Legitimate software as ransomware delivery: what teams missed

TL;DR: DragonForce used vulnerable, digitally signed legitimate software, exploited three critical CVEs, and preconfigured it to call attacker-controlled servers, enabling rapid remote access and ransomware execution, according to Halcyon. The attack shows that trusted software can become an initial access path when defenders rely on signature trust instead of runtime verification.

Editorial analysis by NHI Mgmt Group, based on content published by Halcyon: “Hiding in Plain Sight: How DragonForce Weaponized Legitimate Software”.

By the numbers:

• Only 7 out of 73 vendors on VirusTotal flagged the file, and those were just generic remote access tool alerts.

Key questions

Q: What breaks when legitimate software is used to deliver ransomware?

A: When attackers weaponise legitimate software, signature trust and standard allowlists stop being reliable safety signals.

Q: Why do trusted installers and remote access tools increase ransomware risk?

A: Trusted installers lower user suspicion and often pass basic reputation checks, which gives attackers a cleaner entry path.

Q: How can security teams spot weaponised legitimate software before encryption starts?

A: Look for abnormal child processes, unexpected outbound connections, privilege changes, and execution from unusual user contexts.

Practitioner guidance

• Tighten execution policy for signed software Require additional scrutiny for signed binaries that are not on an approved administrative allowlist, especially remote access tools and installers.
• Inspect process behavior after launch Correlate parent-child process chains, privilege changes, and outbound destinations so a benign-looking file cannot silently pivot into attacker control.
• Block attacker-controlled callback infrastructure Use egress controls and DNS monitoring to stop newly executed software from reaching unknown command-and-control servers.

Bottom line: The incident shows how ransomware actors can exploit trust in legitimate software instead of relying on obvious malware alone.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →