Threat reportRansomwareTL-2026-2364
DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References
DragonForce Ransomware Attack on RubberMill, Inc. (TL-2026-2364), also tracked as DragonForce RaaS, is a critical-severity ransomware operation, first published 2026-09-06. It is attributed to DragonForce (Malaysia) with medium confidence, affects RubberMill Inc. Corporate IT Infrastructure — Windows Domain, File, references 6 CVEs (CVE-2021-44228, CVE-2023-46805, CVE-2024-21412), maps to 25 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 25MITRE ATT&CK
- Actors
- 1DragonForce
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-2364
- Threat ID
- TL-2026-2364
- Also known as
- DragonForce RaaS, DragonLeaks, RansomBay
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- DragonForce
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Malaysia
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, defense-industrial-base, automotive, aerospace, heavy-equipment
- Target regions
- North America, united states of america
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in DragonForce Ransomware Attack on RubberMill, Inc.
Malware and tooling: AnyDesk, Cobalt Strike, INC, SystemBC - S9001, ransombay, Cobalt Strike, SimpleHelp
How DragonForce Ransomware Attack on RubberMill, Inc. works
The DragonForce ransomware cartel posted RubberMill, Inc. (North Carolina-based ISO 9001:2015/WOSB/WBENC-certified contract manufacturer serving appliance, HVAC, automotive, and defense sectors) on their Tor-based leak site, claiming exfiltration of ~296,000 files totaling 340+ GB. The leaked data includes a 146 GB forensic disk image (.mrimg), employee PII with SSNs, tax forms, credit card data, 3000+ CAD files referencing defense Mil-Spec part numbers, corporate email archives (487 MB PST), credentials (AES passwords), C-TPAT and NAFTA compliance documentation, sales databases, and Conflict Minerals reports. Estimated attack date: 2026-08-15; leak posted: 2026-09-06.
DragonForce is a prolific Ransomware-as-a-Service (RaaS) cartel that first emerged in August 2023 from Pro-Palestine hacktivist roots before pivoting to a financially motivated multi-extortion model. The group initially built payloads using the leaked LockBit 3.0 (Black) builder, then transitioned to a bespoke Conti V3-derived codebase by July 2024. DragonForce ransomware uses ChaCha8 symmetric encryption with per-file 32-byte keys and 8-byte nonces, wrapped in RSA-4096 asymmetric encryption. A 537-byte footer is appended to each encrypted file containing the RSA ciphertext, encryption mode flag, and original file size. The ransomware encrypts files with a .dragonforce_encrypted extension and drops readme.txt ransom notes.
The attack on RubberMill — a women-owned small business (WOSB), ISO 9001:2015-certified contract manufacturer in Liberty, North Carolina — reflects DragonForce affiliates' targeting of the US manufacturing and defense supply chain. RubberMill manufactures custom non-metallic components (molded rubber, die-cut gaskets, foam insulation, laminates) for OEMs across the appliance, HVAC, automotive, heavy equipment, and defense sectors. The company lists compliance with military specifications (Mil-Spec) and holds certifications including ISO 9001:2015, WBENC, and WOSB.
DragonForce affiliates achieve initial access through phishing campaigns, exploitation of known CVEs (including CVE-2021-44228 Log4Shell, CVE-2023-46805/CVE-2024-21887 Ivanti Connect Secure vulnerabilities, and CVE-2024-21412 SmartScreen bypass), credential stuffing against RDP services, and trusted relationship abuse — including leveraging leftover remote management software from prior hosting providers. Post-exploitation involves deploying Cobalt Strike beacons for C2 and lateral movement, SystemBC SOCKS5 backdoor for persistent proxy access, AnyDesk and SimpleHelp for remote interactive access, and the BYOVD technique using Truesight.sys, RentDrv.sys, and KslD.sys vulnerable drivers to terminate EDR/XDR processes via DeviceIoControl calls.
Data exfiltration is performed using a renamed copy of the open-source Restic backup tool (deployed as winupdate.exe) which uploads data to attacker-controlled AWS S3 buckets hosted on wasabisys.com. Exfiltration also occurs via MEGA cloud storage, SFTP, and WebDAV transfers to remote infrastructure. The exfiltration tool employs GoLang-based deduplicated encrypted transfer optimized for bulk data. FileSeek.exe is used to inventory target files before exfiltration. In more recent intrusions (December 2025), DragonForce affiliates have employed Backdoor.Turn — a backdoor that establishes persistence as the TeamsMediaRelay Windows service and communicates via QUIC protocol through Microsoft Teams TURN relay infrastructure to blend in with legitimate Microsoft 365 traffic.
