DragonForce Ransomware

The Scattered Spider case provides a practical example of the evolution of the cartel model. In multiple high-profile incidents ... intrusion activity attributed to Scattered Spider, characterized by advanced social engineering, helpdesk impersonation, and credential compromise, was followed by the deployment of DragonForce ransomware.

DragonForce’s partnership with such actors is likely driven by Scattered Spider’s known strong capabilities in vishing and social engineering, which enable reliable initial access into targeted organizations, complementing DragonForce’s focus on the downstream stages of the attack lifecycle.

Sophos MDR was first alerted when suspicious SimpleHelp installer files were detected being pushed through the legitimate RMM platform.

CVE-2024-57728 permits authenticated administrators to upload malicious files anywhere on the system, potentially leading to remote code execution.

DragonForce’s affiliate panel no longer exposes the vulnerable driver selection option related to BYOVD (Bring Your Own Vulnerable Driver) techniques ... However, analysis of the generated ransomware binaries shows that the BYOVD-based process termination functionality remains integrated into the binary and continues to operate as part of the default implementation.

CVE-2024-57727 allows unauthenticated attackers to download arbitrary files from SimpleHelp hosts, including server configuration files containing secrets and hashed passwords.

the ransomware compresses some data using the Zlib module and decompresses this specific data during runtime... it conceals some data within the binary inside the overlay

During the ransomware’s initial execution, the ransomware uses dynamic API resolution to conceal malware characteristics and functionalities.

DragonForce ransomware exists in versions for Windows and Linux (ESXi, NAS, RHEL).

DragonForce incorporates several defense evasion techniques, including anti-forensics parameters like kill_defender , delete_eventlogs , and self_destruct

Defense evasion techniques include termination of security processes, deletion of backups and shadow copies, and execution in background or detached modes to reduce visibility.

The ESXi version additionally implements virtual machine shutdown handling and collects ESXi environment and user information.

it calls OpenProcessToken and GetTokenInformation to extract the security details about the running process. Additionally, it calls LookupAccountSidW to resolve the account name associated with the SID

The attacker also used their access through the MSP’s RMM instance to gather information on multiple customer estates managed by the MSP, including collecting device names and configuration, users, and network connections

After the ransomware configures the kill processes list, it looks for processes that are running on the victim’s system and compares them to the list.

The ransomware might determine whether it is executing under a privileged user... used to extract information about privilege levels, user group details, or integrity levels.

The ESXi version additionally implements virtual machine shutdown handling and collects ESXi environment and user information.

Upon execution, it parses command-line arguments and runs as a background daemon when invoked with the “-d” option. It then performs logging, delayed execution, and system information collection before initiating file encryption.

The attacker also used their access through the MSP’s RMM instance to gather information on multiple customer estates managed by the MSP, including collecting device names and configuration, users, and network connections

The ransomware scans the victim’s system for logical drives using GetLogicalDriveStringsW .

The ransomware appears to be conducting reconnaissance on network shares... The ransomware employs the NetShareEnum function to facilitate lateral movement, expanding its encryption capabilities to network shares

The ESXi version additionally implements virtual machine shutdown handling and collects ESXi environment and user information.

The ransomware employs the NetShareEnum function to facilitate lateral movement, expanding its encryption capabilities to network shares and NetBIOS.

Sophos MDR was first alerted when suspicious SimpleHelp installer files were detected being pushed through the legitimate RMM platform.

Following access acquisition, affiliates leverage credential abuse techniques, likely including NTLM and Kerberos-based mechanisms to perform privilege escalation and lateral movement within Active Directory environments, enabling efficient propagation across enterprise networks.

The cybercriminals used a Go-based Remote Access Trojan (RAT) to abuse Microsoft Teams' TURN relay servers and mask command-and-control traffic.

the attackers were able to deploy DragonForce ransomware to exfiltrate data and encrypt the victim machines

the attackers stole confidential files and encrypted systems using DragonForce ransomware.

The group operates a structured and scalable affiliate model, combining encryption with data exfiltration and publication on a dedicated data leak site (DLS).

DragonForce employs double extortion tactics to exert maximum pressure on its victims. The ransom note is carefully structured, threatening both the encryption of data and public exposure... In addition, the ransomware encrypts the victim’s files using the symmetric ChaCha20 encryption method

It uses OpenProcess to access the notepad.exe process and then terminates it using TerminateProcess .

The string SELECT * FROM Win32_ShadowCopy shows that the ransomware is using WMI to query Volume Shadow Copies, which disables the victim’s ability to restore backups.

DragonForce employs double extortion tactics... threatening both the encryption of data and public exposure, stating that stolen files will be leaked if the ransom is not paid.

DragonForce incorporates several defense evasion techniques, including anti-forensics parameters like kill_defender

samples generated through the panel’s builder maintained identical core functions, including the encryption routine and process termination via the BYOVD (Bring Your Own Vulnerable Driver) technique.