Loading malware…
DragonForce is a ransomware family and financially motivated ransomware-as-a-service operation active since 2023. It targets Windows, Linux, and VMware ESXi environments and uses double extortion, combining file encryption with sensitive-data theft and threats of public disclosure. Early payloads used the leaked LockBit 3.0 builder; subsequent variants incorporated modified Conti code. Its encryptors support configurable encryption modes, including full and partial encryption. Victims span manufacturing, construction, technology, healthcare, retail, and other sectors across multiple regions.
DragonForce supplies affiliates with customizable payloads, deployment infrastructure, victim-management panels, negotiation services, and stolen-data publication facilities. In March 2025, it announced a cartel model allowing partners to use its infrastructure under their own branding. Campaigns obtain access through compromised credentials, phishing, social engineering, and exploitation of exposed applications. DragonForce exploited vulnerable SimpleHelp deployments at a managed service provider to reach downstream customers, distribute malicious installers, conduct reconnaissance and credential harvesting, steal data, and deploy ransomware. Scattered Spider and Storm-2570 have been associated with DragonForce deployment.
DragonForce activity includes network discovery, lateral movement through legitimate remote-management tools, scheduled-task persistence, security-tool tampering, log clearing, and anti-analysis checks. Operators have used bring-your-own-vulnerable-driver techniques to disable endpoint defenses. Supporting custom backdoors relay command-and-control traffic through Microsoft Teams TURN infrastructure, with MQTT as a fallback channel. These backdoors use encrypted payload delivery and in-memory execution; a persistent execution chain employs scheduled tasks and DLL sideloading. These supporting tools extend access and evasion capabilities beyond the ransomware encryptor itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
DragonForce affiliates employ a range of initial access vectors to infiltrate target environments. These commonly include: ... Exploitation of publicly known vulnerabilities, notably Log4Shell (CVE-2021-44228).
CVE-2024-57728 (CVSS 7.2): An arbitrary file upload vulnerability enabling attackers to introduce malicious payloads into the environment.
Notably, the group exploits multiple vulnerabilities to conduct attacks. These vulnerabilities include CVE-2024-21412, CVE-2024-21887, and CVE-2024-21893.
Notably, the group exploits multiple vulnerabilities to conduct attacks. These vulnerabilities include CVE-2024-21412, CVE-2024-21887, and CVE-2024-21893.
CVE-2024-57727 (CVSS 7.5): A set of path traversal flaws that allow attackers to navigate directories and access restricted files.
Notably, the group exploits multiple vulnerabilities to conduct attacks. These vulnerabilities include CVE-2024-21412, CVE-2024-21887, and CVE-2024-21893.
CVE-2024-57726 (CVSS 9.9): A privilege escalation flaw that grants elevated permissions once initial access is gained.
Abusing a legitimate-but-vulnerable driver K7RKScan.sys (CVE-2025-1055) as part of a BYOVD attack to disable security software. The same driver was previously exploited by DragonForce ransomware actors. | "Abusing a legitimate-but-vulnerable driver K7RKScan.sys (CVE-2025-1055) as part of a BYOVD attack to disable security software. The same driver was previously exploited by DragonForce ransomware actors."
The attack chain begins with exploitation of the “CitrixBleed 2” vulnerability in Citrix NetScaler appliances... Huntress assesses with high confidence that the activity is the work of an initial access broker (IAB) weaponising CVE-2025-5777... A pre-auth memory leak that defeats MFA CVE-2025-5777, dubbed CitrixBleed 2... is a pre-authentication memory-overread affecting NetScaler ADC and Gateway when configured as a Gateway or AAA virtual server. | ...in its most advanced form, ends in DragonForce ransomware... In the most progressed case, the operator used PsExec, Impacket-based tooling and Mimikatz for lateral movement and credential access before deploying a DragonForce ransomware binary...
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
Fortinet FortiOS CVE-2024-55591, a zero-day authentication bypass vulnerability disclosed in January 2025, had the highest count of ransomware groups attached to it as the year closed, with six named ransomware families (DragonForce, Hunters International, NightSpire, Qilin, RansomHub, and SuperBlack)...
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DragonForce in the 2025 wave against UK retailers ... including Marks & Spencer, Co-op, and Harrods.
