DragonForce

The DragonForce ransomware group initially infiltrated the victim system network via a remote desktop server and attempted persistent logins using valid domain accounts (Domain Accounts, T1078.002).

Notable Behaviour: - Initial Access via public-facing RDP (TA0001/T1133)

The Ransomware Vulnerability Matrix Group Profile for DragonForce shows that affiliates are highly adept at targeting edge devices and remote access points, such as Ivanti Connect Secure, Fortinet FortiOS, SonicWall SSL-VPN.

Others are hit as a stepping stone toward bigger, better-defended targets further down the chain, such as hospitals that depend on them for records, equipment, or connected systems.

When the “schedule_job” field in the Config information is enabled, the process of registering a job that runs with SYSTEM privileges to the scheduler is performed.

After successfully logging in, they executed a PowerShell command (PowerShell, T1059.001) to download additional payloads from a remote location using a Cobalt Strike Beacon, maintaining persistence throughout this process using SystemBC.

When the “schedule_job” field in the Config information is enabled, the process of registering a job that runs with SYSTEM privileges to the scheduler is performed.

The DragonForce ransomware group initially infiltrated the victim system network via a remote desktop server and attempted persistent logins using valid domain accounts (Domain Accounts, T1078.002).

Notable Behaviour: - Initial Access via public-facing RDP (TA0001/T1133)

Appendix C. MITRE ATT&CK ... (T1543.003) Windows Service

Appendix C. MITRE ATT&CK ... (T1547.001) Registry Run Keys / Startup Folder

When the “schedule_job” field in the Config information is enabled, the process of registering a job that runs with SYSTEM privileges to the scheduler is performed.

DragonForce ransomware uses two methods to terminate predefined processes. The first method utilizes the BYOVD (Bring Your Own Vulnerable Driver) technique, exploiting vulnerable drivers...

The DragonForce ransomware group initially infiltrated the victim system network via a remote desktop server and attempted persistent logins using valid domain accounts (Domain Accounts, T1078.002).

Appendix C. MITRE ATT&CK ... (T1543.003) Windows Service

Appendix C. MITRE ATT&CK ... (T1547.001) Registry Run Keys / Startup Folder

All strings used by DragonForce ransomware are obfuscated and decrypted using a custom algorithm.

...some samples... were found to perform API resolving based on the MurMurHash2 algorithm to dynamically load the API.

Appendix C. MITRE ATT&CK ... (T1070.001) Clear Windows Event Logs

The DragonForce ransomware group initially infiltrated the victim system network via a remote desktop server and attempted persistent logins using valid domain accounts (Domain Accounts, T1078.002).

The key configuration values... are stored within the binary in an encrypted format. These are decrypted using the ChaCha8 algorithm for use.

In the most progressed case, the operator used PsExec, Impacket-based tooling and Mimikatz for lateral movement and credential access before deploying a DragonForce ransomware binary

Subsequently, the attacker used Mimikatz to dump credential information (LSASS Memory, T1003.001) and collected Active Directory configuration...

a lot of these DragonForce incidents have been because of RDP and SSL-VPN account brute forcing.

one that begins with exploitation of the “CitrixBleed 2” vulnerability in Citrix NetScaler appliances... Huntress assesses with high confidence that the activity is the work of an initial access broker (IAB) weaponising CVE-2025-5777 to gain footholds in Citrix environments

...collected Active Directory configuration (Domain Trust Discovery, T1482) and network information (System Network Configuration Discovery, T1016) via ADFind and netscanold.exe.

Appendix C. MITRE ATT&CK ... (T1018) Remote System Discovery

Appendix C. MITRE ATT&CK ... (T1082) System Information Discovery

Before performing encryption, a directory traversal is conducted to identify files to be encrypted.

If the connection succeeds, it enumerates shared drives and directories using NetShareEnum(). Only shares of the temporary/special/disk type are included as encryption targets...

...collected Active Directory configuration (Domain Trust Discovery, T1482) and network information... via ADFind and netscanold.exe.

In the most progressed case, the operator used PsExec, Impacket-based tooling and Mimikatz for lateral movement and credential access

The obtained credentials and network information were leveraged for lateral movement using Remote Desktop Protocol (Remote Desktop Protocol, T1021.001), ultimately deploying DragonForce ransomware across the entire network.

Notable Behaviour: - PsExec lateral movement (T1021.002)

Appendix C. MITRE ATT&CK ... (T1560.001) Archive via Utility

It is frequently delivered inside a password-protected archive pulled from the file-sharing service temp[.]sh... After establishing a backdoor admin on the victim's server, they pulled and executed a DragonForce ransomware binary (1.exe).

A ransomware attack against a hospital makes headlines, while attacks on the rest of the ecosystem around it tend to stay quiet despite doing damage that can be just as bad. | Flare researcher Assaf Morag analyzed ransomware leak-site activity tied to healthcare organizations in the EMEA region between 2024 and 2026, and found that ransomware groups are going after the entire healthcare supply chain.

Finally, the malware deletes the volume shadow copies. To do so, it uses a WQL query to enumerate the volume shadow copies present on the victim system and then passes a command to delete them...

Riot Games, which involved ransom demands to prevent source code leakage

Observed Tools Discovery RMM Tools Defense Evasion Credential Theft OffSec Networking LOLBAS Exfiltration SoftPerfect netscan Windows Defender Real-time Protection disabled PsExec (PSEXESVC.exe) RDP (External Remote Services)