[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1zc8_KOhHvUWRqjc3CS3mHsOvj1E-00DTKn7fe_IanQ":3,"$faBhBPgqhpEGapQ_SKxaOnu2adY58edppxkZFof4ap8k":82},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":79,"created_at":80,"updated_at":81,"published_at":33},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","ASEC's July 2026 weekly roundup confirms a new DragonForce victim in the Saudi Arabian chemical sector.","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[10,11,12,13,14],"DragonForce","Ransomware","Saudi Arabia","Chemical Manufacturing","ASEC","# DragonForce Ransomware Hits Saudi Chemical Manufacturer\n\n*ASEC's July 2026 weekly roundup confirms a new DragonForce victim in the Saudi Arabian chemical sector.*\n\n**Tags:** `DragonForce` `Ransomware` `Saudi Arabia` `Chemical Manufacturing` `ASEC`\n\n> The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.\n\n---\n\n## DragonForce hits Saudi chemical maker\n\nA Saudi Arabian chemical manufacturer is among the first major industrial targets hit by DragonForce in the Kingdom, according to ASEC’s July 2026 weekly roundup. The disclosure confirms the group’s continued push into Gulf manufacturing, following its February 2025 strike on a Riyadh real estate and construction firm that exfiltrated over 6 terabytes of data.\n\nThe incident is part of DragonForce’s broader 2026 run. The group claimed 144 victims in Q2, 248 year-to-date through May, and 76 claims in Q2 (45 in Q1). It entered the Q2 top-5 at rank 4, displacing IncRansom, and posted 101 victims in Q1 — a 29% jump from Q4 2025.\n\n## How the attack works\n\nInitial access typically arrives through RDP on Port 3389 or an unpatched SSL-VPN appliance—most commonly Ivanti Connect Secure, Fortinet FortiOS, or SonicWall. Affiliates brute-force or reuse credentials to land a shell on the edge, then pivot inward.\n\nBefore the encryptor runs, they drop RTCore64.sys, a Bring Your Own Vulnerable Driver (BYOVD) that bypasses EDR and AV on the target. The driver is signed and loaded via a standard `sc create` \u002F `sc start` sequence, giving the payload a clean execution context.\n\nThe ransomware payload itself is a Visual C++ build derived from the leaked LockBit 3.0 builder that went public in September 2022. DragonForce has kept the core encryption logic but added a custom wiper that scrubs forensic artifacts—registry keys, event logs, and the ransom note file—after the encryptor finishes. The wiper runs as a second-stage binary and is what makes the post-encryption state harder to attribute than a stock LockBit drop.\"\n\n## The DragonForce platform\n\nDragonForce is a ransomware-as-a-service platform built on the leaked LockBit 3.0 builder that went public in September 2022. The group has been active since late 2023 and distinguishes itself with a data audit service that analyzes stolen datasets larger than 300 GB to surface the highest-value files for targeted extortion leverage.\n\nThe Q2 2026 tradecraft update introduces Backdoor.Turn, a Go-based remote access trojan that abuses Microsoft Teams TURN-relay for command-and-control concealment. It is the first known malware to misuse the Teams relay mechanism, giving affiliates a cleaner C2 channel than standard RDP or HTTP beacons.\n\n## Why this matters for the Gulf\n\nThis is DragonForce’s second major Saudi enterprise target. The first was a Riyadh real estate and construction firm hit in February 2025, where the group exfiltrated over 6 terabytes of data and timed the drop just before Ramadan to pressure the victim into paying. That pattern—large Gulf target, high-value data, aggressive leak—has now repeated with the chemical manufacturer, confirming the group’s deliberate push into Kingdom manufacturing.\n\nThe consolidation story matters for the Gulf because DragonForce absorbed RansomHub in early 2025. RansomHub’s leak site went dark on March 31, and DragonForce commandeered the infrastructure by April 8, the same day the public takeover was formally recognized. DragonForce then announced RansomHub had “joined the cartel,” leaving the former RaaS inactive as of April 2026. That move tightened the RaaS market and pushed affiliates toward DragonForce, which is why the group is now the #4 RaaS in Q2 2026 with 144 victims, displacing IncRansom from the top-5.\n\n## Key points\n\n- DragonForce ransomware group claims a Saudi Arabian chemical manufacturer in ASEC's July 2026 weekly roundup.\n- The victim is part of DragonForce's Q2 2026 run of 144 confirmed victims, up 29% from Q1's 101.