DragonForce exploited a set of vulnerabilities in SimpleHelp, a popular Remote Monitoring and Management (RMM) tool, to breach an MSP and deploy ransomware across multiple client environments.
Devman was observed launching a new RaaS platform based on modified code from the "DragonForce" ransomware family.
Analysts from Microsoft identified a consistent pattern after access was gained, even when attacks ended with Qilin, DragonForce, Anubis or BERT ransomware.
The 2025 wave of UK retail attacks against Marks & Spencer, Co-op, and Harrods deployed DragonForce ransomware.
When DragonForce emerged in August 2023, it offered a traditional RaaS scheme. On March 19, 2025, the group announced a rebrand as a ‘cartel’ to expand its reach, hoping to emulate the success of LockBit and other mature ransomware-as-a-service (RaaS) groups.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The table below shows the observed TTPs in our dataset... Resource Development Compromise Accounts T1586
Others are hit as a stepping stone toward bigger, better-defended targets further down the chain, such as hospitals that depend on them for records, equipment, or connected systems.
“[The sample] initializes COM and WMI, queries the Win32_ShadowCopy class, and uses each returned shadow-copy identifier to construct and execute a WMIC deletion command.”
“cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where ‘ID='<shadow-copy-id>'’ delete”
The victim is tricked into opening a malicious attachment ... or clicking a malicious link, triggering the execution of the ransomware.
“It creates the HKEY_CLASSES_ROOT\.df_win\DefaultIcon association so Windows can display the custom icon for encrypted files.”
DragonForce obfuscates its payload by packing or encrypting parts of the code.
“DragonForce manually resolves LoadLibraryA from kernel32.dll, then uses it to load eleven Windows libraries using decrypted DLL names. GetProcAddress() resolves the required functions from those modules.”
DragonForce ... deletes system logs, and erases indicators to avoid detection by security tools.
“It creates the HKEY_CLASSES_ROOT\.df_win\DefaultIcon association so Windows can display the custom icon for encrypted files.”
“A configurable priority list contains 38 process names spanning security, backup, database, and productivity software… [workers] attempt to terminate matches.”
In the most progressed case, the operator used PsExec, Impacket-based tooling and Mimikatz for lateral movement and credential access before deploying a DragonForce ransomware binary
one that begins with exploitation of the “CitrixBleed 2” vulnerability in Citrix NetScaler appliances... Huntress assesses with high confidence that the activity is the work of an initial access broker (IAB) weaponising CVE-2025-5777 to gain footholds in Citrix environments
“Before target processing, the sample retrieves the current user SID and resolves account information.”
“Background monitoring workers repeatedly enumerate running processes, compare names against this list, and attempt to terminate matches.”
DragonForce gathers system information such as the operating system version, architecture, and installed applications.
DragonForce explores file and directory structures to identify valuable files for encryption.
“For each candidate address, NetShareEnum() enumerates SMB shares and the reachable paths are published to the network task queue.”
In the most progressed case, the operator used PsExec, Impacket-based tooling and Mimikatz for lateral movement and credential access
DragonForce collects sensitive data ... storing it in a log file for future exploitation.
DragonForce replicates itself in various directories and may copy itself to other systems on the network after gaining initial access.
The malware employs intermittent encryption and evasion techniques to bypass EDR and anti-ransomware defenses.
“DragonForce also initializes COM and WMI, queries the Win32_ShadowCopy class, and uses each returned shadow-copy identifier to construct and execute a WMIC deletion command.”
“The wallpaper routine enumerates HKEY_USERS and attempts wallpaper-related registry writes for the listed profile contexts, then calls SystemParametersInfoW() to apply the wallpaper to the active session.”
76 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
172 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as ransomware in the indicators table, but only in advisory context. No deployment details, capabilities, or explicit relationship to Scattered Spider are provided.
Ransomware associated in the article with Scattered Spider's affiliate activity during the 2025 UK retail attack wave. Its use illustrates how operators can retain their initial-access methods while switching ransomware brands.
Named as a participant in a ransomware alliance with LockBit and Qilin intended to share tools and infrastructure and improve attack effectiveness. The article provides no specific details about its payload capabilities or victims.
Mentioned in a background account of a ransomware operator's website being defaced. The reference provides no technical details about the ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.