DragonForce doesn’t attack organizations one at a time. It finds the IT management software that sits above them all — and pulls a single lever. Understanding why RMM tools have become ransomware’s favorite front door is the first step to closing it.

There is a reason DragonForce has become one of the most consistently active ransomware operations of 2026. It is not that the group has developed novel malware or discovered exotic exploitation techniques. It is that its affiliates have internalized a simple arithmetic: compromising one managed service provider that runs an unpatched RMM platform does not yield one victim. It yields every downstream organization that MSP manages — potentially dozens or hundreds at once.

This is the RMM trust problem, and it is not theoretical. CISA has issued advisories about it. The FBI has tracked it. Sophos, Darktrace, and Field Effect have all documented real-world DragonForce intrusions that began with a vulnerable SimpleHelp instance and ended with encrypted files, exfiltrated data, and ransom demands across multiple organizations simultaneously. The attack surface is the trust relationship itself.

Threat at a Glance

The RMM trust model as an attack surface

Remote Monitoring and Management software is the connective tissue of the managed services industry. MSPs rely on tools like SimpleHelp, ConnectWise ScreenConnect, and Kaseya VSA to remotely access, patch, and troubleshoot client endpoints. When configured correctly, this gives a single technician the ability to reach into hundreds of customer environments from one console. When that console is compromised, an attacker inherits the same reach.

This is why RMM exploitation delivers a return on investment that endpoint-by-endpoint attacks cannot match. A threat actor who brute-forces their way into one corporate endpoint gains access to one organization. A threat actor who exploits a vulnerable SimpleHelp administrative console — serving an MSP with 200 client organizations — gains a potential deployment vector across all 200 simultaneously. The math is not subtle.

CISA has tracked this pattern explicitly. Its June 2025 advisory documented ransomware actors exploiting unpatched SimpleHelp instances to breach the customers of a utility billing software provider — a supply-chain pivot in which the direct victim was not the ultimate target. The same advisory noted the pattern had been active since at least January 2025, predating the formal KEV addition by over a year.

The SimpleHelp vulnerabilities

Three CVEs in SimpleHelp versions 5.5.7 and earlier form the exploitation chain DragonForce and related groups have been using. Each addresses a distinct layer of the attack surface.

CVE-2024-57727 is the entry point: a path traversal vulnerability that allows unauthenticated file download from the SimpleHelp server. An attacker does not need to authenticate to exploit it — they can extract sensitive configuration data, including credentials, from an exposed instance over the public internet. CISA added this CVE to the Known Exploited Vulnerabilities catalog in February 2026.

CVE-2024-57726 escalates that access. With a CVSS score of 9.9, it allows a low-privilege technician account to escalate to full administrative control. Once an attacker has harvested credentials via the path traversal flaw, this vulnerability converts limited access into platform ownership.

CVE-2024-57728 completes the chain. An administrator on a SimpleHelp instance can upload and execute arbitrary files on the server — enabling remote code execution on the MSP’s infrastructure, from which lateral movement into customer environments begins.

The Play ransomware group has separately been documented exploiting the same CVE-2024-57727 flaw — a detail in the joint CISA/FBI advisory that is worth noting. These vulnerabilities are not being used by a single group. They represent a shared resource in the ransomware ecosystem, exploited by multiple independent affiliates and operators because the attack geometry is simply too efficient to ignore.

DragonForce: the RaaS cartel model

DragonForce emerged in late 2023 and distinguished itself from earlier ransomware operations through its organizational model. Rather than operating as a closed group, it built a white-label affiliate platform: operators provide the ransomware payload, the data leak infrastructure, and payment negotiation services. Affiliates bring their own targets and initial access methods. DragonForce takes approximately 20% of ransom proceeds — a cut significantly lower than traditional RaaS models — and handles the operational infrastructure that most affiliates lack.

The encryptor itself has been built on leaked source code from LockBit 3.0 and Conti, customized to produce the .df_win file extension and drop readme.txt ransom notes to network-accessible paths. The group demonstrated its adaptability in 2025 by asserting operational control over infrastructure previously associated with RansomHub, absorbing affiliates from that operation as law enforcement pressure forced RansomHub offline.