\n- DragonForce is a pro-Palestinian-turned-cybercriminal RaaS platform active since late 2023, built on the leaked LockBit 3.0 builder.\n- The group uses double extortion: it encrypts files and leaks data on its DragonLeaks Tor site.\n- This is the latest in a string of DragonForce hits on Saudi and Gulf-region industrial and retail targets, including a February 2025 Riyadh real estate firm (6 TB exfil) and the April 2025 M&S\u002FCo-op\u002FHarrods UK retail wave.\n\n## Further reading & sources\n\n- [Ransomware Spotlight: Ransomhub | TrendAI (US)](https:\u002F\u002Ftrendmicro.com\u002Fvinfo\u002Fus\u002Fsecurity\u002Fnews\u002Fransomware-spotlight\u002Fransomware-spotlight-ransomhub)\n- [DragonForce Ransomware – Hacktivist Turned Cybercriminal Enterprise - Threat Actors](https:\u002F\u002Fdailysecurityreview.com\u002Fresources\u002Fthreat-actors-resources\u002Fdragonforce-ransomware-hacktivist-turned-cybercriminal-enterprise)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [UK Cybercrime Journal: Sustained DragonForce Campaign](https:\u002F\u002Fblog.bushidotoken.net\u002F2026\u002F06\u002Fuk-cybercrime-journal-sustained.html)\n- [BlackLock Ransomware Exposed After Researchers Exploit Leak Site Vulnerability](https:\u002F\u002Flinkedin.com\u002Fpulse\u002Fblacklock-ransomware-exposed-after-researchers-exploit-leak-9bakf)\n- [Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target - Brandefense](https:\u002F\u002Fbrandefense.io\u002Fblog\u002Ftop-5-ransomware-groups-q2-2026)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf",{"iocs":18,"actors":22,"malware":43,"timeline":53,"technologies":66},[19],{"type":20,"value":21},"other","DragonLeaks",[23,29,34,39],{"url":24,"name":25,"slug":25,"type":26,"origin":27,"motivation":28},"\u002Fthreat-groups\u002Fdragonforce","dragonforce","ransomware","Unknown; hacktivist origins (possible Malaysia) evolving to a financially motivated Russia-nexus RaaS","financial",{"url":30,"name":31,"slug":32,"type":26,"origin":33,"motivation":28},"\u002Fthreat-groups\u002Fransomhub","RansomHub","ransomhub",null,{"url":35,"name":36,"slug":37,"type":26,"origin":38,"motivation":28},"\u002Fthreat-groups\u002Fblacklock","BlackLock","blacklock","Russia\u002FChina (unconfirmed; Resecurity observed operator logins from Chinese and Russian IP addresses and the affiliate rules exclude BRICS and CIS countries)",{"url":40,"name":41,"slug":42,"type":26,"origin":33,"motivation":33},"\u002Fthreat-groups\u002Factor","Владивосток","actor",[44,46,48,49,51],{"name":45},"Backdoor.Turn",{"name":47},"DragonForce Ransomware",{"name":10},{"name":50},"BlackLock Ransomware",{"name":52},"RTCore64.sys",[54,58,62],{"date":55,"event":56,"description":57},"2025-03-20","Deface","BlackLock DLS defaced by DragonForce",{"date":59,"event":60,"description":61},"2025-04","Attack","DragonForce attack on Marks and Spencer causing significant retail disruption.",{"date":63,"event":64,"description":65},"2025-06","Notable use","DragonForce used by Scattered Spider to attack M&S, Co-op, Harrods",[67,70,73,74,77],{"vendor":68,"product":69},"Fortinet","FortiGate",{"vendor":71,"product":72},"Huawei","driver",{"vendor":68,"product":68},{"vendor":75,"product":76},"Ivanti","Connect Secure",{"vendor":36,"product":78},"Data Leak Site (DLS)","ransomware_incident","2026-09-19T12:09:53.129912+00:00","2026-10-16T12:28:23.994995+00:00",{"articles":83},[84,95,106,117],{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":93,"story_type":79,"created_at":94},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[89,90,91,11,92],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":104,"story_type":79,"created_at":105},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[100,11,101,102,103],"Qilin","AhnLab ASEC","Manufacturing","US","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d","2026-09-18T07:07:39.952851+00:00",{"slug":107,"title":108,"summary":109,"tags":110,"hero_image_url":115,"story_type":79,"created_at":116},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE","Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.",[111,112,113,11,114],"Interlock","Cisco FMC","CVE-2026-20131","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00",{"slug":118,"title":119,"summary":120,"tags":121,"hero_image_url":127,"story_type":79,"created_at":128},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.",[122,123,11,124,125,126],"CISA","Gunra","FortiOS","FortiProxy","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","2026-08-27T17:06:47.703652+00:00"]