Supply chain attacks are no longer rare—they are rapidly becoming one of the most dangerous cybersecurity threats facing organizations today. In March 2026, what initially appeared to be a routine adware alert quickly escalated into a large-scale supply chain compromise affecting over 25,000 endpoints globally.
At the center of this campaign is Dragon Boss Solutions LLC, whose signed software leveraged a malicious update mechanism to disable antivirus protections and leave systems defenseless.
This incident is a stark reminder:
Trust in software updates can be weaponized.
In this deep-dive, you’ll learn:
- How the Dragon Boss supply chain attack works
- The role of update infrastructure in compromise
- Technical breakdown of the AV-killing payload
- Real-world impact across critical sectors
- Detection strategies and mitigation best practices
What Is the Dragon Boss Supply Chain Attack?
The Dragon Boss campaign is a software supply chain attack that abuses legitimate update mechanisms to deliver malicious payloads.
Key Characteristics
- Attack Type: Supply chain compromise
- Initial Vector: Signed software with built-in updater
- Payload Delivery: MSI installers + PowerShell scripts
- Primary Impact: Antivirus disabling, persistence, system compromise
- Scale: 23,565+ confirmed infected endpoints
Why This Attack Is Significant
- Uses digitally signed binaries (trusted by systems)
- Exploits unregistered update domains
- Targets enterprise, education, and critical infrastructure
- Operates with SYSTEM-level privileges
How the Attack Works (Step-by-Step Lifecycle)
Understanding the attack chain is critical for threat detection and incident response.
1. Initial Execution: Signed Binary
The attack begins with a seemingly legitimate executable:
- RaceCarTwo.exe (digitally signed)
- Delivered via existing installations or bundled software
Because it is signed, it bypasses many application control policies.
2. Malicious Update Mechanism
The binary leverages:
- Advanced Installer (legitimate tool)
- Built-in update functionality
This allows attackers to:
- Deliver payloads silently
- Blend in with normal software behavior
3. Multi-Stage Payload Delivery
The infection chain unfolds as follows:
- RaceCarTwo.exe executes
- Downloads and installs Setup.msi
- MSI triggers ClockRemoval.ps1
This modular design enables flexibility and stealth.
4. Domain Hijacking Opportunity
A critical misconfiguration exposed the entire ecosystem:
- Update domain:
chromsterabrowser[.]com - Status: Unregistered
This meant:
Anyone could register the domain and control updates for all infected systems.
Security researchers intervened, sinkholing the domain and revealing:
- 23,565 unique infected IPs in 24 hours
5. Execution of AV-Killing Payload
The PowerShell script ClockRemoval.ps1 is the core weapon.
Capabilities
- Terminates antivirus processes
- Deletes AV services via registry edits
- Blocks reinstallation attempts
- Establishes SYSTEM-level persistence
6. Persistence Mechanisms
The malware ensures continuous control via:
Scheduled Tasks
- ClockSetupWmiAtBoot
- DisableClockServicesFirst
- DisableClockAtStartup
- RemoveClockAtLogon
- RemoveClockPeriodic
These run:
- At boot
- At login
- Every 30 minutes
7. Defense Evasion Techniques
The attack employs multiple evasion strategies:
- Modifies hosts file to block AV updates
- Adds Windows Defender exclusions
- Disables Chrome auto-updates
- Uses WMI persistence
Inside the AV-Killing Payload
The ClockRemoval.ps1 script is highly aggressive and engineered for persistence.
Key Behaviors
- Redirects AV vendor domains (e.g., Malwarebytes, Kaspersky) to
0.0.0.0 - Prevents antivirus reinstallation
- Removes security services entirely
- Maintains recurring execution
Why This Matters
Once security tools are removed, attackers gain complete freedom to deploy secondary payloads.