In August 2025, DragonForce introduced what it internally markets as a “data analysis service” for affiliates. The service is designed to maximize extortion pressure: it generates materials including extortion call scripts, letters addressed to organizational leadership, and pseudo-legal risk assessments of the stolen data. Fees range from 0% to 23% of ransom payments and the service is specifically targeted at affiliates attacking organizations with annual revenue above $15 million. The existence of this tooling signals an operation that has professionalized not just its technical capabilities but its post-compromise pressure methodology.

Scattered Spider — the threat actor collective responsible for high-profile UK retail breaches in 2025 — has been documented as a DragonForce affiliate, using its payload in attacks against major retail chains in both the UK and the US. CISA updated its Scattered Spider advisory in July 2025 to reflect this operational convergence. The combination of Scattered Spider’s social engineering capabilities — including SIM swapping, help desk manipulation, and MFA bypass — with DragonForce’s backend infrastructure represents the high end of the affiliate threat model.

The attack chain: what it looks like in practice

Darktrace’s incident response team documented a DragonForce-affiliated attack against a manufacturing organization in August–September 2025. The timeline illustrates how the RMM entry vector progresses through to encryption and is worth examining in detail — not because of who was victimized, but because of what defenders could have caught at each stage.

Stage 1 — Initial access and first foothold

The exact initial access vector was not confirmed in the Darktrace case, which is consistent with DragonForce’s affiliate model: affiliates use whatever method fits the target. Across documented campaigns, the group’s entry points have included exploitation of the SimpleHelp CVE chain against exposed MSP infrastructure, RDP brute-forcing using credential stuffing against administrative accounts, phishing with social engineering lures, and exploitation of web-facing applications including CVE-2021-44228 (Log4Shell) and CVE-2023-46805 (Ivanti ICS).

In the Darktrace manufacturing incident, suspicious login activity appeared involving three different source IP addresses using valid domain credentials — a pattern consistent with compromised credentials obtained through prior reconnaissance or purchasing access from an initial access broker. The accounts were used to establish authenticated RDP sessions on a public-facing server.

Stage 2 — Establishing persistence

Following initial access, the compromised device performed suspicious Windows Registry operations using BaseRegOpenKey and BaseRegQueryValue calls across two key paths. The first — SYSTEM\CurrentControlSet\Control\WMI\Security — allows modification of WMI access controls, enabling covert command execution without triggering standard process monitoring. The second — Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks — stores GUIDs for scheduled tasks, the manipulation of which allows persistent execution of attacker-controlled code at defined intervals.

This is the stage where defenders most consistently have an opportunity to intervene. Registry modifications of this nature are detectable through Windows Event Log monitoring (Event IDs 4656, 4663) and Sysmon (Event ID 13). The operational window between persistence establishment and lateral movement in the documented incident was several days — a gap that aggressive detection would have closed.

Stage 3 — Reconnaissance and lateral movement

With persistence established, the actor conducted internal network scanning using the OpenVAS vulnerability scanner — identifiable through the HTTP user agent string OpenVAS-VT appearing in internal traffic logs. Brute-force attempts targeted administrative credentials including administrator, Admin, rdpadmin, and ftpadmin across the environment. A file named delete.me was deleted across multiple devices via SMB — a behavioral artifact associated with the NetScan network scanning tool.

The reconnaissance phase concluded with successful Kerberos authentication using the administrator credential — the first time that account had authenticated in the environment. This single event represents one of the highest-signal detection opportunities in the entire chain: first-time use of a privileged credential is anomalous by definition and should trigger immediate investigation in any SIEM with baseline behavioral modeling.

Stage 4 — Data exfiltration

Prior to deploying the encryptor — consistent with the double extortion model — multiple infected devices transferred data to the external IP 45.135.232[.]229 via SSH over port 22. The endpoint is geolocated to Russia and registered to a bulletproof hosting provider with a documented history of malicious activity.

