Threat reportRansomwareTL-2026-4963
DragonForce Ransomware Claims Victim lyserp.com (ERP Software Provider)
DragonForce Ransomware Claims Victim lyserp.com (ERP (TL-2026-4963) is a high-severity ransomware operation, first published 2026-11-01. It is attributed to DragonForce (Malaysia) with medium confidence, affects lyserp.com ERP systems and automation (inventory, finance and, maps to 19 MITRE ATT&CK techniques (T1003.001, T1021.001, T1046), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1DragonForce
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-4963
- Threat ID
- TL-2026-4963
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- DragonForce
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Malaysia
- Motivation
- FINANCIAL
- Target sectors
- technology, manufacturing, supply-chain, logistics, finance
- Target regions
- Unknown
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in DragonForce Ransomware Claims Victim lyserp.com (ERP
Malware and tooling: Cobalt Strike, MimiKatz, SystemBC - S9001, AdFind - S0552, Cobalt Strike, LaZagne - S0349, Mimikatz
How DragonForce Ransomware Claims Victim lyserp.com (ERP works
ransomware.live lists lyserp.com, a vendor of ERP and automation software (inventory, finance, logistics, production, supply chain), as a DragonForce ransomware victim. It was discovered on 2026-10-30 with an estimated attack date of 2026-10-29, and HudsonRock infostealer telemetry shows 49 exposed passwords.
On 2026-10-30 at 10:43 UTC the ransomware tracker ransomware.live recorded lyserp.com (www.lyserp.com, mail.lyserp.com) as a victim posted by the DragonForce ransomware group. The estimated attack date is 2026-10-29. The victim is a technology company that supplies ERP systems and automation covering inventory management, finance and accounting, logistics, production management and supply chain. The listing carries a leak-site screenshot, which indicates that the operators published data or a proof-of-compromise on their public leak site. The listing does not state a country; WHOIS data referenced on the listing shows a Taiwan connection (foreignnet-chinese.com.tw), and this is unconfirmed. The listing does not state a CVE, an initial access vector, a ransom demand or the volume of data taken.
The listing includes HudsonRock infostealer telemetry queried on 2026-10-30: 1 compromised employee, 1 compromised user, 0 third-party employee credentials, 2 exposed attack-surface points, and 49 exposed passwords (2 rated critical). This shows that infostealer-harvested credentials existed for the victim's domain. The listing does not establish that they were used in this intrusion, so the telemetry is a correlate and not a confirmed access vector.
No victim-specific technical analysis (DFIR report, IOCs, TTPs) has been published. The tactics below are therefore DragonForce group-level behaviour documented by Group-IB, Trend Micro, Resecurity, Intel 471 and BleepingComputer, and they are not confirmed for this incident. DragonForce emerged in August 2023, initially using a leaked LockBit 3.0 builder. It launched an affiliate programme on the RAMP forum on 2024-06-26 (80% to affiliates, 20% to operators), then released a Conti v3-based encryptor in July 2024 and a Linux/ESXi variant in November 2024. It rebranded as a 'ransomware cartel' in 2025, and BleepingComputer links it to Scattered Spider-style social-engineering intrusions. Documented intrusion patterns include valid domain accounts against remote desktop servers, exploitation of public-facing applications (Ivanti Connect Secure, Log4j, SimpleHelp RMM CVEs), PowerShell-delivered Cobalt Strike, SystemBC persistence, Mimikatz/LaZagne credential theft, SoftPerfect Network Scanner and ADFind discovery, BYOVD EDR termination (TrueSight.sys, RentDrv.sys), exfiltration to MEGA/FTP/HTTP, shadow-copy deletion, event-log clearing and double extortion through a Tor leak site.
Because the victim sells ERP and supply-chain software, its customers may face downstream risk if source code, customer data, deployment credentials or remote-support access were taken. The listing does not state any customer impact. Defenders who run this vendor's software should review vendor communications, rotate credentials shared with the vendor, and audit vendor remote-access paths.
MITRE ATT&CK techniques used in TL-2026-4963
Credential Access
T1003.001 LSASS Memory; T1555 Credentials from Password Stores
Lateral Movement
T1021.001 Remote Desktop Protocol
Discovery
T1046 Network Service Discovery; T1087.002 Domain Account
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Privilege Escalation
T1134 Access Token Manipulation
Impact
T1490 Inhibit System Recovery; T1657 Financial Theft
Exfiltration
T1567.002 Exfiltration to Cloud Storage
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in DragonForce Ransomware Claims Victim lyserp.com (ERP
- lyserp.com — ERP systems and automation (inventory, finance and accounting, logistics, production management, supply chain)
Remediation for DragonForce Ransomware Claims Victim lyserp.com (ERP
Patches
- Patch SimpleHelp (CVE-2024-57726/57727/57728), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893) and Log4j2 (CVE-2021-44228) where present; these are DragonForce-associated CVEs from Trend Micro and are not confirmed for this victim
Immediate actions
- Customers of lyserp.com should request an incident statement from the vendor and review vendor remote-access, VPN and support-tool accounts
- Rotate credentials, API keys and service accounts shared with or issued to the ERP vendor
- Reset passwords for any accounts exposed in infostealer logs and enforce phishing-resistant MFA
- Hunt for DragonForce artefacts: *.dragonforce_encrypted files, README.txt ransom notes, C:\Users\Public\log.log, df.exe, mutex dragonforce_encrypted_system
- Block and alert on the documented DragonForce C2 IPs 185.73.125.8 and 94.232.46.202
Workarounds
- Disable or restrict internet-exposed RDP and VPN services without MFA
- Block outbound traffic to MEGA and unapproved file-sharing services from servers
Longer-term hardening
- Deploy EDR with tamper protection and block vulnerable drivers (TrueSight.sys, RentDrv.sys) via driver blocklists / WDAC
- Monitor for infostealer exposure of corporate domains and automate credential resets
- Restrict and log RMM tools (SimpleHelp, AnyDesk, ScreenConnect, TeamViewer, Splashtop, Atera) to an allow-list
- Keep offline, immutable backups and segment ESXi/vCenter management networks
- Apply third-party risk reviews to ERP and supply-chain software vendors
Timeline of DragonForce Ransomware Claims Victim lyserp.com (ERP
- DragonForce ransomware first identified in August 2023 (exact day not stated in sources), initially using a leaked LockBit 3.0 builder.
- DragonForce launches its RaaS affiliate programme on the RAMP forum (80% to affiliates, 20% to operators); by 2024-07-04 access is restricted to affiliates with pre-acquired access and exfiltrated data.
- Linux/ESXi variant of DragonForce confirmed in November 2024 (exact day not stated), alongside a Conti v3-based Windows encryptor released in July 2024.
- DragonForce declares itself a 'ransomware cartel' (March 2025, exact day not stated), offering white-label encryptors and infrastructure to other operators.
- DragonForce launches a 'data analysis service' for affiliates targeting organizations with more than $15M annual revenue (August 2025, exact day not stated).
- Estimated date of the DragonForce attack on lyserp.com per ransomware.live.
- ransomware.live discovers and lists lyserp.com as a DragonForce victim at 10:43 UTC, with a leak-site screenshot; HudsonRock data queried the same day shows 49 exposed passwords (2 critical).
Sources cited for DragonForce Ransomware Claims Victim lyserp.com (ERP
- ransomware.live victim entry: lyserp.com (Dragonforce)
- Group-IB: DragonForce Ransomware
- BleepingComputer: Deep dive into DragonForce ransomware and its Scattered Spider connection
- Trend Micro: Ransomware Spotlight - DragonForce
- Resecurity: DragonForce Ransomware Reverse Engineering Report
- Intel 471: DragonForce Ransomware
- AttackIQ: Emulating the Blazing DragonForce Ransomware
- CSIS Research: DragonForce Ransomware TTPs
Detection coverage for TL-2026-4963
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4963 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.