Hackledorb

Hackledorb is a cybercriminal threat actor associated with the DragonForce ransomware operation. The group has been identified as the actor behind DragonForce and has been described as evolving from a conventional ransomware-as-a-service model into a more formalized cartel structure. Its activity is consistent with financially motivated intrusion and extortion operations. Hackledorb has demonstrated comparatively sophisticated post-compromise tradecraft. In a documented intrusion against a major U.S. services-sector victim, the actor used a custom Go-based remote access trojan known as Backdoor.Turn to conceal command-and-control setup within Microsoft Teams TURN relay infrastructure, then transition to attacker-controlled communications over QUIC. This approach reduced defender visibility by making outbound traffic appear to involve legitimate Microsoft Teams infrastructure. The malware was deployed after DragonForce ransomware execution, indicating an effort to preserve covert access following encryption, potentially for follow-on operations or resale of access. Observed intrusion activity included suspected exploitation of an SQL or Microsoft SQL Server vulnerability or use of access obtained from an initial access broker, followed by PowerShell-driven staging, DLL sideloading, reconnaissance, persistence, attempts to suppress security tooling, and use of a bring-your-own-vulnerable-driver technique involving a Huawei driver. Hackledorb also injected Backdoor.Turn into a legitimate process for stealth. Reported Backdoor.Turn functionality included command execution, process creation, network scanning, LDAP and Active Directory discovery, credential-based lateral movement, and browser credential theft. Known associations and aliases center on DragonForce; no separate high-confidence sub-groups are established in the available facts beyond that linkage.