# DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References

> The DragonForce ransomware cartel posted RubberMill, Inc. (North Carolina-based ISO 9001:2015/WOSB/WBENC-certified contract manufacturer serving appliance, HVAC, automotive, and defense sectors) on their Tor-based leak site, claiming exfiltration of ~296,000 files totaling 340+ GB. The leaked data includes a 146 GB forensic disk image (.mrimg), employee PII with SSNs, tax forms, credit card data, 3000+ CAD files referencing defense Mil-Spec part numbers, corporate email archives (487 MB PST), credentials (AES passwords), C-TPAT and NAFTA compliance documentation, sales databases, and Conflict Minerals reports. Estimated attack date: 2026-08-15; leak posted: 2026-09-06.

- **Published:** 2026-09-06T00:00:00Z
- **Last reviewed:** 2026-09-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2364
- **ID:** TL-2026-2364
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DragonForce (Malaysia)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-44228, CVE-2023-46805, CVE-2024-21412, CVE-2024-21887, CVE-2024-21893, CVE-2025-0289

## Description

DragonForce is a prolific Ransomware-as-a-Service (RaaS) cartel that first emerged in August 2023 from Pro-Palestine hacktivist roots before pivoting to a financially motivated multi-extortion model. The group initially built payloads using the leaked LockBit 3.0 (Black) builder, then transitioned to a bespoke Conti V3-derived codebase by July 2024. DragonForce ransomware uses ChaCha8 symmetric encryption with per-file 32-byte keys and 8-byte nonces, wrapped in RSA-4096 asymmetric encryption. A 537-byte footer is appended to each encrypted file containing the RSA ciphertext, encryption mode flag, and original file size. The ransomware encrypts files with a .dragonforce_encrypted extension and drops readme.txt ransom notes.

The attack on RubberMill — a women-owned small business (WOSB), ISO 9001:2015-certified contract manufacturer in Liberty, North Carolina — reflects DragonForce affiliates' targeting of the US manufacturing and defense supply chain. RubberMill manufactures custom non-metallic components (molded rubber, die-cut gaskets, foam insulation, laminates) for OEMs across the appliance, HVAC, automotive, heavy equipment, and defense sectors. The company lists compliance with military specifications (Mil-Spec) and holds certifications including ISO 9001:2015, WBENC, and WOSB.

DragonForce affiliates achieve initial access through phishing campaigns, exploitation of known CVEs (including CVE-2021-44228 Log4Shell, CVE-2023-46805/CVE-2024-21887 Ivanti Connect Secure vulnerabilities, and CVE-2024-21412 SmartScreen bypass), credential stuffing against RDP services, and trusted relationship abuse — including leveraging leftover remote management software from prior hosting providers. Post-exploitation involves deploying Cobalt Strike beacons for C2 and lateral movement, SystemBC SOCKS5 backdoor for persistent proxy access, AnyDesk and SimpleHelp for remote interactive access, and the BYOVD technique using Truesight.sys, RentDrv.sys, and KslD.sys vulnerable drivers to terminate EDR/XDR processes via DeviceIoControl calls.

Data exfiltration is performed using a renamed copy of the open-source Restic backup tool (deployed as winupdate.exe) which uploads data to attacker-controlled AWS S3 buckets hosted on wasabisys.com. Exfiltration also occurs via MEGA cloud storage, SFTP, and WebDAV transfers to remote infrastructure. The exfiltration tool employs GoLang-based deduplicated encrypted transfer optimized for bulk data. FileSeek.exe is used to inventory target files before exfiltration. In more recent intrusions (December 2025), DragonForce affiliates have employed Backdoor.Turn — a backdoor that establishes persistence as the TeamsMediaRelay Windows service and communicates via QUIC protocol through Microsoft Teams TURN relay infrastructure to blend in with legitimate Microsoft 365 traffic.

