Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations

The DFIR Report links a single threat actor to three ransomware-as-a-service operations, tying together tools and campaigns used during a September 2024 intrusion. The attack began when a malicious EarthTime fake led to the .NET-based SectopRAT malware, signed with a revoked certificate from Brave Pragmatic Network Technology.

After establishing persistence via a new administrator-enabled local account, the actors deployed SystemBC for proxy tunnelling, compromised the domain controller via RDP, and enumerated hosts with Windows utilities. They used AdFind, PowerShell, SharpHound and NetScan for discovery, later deploying Betruger as a second backdoor and conducting extensive credential theft and data exfiltration, while evading defenders with timestomping and other techniques.

The DFIR Report notes that the final objective was ransomware deployment, with data archived and exfiltrated via FTP, and not a direct mass-encrypt operation. According to The DFIR Report, the threat actor can be linked to three RaaS operations: Grixba is used by the Play ransomware group, Betruger by RansomHub affiliates, and an output file tied to NetScan points to a DragonForce compromise.