DRAGONFORCE Ransomware: Global Surge in Business Services Attacks & Detection Engineering for Critical CVEs

---
title: Potential ConnectWise ScreenConnect Authentication Bypass (CVE-2024-1708)
id: 6a48f5e8-9c8f-4e9a-9d2b-1a5c6f3e8d9c
status: experimental
description: Detects potential exploitation of ConnectWise ScreenConnect authentication bypass and path traversal vulnerabilities leading to webshell creation.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/27
tags:
    - attack.initial_access
    - attack.web_shell
    - cve.2024.1708
logsource:
    category: web
detection:
    selection:
        cs-uri-query|contains:
            - '/Setup/Upgrade.aspx'
            - '/Bin/ScreenConnect.Service.dll'
            - 'WebService.ashx'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Legitimate administrative upgrades
level: critical

---
title: SmarterMail Webshell Upload via File Upload Vulnerability (CVE-2025-52691)
id: b1f2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects the upload of suspicious file types to SmarterMail directories, indicative of webshell activity following the exploitation of the unrestricted upload vulnerability.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/27
tags:
    - attack.initial_access
    - attack.persistence
    - cve.2025.52691
logsource:
    category: file_creation
detection:
    selection:
        TargetFilename|contains:
            - 'C:\\Program Files (x86)\\SmarterTools\\SmarterMail\\MRS\\'
            - '/var/lib/smartermail/'
        TargetFilename|endswith:
            - '.aspx'
            - '.ashx'
            - '.asmx'
    condition: selection
falsepositives:
    - Rare, legitimate administrative file maintenance
level: high

---
title: DRAGONFORCE Ransomware Pre-Encryption Activity
id: e3d4c5b6-a7b8-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects typical DRAGONFORCE pre-encryption behavior including Volume Shadow Copy deletion (via vssadmin) and mass file encryption patterns.
references:
    - Internal Threat Intelligence
author: Security Arsenal Research
date: 2026/05/27
tags:
    - attack.impact
    - attack.t1485
logsource:
    category: process_creation
detection:
    selection_vss:
        Image|endswith:
            - '\\vssadmin.exe'
            - '\\wmic.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
    selection_crypt:
        Image|endswith:
            - '\.exe'
        CommandLine|contains:
            - '-enc'
            - '-encrypt'
            - '--lock'
    condition: 1 of selection_
falsepositives:
    - Legitimate system administration (rare for vssadmin delete)
level: critical

// Hunt for lateral movement and staging associated with DRAGONFORCE tooling
// Looks for suspicious admin tools spawned by web server processes or unusual parent-child relationships
let AdminTools = dynamic(["psexec.exe", "wmic.exe", "powershell.exe", "cmd.exe", "rclone.exe", "megacmd"]);
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ (AdminTools)
| where InitiatingProcessFileName hasAny ("w3wp.exe", "java.exe", "svchost.exe", "smartermail.exe", "screenconnect.service.exe")
| extend FullFilePath = FolderPath + FileName
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

<#
.SYNOPSIS
    DRAGONFORCE Hardening & Investigation Script
.DESCRIPTION
    Checks for indicators of compromise related to CVE-2024-1708, SmarterMail, and common ransomware staging.
#>

Write-Host "[+] Checking for suspicious Scheduled Tasks (Last 7 Days)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -ge (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author

Write-Host "[+] Checking for recent Volume Shadow Copy deletions (Event ID 5145 or VSS)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | 
    Where-Object {$_.Message -like '*stopped*' -and $_.Message -like '*VSS*'} | Select-Object TimeCreated, Message

Write-Host "[+] Checking for ScreenConnect & SmarterMail Service Status..." -ForegroundColor Cyan
$services = @("ScreenConnect", "SmarterMail Service", "SmarterTools SmarterMail")
foreach ($svc in $services) {
    $status = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($status) {
        Write-Host "Service: $($status.Name) - Status: $($status.Status) - StartType: $($status.StartType)"
    }
}

Write-Host "[+] Identifying open RDP ports (NetStat)..." -ForegroundColor Yellow
netstat -an | Select-String ":3389" | Measure-Object


---