DragonForce is a financially motivated ransomware operation that began in August 2023, initially leveraging leaked LockBit 3.0 code and later adopting Conti v3-based variants. It operates as a Ransomware-as-a-Service (RaaS) model, offering affiliates an 80% revenue share and management tools. By March 2025, it evolved into a cybercrime cartel providing white-label services. The group targets organizations primarily in the US and UK across sectors such as manufacturing, professional services, retail, healthcare, and technology. They recruit developers and reverse engineers and provide data analysis services to maximize extortion. A notable incident includes a major managed service provider (MSP) breach in May 2025 exploiting SimpleHelp vulnerabilities, leading to cascading compromises across client networks.
An intrusion was investigated that began with exploitation of CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM software. The threat actor obtained unauthorized technician access and deployed two previously undocumented malware samples: TaskWeaver and Djinn Stealer. TaskWeaver is a heavily obfuscated Node.js loader that establishes encrypted communications and delivers additional payloads. Djinn Stealer targets credentials across Windows, macOS, and Linux systems, collecting authentication data for cloud platforms, source control, package registries, AI development assistants, browsers, SSH keys, and cryptocurrency wallets. The attacker leveraged legitimate RMM capabilities to transfer files and execute commands across managed systems. Stolen AI assistant tokens provided extensive access to repositories, databases, and cloud accounts. The intrusion demonstrated how a single authentication bypass in trusted management infrastructure can enable widespread credential theft and p...