The RubberMill data dump comprehensively spans the entire business: a full 146 GB disk image providing forensic-level system access, employee PII including SSNs and tax forms, credit card data running multiple records, corporate password stores (AES PASSWORDS.xlsx), a 487 MB Outlook PST email archive, a 38 MB sales database (.mdb), 3000+ CAD files in .dxf/.stp/.dwg formats with customer part numbers (7J314, K2A31, K7K11, V1324), C-TPAT and NAFTA compliance certifications, Conflict Minerals Reporting, a Supplier Quality Assurance Manual, and defense-relevant Mil-Spec documentation. The leak group characterizes the haul as containing 'a full cross-section of the business: from passwords and SSNs to automotive OEM drawings and military specifications.' No ransom demand amount was disclosed, but the posting on the dedicated leak site indicates that ransom negotiations failed or were refused.

DragonForce operates an extensive affiliate ecosystem (the 'Ransomware Cartel' model) offering infrastructure, malware, and support services including DDoS, spam campaigns, and cold-calling victim executives as 'pressure-as-a-service.' Affiliates retain up to 80% of ransom payments. The group launched a white-label RaaS service in early 2025 allowing affiliates to rebrand payloads, and operates multiple Tor leak sites including DragonLeaks and RansomBay. By May 2026, DragonForce ranked among the three most active ransomware groups globally, claiming 20.8 TB of data across 51 attacks in a single month. The group functions as a cartel with cooperation and shared infrastructure across multiple ransomware strains including LockBit, Qilin, and Conti.

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1543 Create or Modify System Process
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1574 Hijack Execution Flow
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1119 Automated Collection
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1095 Non-Application Layer Protocol
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1490 Inhibit System Recovery

## Sources

- [Ransomware.live — DragonForce / RubberMill Leak Posting](https://www.ransomware.live/id/cnViYmVybWlsbC5jb21AZHJhZ29uZm9yY2U=)
- [SentinelOne — DragonForce Ransomware: From Hacktivists to High-Street Extortionists](https://www.sentinelone.com/blog/dragonforce-ransomware-gang-from-hacktivists-to-high-street-extortionists/)
- [Darktrace — Tracking a Dragon: Investigating a DragonForce-Affiliated Ransomware Attack](https://www.darktrace.com/blog/tracking-a-dragon-investigating-a-dragonforce-affiliated-ransomware-attack-with-darktrace)
- [Symantec/Broadcom — Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays](https://www.broadcom.com/support/security-center/protection-bulletin/hidden-in-teams-dragonforce-attackers-weaponize-microsoft-teams-relays-to-stay-hidden)
- [LevelBlue SpiderLabs — The Godfather of Ransomware: Inside DragonForce's Cartel Ambitions](https://www.levelblue.com/blogs/spiderlabs-blog/the-godfather-of-ransomware-inside-dragonforces-cartel-ambitions)
- [Group-IB — DragonForce Ransomware Group Analysis](https://www.group-ib.com/blog/dragonforce-ransomware/)
- [Bitdefender — DragonForce: The Ransomware Cartel Guarding Its Burrow](https://businessinsights.bitdefender.com/dragonforce-ransomware-cartel)
- [BushidoUK — Ransomware-Tool-Matrix Community Report CR-021: DragonForce (April 2025)](https://github.com/BushidoUK/Ransomware-Tool-Matrix/blob/main/CommunityReports/CR-021-DRAGONFORCE-APR-2025.md)
- [AttackIQ — Emulating DragonForce Ransomware (May 2025)](https://www.attackiq.com/2025/05/23/emulating-dragonforce-ransomware/)
- [Quorum Cyber — DragonForce Ransomware Report (May 2025)](https://www.quorumcyber.com/wp-content/uploads/2025/05/QC-DragonForce-Ransomware-Report.pdf)
- [RubberMill Inc. — Company Profile and Certifications](https://www.rubbermill.com/)
- [Belgium CCB — DragonForce Threat Analysis](https://ccb.belgium.be/open-media/1275/download?inline=)
- [Rewterz — DragonForce Ransomware Active IOCs](https://rewterz.com/threat-advisory/dragonforce-ransomware-active-iocs-3)
- [Hybrid Analysis — Shuffling Greatest Hits: How DragonForce Leverages LockBit 3.0 and Conti V3](https://hybrid-analysis.blogspot.com/2025/05/shuffling-greatest-hits-how-dragonforce.html)
- [S2W Blog — Detailed Analysis of DragonForce Ransomware](https://medium.com/s2wblog/detailed-analysis-of-dragonforce-ransomware-25d1a91a4509)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2364