Ransom Busters Scam Targets Ransomware Victims with Fake Data Deletion Services
A threat actor calling itself 'Ransom Busters' is targeting ransomware victims with a novel extortion scheme, offering to delete stolen data from…
Tag: DragonForce
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The operators of the DevMan ransomware-as-a-service (RaaS) scheme maintain a dedicated web platform that offers affiliates the ability to build payloads, oversee…
DragonForce — Malware profile
DragonForce was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Weekly Cybersecurity Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
This week's cybersecurity landscape is marked by a series of critical threats and vulnerabilities. Progress has urged ShareFile customers to shut down…
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Threat actors associated with the DragonForce ransomware group have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to…
Hackledorb Threat Actor
Hackledorb is the threat actor behind DragonForce ransomware, known for pivoting to a highly organized cartel structure and deploying sophisticated backdoors like…
Backdoor.Turn: Go-Based RAT Abusing Microsoft Teams TURN
Backdoor.Turn is a Go-based remote access trojan used by DragonForce ransomware to hide C2 traffic inside Microsoft Teams relay infrastructure via QUIC…
Symantec: Documented Backdoor.Turn
Symantec, owned by Broadcom, documented the Backdoor.Turn RAT used by DragonForce ransomware to abuse Microsoft Teams TURN relays.
CVE-2025-5777 (Citrix Bleed 2): Exploited for DragonForce Ransomware Deployment
CVE-2025-5777, known as Citrix Bleed 2, is being exploited by threat actors to deploy DragonForce ransomware. Attackers follow a consistent post-compromise pattern…
The Gentlemen RaaS Deploys GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands…