DragonForce is a fast-growing ransomware group, first observed in March 2023, that deploys ransomware using the ransomware-as-a-service (RaaS) business model.
This post explores the TTPs employed by the group who were observed deploying DragonForce ransomware during a recent incident response engagement.
In summary, CSIS identified the following key TTPs:
The threat actor gained access to the network by exploiting a remote management software installed by a previous hosting company. When the target organisation switched providers, they failed to remove the administration tools by the previous hosting provider. These tools were then utilised by the threat actor to reset a domain administrator password, this account was then used for remote access via the administrator tools.
Windows PowerShell was used to move the file “winupdate.exe” (data exfiltration software) to C:\windows\system32\ folder and execute it afterwards.
The threat actor installed the remote access tool AnyDesk to maintain persistence.
The threat actor used the software FileSeek[1] to create a file of files to exfiltrate.
The threat actor successfully exfiltrated data from the network using a custom tool named winupdate.exe, which is written in GoLang based on the Restic library.
DragonForce‘s main objective is the exfiltration of sensitive data as well as encryption, commonly referred to as double extortion.
|
Indicator of compromise |
Indicator type |
Description |
|
C:\Users\Public\Documents\Winupdate.exe |
File Name |
Exfiltration tool |
|
C:\Windows\system32\Winupdate.exe |
File Name |
Exfiltration tool |
|
FileSeek.exe |
File Name |
File discovery tool |
|
C:\Users\Public\Documents\new.txt |
File Name |
File list to exfiltrate |
|
Tactic |
Technique |
IT |
Description |
|
Initial Access |
Trusted Relationship |
T1199 |
Initial access was via remote administration tools left on the system from a previous supplier. |
|
Execution |
Command and Scripting Interpreter: PowerShell |
T1059.001 |
Threat actor utilised PowerShell to execute malicious commands. |
|
Persistence |
Create or Modify System Process: Windows Service |
T1543.003 |
Threat actor installed remote desktop software tools as services for persistence |
|
Discovery |
T1083 |
File and Directory Discovery |
FileSeek was used for file discovery. |
|
Exfiltration |
T1657 |
Data exfiltration for Impact |
The threat actor used a custom tool for exfiltration. |
|
Impact |
T1486 |
Data Encrypted for Impact |
DragonForce Ransomware was deployed. |
[1] https://www.fileseek.ca/Download/