Dragon RaaS Leading “Five Families” Crimeware with New Initial Access & Exploitation Tactics

Dragon RaaS, a ransomware group known for its blend of hacktivism and cybercrime, has emerged as a significant player in the “Five Families” crimeware syndicate.

This group, which includes ThreatSec, GhostSec, Blackforums, and SiegedSec, has been making waves since its inception in July 2024 as an offshoot of the Stormous group.

Dragon RaaS markets itself as a sophisticated Ransomware-as-a-Service (RaaS) operation, though its attacks often focus on defacements and opportunistic strikes rather than large-scale ransomware extortion.

Origins and Evolution

Dragon RaaS’s origins are deeply rooted in the pro-Russian Stormous group, which gained notoriety for targeting organizations perceived as hostile to Russia.

Stormous is part of the broader “Five Families” syndicate, which has been involved in various ransomware operations, including GhostLocker and StormCry.

In July 2024, Dragon RaaS launched its Telegram channel, announcing a forthcoming ransomware platform.

The group’s first substantive postings occurred in October 2024, with the announcement of a ransomware attack against Al-Saeeda University in Yemen.

This marked the beginning of Dragon RaaS’s active campaign, which continues to target smaller organizations with weak security postures, primarily in the United States, Israel, the United Kingdom, France, and Germany.

Initial Access and Exploitation Methods

Dragon RaaS employs a range of tactics to gain initial access to target systems.

These include exploiting vulnerabilities in public-facing applications, brute-force credential attacks, and leveraging compromised credentials from infostealer logs.

The group frequently targets WordPress themes and plugins, LiteSpeed HTTP servers, and cPanel interfaces.

Specific vulnerabilities exploited by Dragon RaaS include those in the Porto WP Theme (CVE-2024-3806 to CVE-2024-3809) and LiteSpeed HTTP servers (CVE-2022-0073 and CVE-2022-0074).

Once access is gained, Dragon RaaS deploys a PHP webshell that provides backdoor functionality and persistent ransomware capabilities.

According to SentinelOne Report, this webshell allows attackers to manipulate and encrypt files using methods such as OpenSSL, XOR, or mCrypt.

To protect against Dragon RaaS and similar groups, organizations should prioritize securing public-facing applications by regularly updating and patching services like WordPress and cPanel.

Implementing strong password policies, including multi-factor authentication, is also crucial.

Deploying advanced endpoint security solutions can help detect and prevent malicious tactics, techniques, and procedures (TTPs) associated with these groups.

Monitoring for indicators of compromise and auditing systems for suspicious webshell activity are essential steps in maintaining a robust security posture.

By focusing on these measures, organizations can significantly reduce their vulnerability to Dragon RaaS and other crimeware syndicates.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup – Try for Free

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!