# DragonForce Ransomware Claims Victim lyserp.com (ERP Software Provider)

> ransomware.live lists lyserp.com, a vendor of ERP and automation software (inventory, finance, logistics, production, supply chain), as a DragonForce ransomware victim. It was discovered on 2026-10-30 with an estimated attack date of 2026-10-29, and HudsonRock infostealer telemetry shows 49 exposed passwords.

- **Published:** 2026-11-01T05:15:44Z
- **Last reviewed:** 2026-11-01T05:15:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4963
- **ID:** TL-2026-4963
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DragonForce (Malaysia)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-30 at 10:43 UTC the ransomware tracker ransomware.live recorded lyserp.com (www.lyserp.com, mail.lyserp.com) as a victim posted by the DragonForce ransomware group. The estimated attack date is 2026-10-29. The victim is a technology company that supplies ERP systems and automation covering inventory management, finance and accounting, logistics, production management and supply chain. The listing carries a leak-site screenshot, which indicates that the operators published data or a proof-of-compromise on their public leak site. The listing does not state a country; WHOIS data referenced on the listing shows a Taiwan connection (foreignnet-chinese.com.tw), and this is unconfirmed. The listing does not state a CVE, an initial access vector, a ransom demand or the volume of data taken.

The listing includes HudsonRock infostealer telemetry queried on 2026-10-30: 1 compromised employee, 1 compromised user, 0 third-party employee credentials, 2 exposed attack-surface points, and 49 exposed passwords (2 rated critical). This shows that infostealer-harvested credentials existed for the victim's domain. The listing does not establish that they were used in this intrusion, so the telemetry is a correlate and not a confirmed access vector.

No victim-specific technical analysis (DFIR report, IOCs, TTPs) has been published. The tactics below are therefore DragonForce group-level behaviour documented by Group-IB, Trend Micro, Resecurity, Intel 471 and BleepingComputer, and they are not confirmed for this incident. DragonForce emerged in August 2023, initially using a leaked LockBit 3.0 builder. It launched an affiliate programme on the RAMP forum on 2024-06-26 (80% to affiliates, 20% to operators), then released a Conti v3-based encryptor in July 2024 and a Linux/ESXi variant in November 2024. It rebranded as a 'ransomware cartel' in 2025, and BleepingComputer links it to Scattered Spider-style social-engineering intrusions. Documented intrusion patterns include valid domain accounts against remote desktop servers, exploitation of public-facing applications (Ivanti Connect Secure, Log4j, SimpleHelp RMM CVEs), PowerShell-delivered Cobalt Strike, SystemBC persistence, Mimikatz/LaZagne credential theft, SoftPerfect Network Scanner and ADFind discovery, BYOVD EDR termination (TrueSight.sys, RentDrv.sys), exfiltration to MEGA/FTP/HTTP, shadow-copy deletion, event-log clearing and double extortion through a Tor leak site.

Because the victim sells ERP and supply-chain software, its customers may face downstream risk if source code, customer data, deployment credentials or remote-support access were taken. The listing does not state any customer impact. Defenders who run this vendor's software should review vendor communications, rotate credentials shared with the vendor, and audit vendor remote-access paths.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003.001 LSASS Memory
- T1555 Credentials from Password Stores
- T1046 Network Service Discovery
- T1087.002 Domain Account
- T1021.001 Remote Desktop Protocol
- T1071.001 Web Protocols
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [ransomware.live victim entry: lyserp.com (Dragonforce)](https://www.ransomware.live/id/bHlzZXJwLmNvbUBkcmFnb25mb3JjZQ)
- [Group-IB: DragonForce Ransomware](https://www.group-ib.com/blog/dragonforce-ransomware/)
- [BleepingComputer: Deep dive into DragonForce ransomware and its Scattered Spider connection](https://www.bleepingcomputer.com/news/security/deep-dive-into-dragonforce-ransomware-and-its-scattered-spider-connection)
- [Trend Micro: Ransomware Spotlight - DragonForce](https://www.trendmicro.com/ja_jp/research/25/k/ransomware-spotlight-dragonforce.html)
- [Resecurity: DragonForce Ransomware Reverse Engineering Report](https://www.resecurity.com/blog/article/dragonforce-ransomware-reverse-engineering-report)
- [Intel 471: DragonForce Ransomware](https://www.intel471.com/blog/dragonforce-ransomware)
- [AttackIQ: Emulating the Blazing DragonForce Ransomware](https://www.attackiq.com/2025/05/23/emulating-dragonforce-ransomware/)
- [CSIS Research: DragonForce Ransomware TTPs](https://www.csis.com/csis-tech-blog/csis-research-dragonforce-ransomware-ttps)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4963