This could include:
- Ransomware
- Infostealers
- Remote access trojans (RATs)
Global Impact and Risk Analysis
Geographic Distribution
| Country | Infections | Percentage |
|---|---|---|
| United States | 12,697 | 53.9% |
| France | 2,803 | 11.9% |
| Canada | 2,380 | 10.1% |
| United Kingdom | 2,223 | 9.4% |
| Germany | 2,045 | 8.7% |
High-Value Targets
- 221 universities and colleges
- 41 critical infrastructure networks
- 35 government entities
- 24 schools
- 3 healthcare organizations
- Multiple Fortune 500 environments
Risk Impact
| Risk Area | Impact |
|---|---|
| Endpoint Security | Critical |
| Data Exposure | High |
| Operational Downtime | High |
| Compliance Risk | High |
Common Mistakes That Enabled the Attack
1. Blind Trust in Signed Software
- Digital signatures do not guarantee safety
2. Weak Update Validation
- No verification of update sources
3. Lack of Domain Monitoring
- Unregistered domains went unnoticed
4. Poor Endpoint Visibility
- AV removal activity undetected
Detection and Threat Hunting Techniques
Security teams should actively hunt for:
1. WMI Persistence Indicators
- Consumer names containing:
- “MbRemoval”
- “MbSetup”
2. Suspicious Scheduled Tasks
Look for tasks linked to:
- WMILoad directories
- ClockRemoval scripts
3. Hosts File Manipulation
Check for:
- AV vendor domains redirected to
0.0.0.0
4. Suspicious Defender Exclusions
Flag unusual paths such as:
- DGoogle
- EMicrosoft
- DDapps
5. Signed Binary Abuse
Monitor processes signed by:
- Dragon Boss Solutions LLC
Best Practices to Prevent Supply Chain Attacks
1. Implement Zero Trust for Software Updates
- Verify update sources
- Restrict outbound update traffic
2. Strengthen Endpoint Detection
- Use EDR/XDR tools
- Monitor behavioral anomalies
3. Enforce Application Control
- Allow only trusted applications
- Validate code signing chains
4. Monitor DNS and Domain Activity
- Detect suspicious or newly registered domains
- Use DNS filtering
5. Harden PowerShell Execution
- Restrict script execution
- Enable logging and monitoring
6. Regular Security Audits
- Validate update mechanisms
- Review software supply chain dependencies
Framework Alignment
MITRE ATT&CK Techniques
- T1195: Supply Chain Compromise
- T1059: Command and Scripting Interpreter
- T1546: Event Triggered Execution (WMI)
- T1562: Impair Defenses
NIST Cybersecurity Framework
- Identify: Software supply chain risks
- Protect: Application control
- Detect: Behavioral monitoring
- Respond: Incident containment
Expert Insights
This attack demonstrates a dangerous shift:
Update infrastructure is becoming a primary attack vector.
Strategic Takeaways
- Trust must be continuously validated
- Signed software can still be malicious
- Supply chain attacks offer mass-scale compromise
FAQs
1. What is a supply chain attack?
An attack that compromises trusted software or vendors to distribute malware to users.
2. How many systems were affected?
Over 23,000 confirmed endpoints globally.
3. Why was the unregistered domain critical?
It allowed anyone to take control of the update mechanism and deliver payloads.
4. What does ClockRemoval.ps1 do?
It disables antivirus tools, blocks updates, and ensures persistence.
5. Who is most at risk?
Organizations relying on third-party software updates without validation.
6. How can this be prevented?
Use zero trust principles, monitor updates, and deploy advanced endpoint protection.
Conclusion
The Dragon Boss campaign is a textbook example of how supply chain attacks can scale rapidly and silently.
Key Takeaways
- Trusted software can become a threat vector
- Update mechanisms are high-risk attack surfaces
- Endpoint visibility is critical for early detection
Organizations must evolve their defenses to include supply chain security, behavioral monitoring, and zero trust validation.
👉 Now is the time to audit your software supply chain and strengthen update security controls.
