Full Report
Dragon RaaS is a ransomware group that walks the line between hacktivism and cybercrime targeting organizations in the US, UK, France and Germany.
Analysis Summary
# Threat Actor: Dragon RaaS (DragonRansom, Dragon Team)
## Attribution & Identity
Dragon RaaS is a ransomware group positioning itself as both a hacktivist operation and a traditional cybercrime entity. It emerged in July 2024 as an offshoot of the **Stormous** group, linking it intrinsically to the larger pro-Russian cybercrime syndicate known as **“The Five Families,”** which also encompasses ThreatSec, GhostSec, Blackforums, and SiegedSec.
## Activity Summary
Dragon RaaS markets itself as a Ransomware-as-a-Service (RaaS) operation, though its actual activities are often characterized by opportunistic attacks, including system defacements, rather than large-scale traditional ransomware extortion.
* **Origin:** Launched its Telegram channel in July 2024 after the parent group, Stormous, had been active since mid-2021 targeting organizations perceived as hostile to Russia.
* **Platform Launch:** Announced the “Dragon Ransomware RaaS Platform” on Telegram in October 2024, boasting features like a web-based management portal, privacy focus, a small file size (50KB), fast encryption, and a distributed builder tool.
* **Notable Campaigns:** Announced an attack against **Al-Saeeda University** (Yemen) on October 25, 2024, and continued announcing victims throughout late 2024 and into 2025 (e.g., claiming multiple victims hosted on compromised cPanel instances on March 1, 2025).
## Tactics, Techniques & Procedures
The group heavily relies on initial access methods common to its affiliated groups:
* Vulnerability exploitation.
* Brute-force credential attacks.
* Use of stolen credentials obtained from infostealer logs.
* Abusing weak security postures and misconfigurations (e.g., default admin passwords).
* **Post-Exploitation:** Deploying a **PHP webshell** to maintain persistence and interact with encrypted files via compromised web panel interfaces (like cPanel).
* **Targeted Vulnerabilities/Tools:** Historically abused WordPress themes/plugins, and specifically targeted flaws in WordPress SMB, LiteSpeed HTTP, and mySQL systems.
* CVE-2024-3806, CVE-2024-3807, CVE-2024-3808, CVE-2024-3809 (Porto WP Theme LFI flaws).
* CVE-2022-0073 (LiteSpeed HTTP Command Injection).
* CVE-2022-0074 (LiteSpeed HTTP Privilege Escalation).
* CVE-2023-2359 (Slider Revolution RCE).
* CVE-2023-6925 (WPBakery Page Builder Command Injection).
* CVE-2023-47784 (Slider Revolution Unrestricted/Arbitrary File Upload).
* CVE-2024-47374 (LiteSpeed HTTP Cross-site Scripting).
## Targeting
* **Sectors:** Primarily targets smaller organizations recognized as having relatively weak security postures.
* **Geography:** Primarily targets organizations in the **United States, Israel, United Kingdom, France, and Germany.**
* **Victims:** Al-Saeeda University (Yemen) was specifically announced as a victim. The group frequently targets multiple domains managed under a single, compromised cPanel instance.
## Tools & Infrastructure
* **Malware families used:** Dragon Ransomware (Encryptors for both PHP and Windows environments are mentioned).
* **Infrastructure:** Utilizes Telegram channels for announcements and marketing. Infrastructure discussions mention the use of **cPanel** interfaces as a critical vector for initial access and mass compromise.
## Implications
Dragon RaaS poses a tangible threat to organizations with poor security hygiene, leveraging known vulnerabilities (especially in common web stacks like WordPress and LiteSpeed) for quick access. Its association with the politically motivated "Five Families" syndicate suggests potential for politically relevant targeting, even if its current operational tempo leans toward opportunistic crime.
## Mitigations
* Secure web panel interfaces (e.g., cPanel) against brute-force and initial access exploitation.
* Regularly patch and audit WordPress themes and plugins (especially Porto, Slider Revolution, WPBakery).
* Address known vulnerabilities in LiteSpeed HTTP servers pertaining to Command Injection and Privilege Escalation.
* Implement strong credential policies to mitigate credential stuffing and brute-forcing attacks used to gain initial access.
* Monitor for the deployment of PHP webshells on web servers.