Dragon Boss Solutions LLC described itself as a search monetization research company. Its software was signed. Its updates arrived through normal channels. For the IT teams and managed service providers whose systems ran Dragon Boss software, there was no obvious reason to distrust it.
In late March 2026, an update pushed through the Dragon Boss update mechanism changed that. The update chain ran RaceCarTwo.exe to Setup.msi to a PowerShell script called ClockRemoval.ps1, designed to strip antivirus protection from every system it touched. ClockRemoval.ps1 killed antivirus processes, blocked reinstallation, and modified the Windows hosts file to redirect Malwarebytes and Kaspersky update domains to 0.0.0.0, cutting them off from their own update infrastructure. Five persistent scheduled tasks were created, all running as SYSTEM. Windows Defender exclusions were added for directories named DGoogle, EMicrosoft, and DDapps, staging areas prepared for future payloads that would arrive into a fully unprotected environment.
Within a 24-hour monitoring window, after Huntress researchers James Northey and Ryan Dowd registered the Dragon Boss update domain, left unregistered and available for roughly ten dollars, 23,565 unique IP addresses reached out to their sinkhole. Affected systems included 221 universities, 41 critical infrastructure networks, 35 government entities, 24 schools, 3 healthcare organisations, and multiple Fortune 500 companies across the US, France, Canada, the UK, and Germany.
The payload was built specifically to remove Windows Defender, prevent its return, and ensure that whatever came next would land in a system Defender would never see. The attackers did not need a zero-day or a vulnerability in the update infrastructure. They had a legitimate code signing certificate and software already installed on tens of thousands of machines.
The attack was stopped not by endpoint protection, not by Windows, and not by any security vendor. It was stopped because the attacker left an update domain unregistered. Huntress registered it for ten dollars and sinkholed the traffic. Nothing in the security stack had flagged the update before that point.
Dragon Boss did not need an obscure weakness. The signed software trust model handed them the attack surface. A signature tells you the binary was approved by someone who held a certificate at the time of signing. It says nothing about what the binary phones home to, or what an update pushed months later will deploy. Systems that treat signed software as safe software are relying on a trust chain that attackers have repeatedly demonstrated they can access, abuse, or simply leave unguarded.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What did Dragon Boss Solutions do?
Dragon Boss Solutions LLC distributed signed software claiming to conduct search monetization research. In March 2026, an update it pushed deployed a PowerShell payload that killed antivirus tools, added Windows Defender exclusions, and created persistent scheduled tasks across 25,000 endpoints.
How did the attack disable Windows Defender?
The ClockRemoval.ps1 payload killed antivirus processes, blocked reinstallation, and added Defender exclusions for directories used as staging areas. Any future payloads delivered to those directories would not be scanned or flagged.
How was the attack stopped?
Huntress researchers James Northey and Ryan Dowd found that Dragon Boss's update domain had been left unregistered. They registered it for approximately ten dollars and redirected traffic to a sinkhole, blocking payload delivery.
Who was affected?
25,000 endpoints across 221 universities, 41 critical infrastructure networks, 35 government entities, 24 schools, 3 healthcare organisations, and multiple Fortune 500 companies. The majority of victims were in the US, with significant numbers in France, Canada, the UK, and Germany.
Does a digital signature mean software is safe?
No. A digital signature confirms the binary was approved by the certificate holder at the time of signing. It provides no guarantee about what future updates will deliver or what the software's update mechanism can be instructed to do.