Dragon RaaS, a ransomware group identified for its mix of hacktivism and cybercrime, has emerged as a major participant within the “5 Households” crimeware syndicate.
This group, which incorporates ThreatSec, GhostSec, Blackforums, and SiegedSec, has been making waves since its inception in July 2024 as an offshoot of the Stormous group.
Dragon RaaS markets itself as a classy Ransomware-as-a-Service (RaaS) operation, although its assaults usually deal with defacements and opportunistic strikes slightly than large-scale ransomware extortion.


Origins and Evolution
Dragon RaaS’s origins are deeply rooted within the pro-Russian Stormous group, which gained notoriety for concentrating on organizations perceived as hostile to Russia.
Stormous is a part of the broader “5 Households” syndicate, which has been concerned in varied ransomware operations, together with GhostLocker and StormCry.
In July 2024, Dragon RaaS launched its Telegram channel, saying a forthcoming ransomware platform.


The group’s first substantive postings occurred in October 2024, with the announcement of a ransomware assault towards Al-Saeeda College in Yemen.
This marked the start of Dragon RaaS’s energetic marketing campaign, which continues to focus on smaller organizations with weak safety postures, primarily in america, Israel, the UK, France, and Germany.
Preliminary Entry and Exploitation Strategies
Dragon RaaS employs a variety of techniques to realize preliminary entry to focus on methods.
These embody exploiting vulnerabilities in public-facing purposes, brute-force credential assaults, and leveraging compromised credentials from infostealer logs.
The group often targets WordPress themes and plugins, LiteSpeed HTTP servers, and cPanel interfaces.
Particular vulnerabilities exploited by Dragon RaaS embody these within the Porto WP Theme (CVE-2024-3806 to CVE-2024-3809) and LiteSpeed HTTP servers (CVE-2022-0073 and CVE-2022-0074).
As soon as entry is gained, Dragon RaaS deploys a PHP webshell that gives backdoor performance and chronic ransomware capabilities.
.webp)
.webp)
In keeping with SentinelOne Report, this webshell permits attackers to govern and encrypt recordsdata utilizing strategies comparable to OpenSSL, XOR, or mCrypt.
To guard towards Dragon RaaS and comparable teams, organizations ought to prioritize securing public-facing purposes by frequently updating and patching companies like WordPress and cPanel.
Implementing robust password insurance policies, together with multi-factor authentication, can be essential.
Deploying superior endpoint safety options can assist detect and forestall malicious techniques, strategies, and procedures (TTPs) related to these teams.
Monitoring for indicators of compromise and auditing methods for suspicious webshell exercise are important steps in sustaining a sturdy safety posture.
By specializing in these measures, organizations can considerably cut back their vulnerability to Dragon RaaS and different crimeware syndicates.
Examine Actual-World Malicious Hyperlinks & Phishing Assaults With Menace Intelligence Lookup – Attempt for Free