The RubberMill data dump comprehensively spans the entire business: a full 146 GB disk image providing forensic-level system access, employee PII including SSNs and tax forms, credit card data running multiple records, corporate password stores (AES PASSWORDS.xlsx), a 487 MB Outlook PST email archive, a 38 MB sales database (.mdb), 3000+ CAD files in .dxf/.stp/.dwg formats with customer part numbers (7J314, K2A31, K7K11, V1324), C-TPAT and NAFTA compliance certifications, Conflict Minerals Reporting, a Supplier Quality Assurance Manual, and defense-relevant Mil-Spec documentation. The leak group characterizes the haul as containing 'a full cross-section of the business: from passwords and SSNs to automotive OEM drawings and military specifications.' No ransom demand amount was disclosed, but the posting on the dedicated leak site indicates that ransom negotiations failed or were refused.
DragonForce operates an extensive affiliate ecosystem (the 'Ransomware Cartel' model) offering infrastructure, malware, and support services including DDoS, spam campaigns, and cold-calling victim executives as 'pressure-as-a-service.' Affiliates retain up to 80% of ransom payments. The group launched a white-label RaaS service in early 2025 allowing affiliates to rebrand payloads, and operates multiple Tor leak sites including DragonLeaks and RansomBay. By May 2026, DragonForce ranked among the three most active ransomware groups globally, claiming 20.8 TB of data across 51 attacks in a single month. The group functions as a cartel with cooperation and shared infrastructure across multiple ransomware strains including LockBit, Qilin, and Conti.
MITRE ATT&CK techniques used in TL-2026-2364
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores
Collection
T1005 Data from Local System; T1119 Automated Collection
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1135 Network Share Discovery
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Defense Evasion
T1055 Process Injection; T1574 Hijack Execution Flow
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566 Phishing
Impact
Persistence
T1543 Create or Modify System Process
defense-impairment
Affected products and versions in DragonForce Ransomware Attack on RubberMill, Inc.
- RubberMill Inc. — Corporate IT Infrastructure — Windows Domain, File Servers, Email, CAD Systems
- RubberMill Inc. — Manufacturing Engineering Systems — CAD Workstations
- Microsoft — Exchange / Outlook Email (487 MB PST exfiltrated)
Remediation for DragonForce Ransomware Attack on RubberMill, Inc.
Patches
- Patch all internet-facing systems against CVEs exploited by DragonForce affiliates: CVE-2021-44228 (Log4Shell), CVE-2023-46805/CVE-2024-21887/CVE-2024-21893 (Ivanti Connect Secure), CVE-2024-21412 (Windows SmartScreen bypass), CVE-2025-0289
- Ensure Windows Defender and EDR solutions are fully updated with latest signatures
- Update RMM tools and remote access software to latest versions
Immediate actions
- Isolate affected systems from the network immediately to prevent ransomware spread
- Disable SMBv1 and restrict SMB access to only required systems
- Block known DragonForce C2 domains and IP addresses at perimeter firewalls
- Reset all credentials including domain admin, service accounts, and local admin passwords
- Enable multi-factor authentication on all remote access (VPN, RDP, webmail)
- Engage incident response team and preserve forensic evidence including disk images and memory captures
- Notify law enforcement (FBI IC3, CISA) and legal counsel regarding PII/credit card data breach
Workarounds
- Disable unnecessary RDP exposure to the internet
- Restrict PowerShell execution policy and enable script block logging
- Block execution of unsigned binaries in C:\PerfLogs\ and C:\Users\Public\Documents\
- Monitor for unexpected Windows services named TeamsMediaRelay (Backdoor.Turn indicator)
- Restrict outbound SMB traffic (TCP/445) to approved subnets only
- Enable unified audit logging on domain controllers and critical servers
Longer-term hardening
- Deploy EDR/XDR with behavioral detection for BYOVD driver loading, anomalous process termination (DeviceIoControl calls to vulnerable drivers), and unusual Restic/winupdate.exe execution
- Implement network segmentation isolating manufacturing/OT networks from corporate IT
- Deploy immutable off-site backups with 3-2-1 strategy and regular restore testing
- Establish application allowlisting to prevent unauthorized executables (winupdate.exe, renamed Restic)
- Implement driver blocklist for known vulnerable signed drivers (Truesight.sys, RentDrv.sys, KslD.sys, GameDriverx64.sys, K7RKScan.sys)
- Deploy UEBA solutions to detect anomalous data exfiltration volumes
- Establish threat intelligence ingestion for DragonForce C2 infrastructure updates
CVEs associated with DragonForce Ransomware Attack on RubberMill, Inc.