Stage 5 — Encryption

Eight days after the initial compromise activity, the actor returned and began the encryption phase. Multiple devices connected to internal hosts via SMB and performed Move, Write, and ReadWrite operations on files, appending the .df_win extension. Simultaneously, readme.txt ransom notes were written to network-accessible web root paths. Darktrace’s Cyber AI Analyst detected and correlated the activity autonomously, but because the customer had not enabled Autonomous Response, the encryption ran to completion.

What defenders can detect — and when

One of the most important signals in the documented attack chain is temporal. The initial compromise, persistence establishment, and reconnaissance phase occurred across a window of several days before the encryption payload was deployed. That gap is not unusual for human-operated ransomware — DragonForce affiliates are not automated tools but deliberate operators who move methodically. It is also a detection opportunity that many organizations consistently fail to use.

MITRE ATT&CK coverage

Defender guidance

The priority action is unambiguous: if your organization uses SimpleHelp, patch it. Versions 5.5.7 and earlier are actively exploited. The fix has been available since early 2025 and the CVEs have been in CISA’s KEV catalog since February. Every day an unpatched instance is internet-accessible is a day a DragonForce affiliate could be using it as their starting point.

Beyond the immediate patch, the broader lesson from the RMM exploitation pattern is that MSP relationships require the same security scrutiny as direct vendor access. If a third party has remote management access to your environment, their security posture is effectively your security posture.

The bigger picture: RaaS has professionalized extortion

DragonForce’s introduction of its “data analysis service” — the tooling that generates extortion call scripts and pseudo-legal pressure documents for affiliates — signals something about the maturity arc of the ransomware ecosystem. The technical barriers to deploying ransomware have been falling for years: leaked builders, shared infrastructure, RaaS platforms. What DragonForce’s extortion service represents is the commoditization of the post-encryption pressure phase. Affiliates no longer need expertise in negotiation, victim psychology, or legal language to maximize payment pressure. That capability is now a purchasable add-on.

The implication for defenders extends beyond technical controls. Organizations need incident response playbooks that account for structured, professional extortion pressure — including the reality that double extortion means the decision to pay is no longer purely about restoring access to encrypted files. It is about whether the stolen data appears on a leak site, and whether the organization can tolerate that outcome. Those are governance and legal questions, not technical ones, and they need answers before the ransom note appears in readme.txt.

What remains true — and what the documented attack chains confirm — is that DragonForce and its affiliates are not finding novel ways into environments. They are walking through doors that organizations have left open. Unpatched RMM software with a publicly documented CVE chain, first-time privileged credential use going undetected for days, outbound SSH to bulletproof hosting ignored: each of these represents a gap that closes with existing controls properly configured. The attack is sophisticated. The defense is not.

References

1. CISA / FBI / MS-ISAC Advisory AA25-163A — Ransomware Actors Exploit Unpatched SimpleHelp RMM to Compromise Utility Billing Software Provider cisa.gov ↗
2. Darktrace / Inside the SOC Tracking a Dragon: Investigating a DragonForce-Affiliated Ransomware Attack — Manufacturing Sector Case Study darktrace.com ↗
3. Sophos DragonForce Actors Target SimpleHelp Vulnerabilities to Attack MSP and Customers — Sophos MDR Incident Report, May 2025 news.sophos.com ↗
4. Trend Micro Ransomware Spotlight: DragonForce — Including “Data Analysis Service” for Affiliates (Aug 2025) trendmicro.com ↗
5. CISA / FBI Updated Advisory on Scattered Spider (AA23-320A) — Including DragonForce Affiliate Collaboration, Jul 2025 cisa.gov ↗
6. Group-IB DFIR DragonForce Ransomware: Initial Access via Public-Facing RDP, Cobalt Strike Deployment, and Full Kill Chain Analysis group-ib.com ↗
7. Bitdefender Ransomware Attacks Against the US: Q1 2026 Insights — DragonForce Among Top 10 Persistent Groups bitdefender.com ↗