiple hosts followed by PSExec usage
let TimeFrame = 1h;
let SuspiciousProcesses = dynamic(["psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe"]);
let FileExtensions = dynamic([".locked", ".dragon", ".enc", ".crypt"]);
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where ProcessName in~ SuspiciousProcesses
| project DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, Timestamp
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where FileName has_any (FileExtensions) or ActionType == "FileEncrypted"
) on DeviceName
| summarize count() by DeviceName, bin(Timestamp, 5m)
| where count_ > 5

# DRAGONFORCE Rapid Response Audit
# Checks for recent Scheduled Tasks (common persistence) and VSS manipulation

Write-Host "[!] DRAGONFORCE Response Audit - $(Get-Date)" -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 24 hours (typical dwell time)
Write-Host "\n[*] Checking for Scheduled Tasks created in the last 24 hours..." -ForegroundColor Yellow
$schTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-24) }
if ($schTasks) {
    foreach ($task in $schTasks) {
        Write-Host "[!] Suspicious Task Found: $($task.TaskName)" -ForegroundColor Red
        Write-Host "    Action: $($task.Actions.Execute)" -ForegroundColor DarkGray
    }
} else {
    Write-Host "[+] No recent suspicious tasks found." -ForegroundColor Green
}

# 2. Audit VSS Shadow Copy Storage (Ransomware often deletes these)
Write-Host "\n[*] Checking Volume Shadow Copy Status..." -ForegroundColor Yellow
try {
    $vss = vssadmin list shadows
    if ($vss -match "No shadows found") {
        Write-Host "[!] WARNING: No Volume Shadow Copies found. Possible deletion." -ForegroundColor Red
    } else {
        Write-Host "[+] Shadow copies present." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Error checking VSS." -ForegroundColor Gray
}

# 3. Check for unusual RDP Logons (Potential persistence)
Write-Host "\n[*] Checking for recent RDP connections (Type 10)..." -ForegroundColor Yellow
$rdpEvents = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType']='10']]]" -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) }
if ($rdpEvents) {
    Write-Host "[!] Recent RDP Logons detected:" -ForegroundColor Yellow
    $rdpEvents | Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='IP';E={$_.Properties[19].Value}} | Format-Table
}