DragonForce Ransomware

The Scattered Spider case provides a practical example of the evolution of the cartel model. In multiple high-profile incidents ... intrusion activity attributed to Scattered Spider, characterized by advanced social engineering, helpdesk impersonation, and credential compromise, was followed by the deployment of DragonForce ransomware.

“Valid accounts, exploitation of external remote services, drive-by compromise, vulnerability exploitation, social engineering (MITRE ATT&CK: T1078, T1133, T1189, T1190, T1566)” and “gain persistence… by abusing valid accounts”

“gained initial access via public-facing remote desktop servers…” and “External Remote Services (MITRE ATT&CK: T1133)”

“drive-by compromise… (MITRE ATT&CK… T1189)”

DragonForce’s partnership with such actors is likely driven by Scattered Spider’s known strong capabilities in vishing and social engineering, which enable reliable initial access into targeted organizations, complementing DragonForce’s focus on the downstream stages of the attack lifecycle.

“Scheduled tasks… (MITRE ATT&CK: T1053…)” and “gain persistence… creating… scheduled tasks”

“powershell.exe -windowstyle hidden -Command & ‘path_to_executable_file’” and “T1059… .001: PowerShell”

“cmd.exe /c … WMIC.exe shadowcopy … delete” and “T1059… .003: Windows Command Shell”

Sophos MDR was first alerted when suspicious SimpleHelp installer files were detected being pushed through the legitimate RMM platform.

CVE-2024-57728 permits authenticated administrators to upload malicious files anywhere on the system, potentially leading to remote code execution.

MITRE ATT&CK® Techniques ... Execution T1204.002 (User Execution) Malicious file.

“Scheduled tasks… (MITRE ATT&CK: T1053…)” and “gain persistence… creating… scheduled tasks”

“Valid accounts, exploitation of external remote services, drive-by compromise, vulnerability exploitation, social engineering (MITRE ATT&CK: T1078, T1133, T1189, T1190, T1566)” and “gain persistence… by abusing valid accounts”

“gained initial access via public-facing remote desktop servers…” and “External Remote Services (MITRE ATT&CK: T1133)”

“creating new system processes” and “T1543… .003: Windows Service”

“Scheduled tasks… (MITRE ATT&CK: T1053…)” and “gain persistence… creating… scheduled tasks”

Sophos MDR investigators believe the attackers exploited a chain of three critical vulnerabilities disclosed in January 2025: CVE-2024-57727 (multiple path traversal vulnerabilities), CVE-2024-57728 (arbitrary file upload vulnerability), and CVE-2024-57726 (privilege escalation vulnerability).

“Valid accounts, exploitation of external remote services, drive-by compromise, vulnerability exploitation, social engineering (MITRE ATT&CK: T1078, T1133, T1189, T1190, T1566)” and “gain persistence… by abusing valid accounts”

“Privilege Escalation… DuplicateTokenEx(); CreateProcessWithTokenW()” and “T1134: Access Token Manipulation”

“creating new system processes” and “T1543… .003: Windows Service”

CVE-2024-57727 allows unauthenticated attackers to download arbitrary files from SimpleHelp hosts, including server configuration files containing secrets and hashed passwords.

“ADVobfuscator… obfuscate code and data” and “T1027… .002: Software Packing”

“T1070… .001: Clear Windows Event Logs”

Defense evasion techniques include termination of security processes, deletion of backups and shadow copies, and execution in background or detached modes to reduce visibility.

“Valid accounts, exploitation of external remote services, drive-by compromise, vulnerability exploitation, social engineering (MITRE ATT&CK: T1078, T1133, T1189, T1190, T1566)” and “gain persistence… by abusing valid accounts”

“Privilege Escalation… DuplicateTokenEx(); CreateProcessWithTokenW()” and “T1134: Access Token Manipulation”

“powershell.exe -windowstyle hidden -Command …” and “T1564… .003: Hidden Window”

The attacker also used their access through the MSP’s RMM instance to gather information on multiple customer estates managed by the MSP, including collecting device names and configuration, users, and network connections

The attacker also used their access through the MSP’s RMM instance to gather information on multiple customer estates managed by the MSP, including collecting device names and configuration

MITRE ATT&CK® Techniques ... Discovery T1083 (File and Directory Discovery) Ransomware enumerates folders for file encryption and file deletion.

The attacker also used their access through the MSP’s RMM instance to gather information on multiple customer estates managed by the MSP, including collecting device names and configuration, users, and network connections

The attack represents a significant supply chain compromise, where hackers gained access to an MSP’s SimpleHelp RMM platform and used it as a launching pad to target the provider’s downstream customers.

Sophos MDR was first alerted when suspicious SimpleHelp installer files were detected being pushed through the legitimate RMM platform.

Following access acquisition, affiliates leverage credential abuse techniques, likely including NTLM and Kerberos-based mechanisms to perform privilege escalation and lateral movement within Active Directory environments, enabling efficient propagation across enterprise networks.

Attackers were observed deploying DragonForce ransomware against a major U.S. services firm, hiding command-and-control (C2) traffic inside Microsoft Teams’ own relay infrastructure using a new custom Go-based backdoor called Backdoor.Turn.

After completing reconnaissance and evading defense, the attacker exfiltrated all data, deployed DragonForce ransomware, and encrypted the victim’s systems.

the attackers stole confidential files and encrypted systems using DragonForce ransomware.

The group operates a structured and scalable affiliate model, combining encryption with data exfiltration and publication on a dedicated data leak site (DLS).

the attackers stole confidential files and encrypted systems using DragonForce ransomware.

“kills running processes” and “T1489: Service Stop”

Defense evasion techniques include termination of security processes, deletion of backups and shadow copies, and execution in background or detached modes to reduce visibility.

Windows argument “-wall Changes system Wallpaper…” and “T1491… .001: Internal Defacement”

“T1657: Financial Theft” and the broader extortion/ransom model described

Defense evasion techniques include termination of security processes, deletion of backups and shadow copies, and execution in background or detached modes to reduce visibility.

MITRE ATT&CK® Techniques ... Defense Evasion T1562.001 (Impair Defenses: Disable or Modify Tools) Ransomware disables Windows Defender.