CVE-2021-44228, CVE-2023-46805, CVE-2024-21412, CVE-2024-21887, CVE-2024-21893, CVE-2025-0289
Timeline of DragonForce Ransomware Attack on RubberMill, Inc.
- DragonForce ransomware group first emerges, initially operating out of Malaysia with Pro-Palestine hacktivist roots before pivoting to financially motivated operations
- DragonForce transitions from LockBit 3.0/Black builder to bespoke Conti V3-derived codebase, introducing ChaCha8 encryption and BYOVD capability via Truesight.sys/RentDrv.sys
- DragonForce launches white-label RaaS service and RansomBay dedicated leak site, expanding affiliate ecosystem with 'pressure-as-a-service' offerings including DDoS, spam campaigns, and cold-calling victim executives
- Ransom notes (readme.txt) dropped on affected systems demanding payment; negotiation window opens through DragonForce Tox ID and Session ID contacts
- Ransomware encryptor (df.exe from C:\PerfLogs\) deployed across network; BYOVD driver (KslD.sys) loaded to terminate EDR/XDR processes; Volume Shadow Copies deleted via vssadmin.exe; Windows Event Logs cleared
- Exfiltration begins using renamed Restic backup tool (winupdate.exe) uploading ~340GB of data to attacker-controlled AWS S3 buckets on wasabisys.com; data includes 146GB disk image, 487MB PST email archive, 38MB sales database, 3,000+ CAD files, and employee PII with SSNs
- AnyDesk installed for persistent remote access; SystemBC backdoor deployed for SOCKS5 proxy C2; Cobalt Strike beacon established on domain controllers for lateral movement
- DragonForce affiliates deploy Mimikatz for LSASS credential dumping and access Veeam backup credentials via Get-VeeamCreds.ps1; extract AES PASSWORDS.xlsx and APWDxx credential stores from file servers
- Estimated date of DragonForce ransomware attack on RubberMill, Inc. — initial access (phishing, RDP credential stuffing, or exploited CVE) leading to Cobalt Strike deployment, SystemBC backdoor installation, and network reconnaissance
- DragonForce posts RubberMill data on DragonLeaks Tor leak site after ransom negotiations fail or are refused; full data dump of ~296K files / 340+ GB published including PII (SSNs, tax forms, employee records), credit card data, credentials, defense Mil-Spec CAD files, C-TPAT/NAFTA documentation, and sales databases
Sources cited for DragonForce Ransomware Attack on RubberMill, Inc.
- Ransomware.live — DragonForce / RubberMill Leak Posting
- SentinelOne — DragonForce Ransomware: From Hacktivists to High-Street Extortionists
- Darktrace — Tracking a Dragon: Investigating a DragonForce-Affiliated Ransomware Attack
- Symantec/Broadcom — Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays
- LevelBlue SpiderLabs — The Godfather of Ransomware: Inside DragonForce's Cartel Ambitions
- Group-IB — DragonForce Ransomware Group Analysis
- Bitdefender — DragonForce: The Ransomware Cartel Guarding Its Burrow
- BushidoUK — Ransomware-Tool-Matrix Community Report CR-021: DragonForce (April 2025)
- AttackIQ — Emulating DragonForce Ransomware (May 2025)
- Quorum Cyber — DragonForce Ransomware Report (May 2025)
- RubberMill Inc. — Company Profile and Certifications
- Belgium CCB — DragonForce Threat Analysis
- Rewterz — DragonForce Ransomware Active IOCs
- Hybrid Analysis — Shuffling Greatest Hits: How DragonForce Leverages LockBit 3.0 and Conti V3
- S2W Blog — Detailed Analysis of DragonForce Ransomware
Detection coverage for TL-2026-2364
As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2364 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2364
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.