Loading story…
Analysis of a 32-bit Windows DragonForce ransomware payload shows the ransomware-as-a-service cartel preparing its runtime environment, decrypting embedded configuration and strings, inventorying the host, and writing encrypted activity logs. The malware attempts to stop selected security, backup, database, and productivity processes, then deletes Volume Shadow Copies through WMI and WMIC to impede recovery.
DragonForce identifies local drives and reachable SMB shares using the existing IPv4 ARP cache and share enumeration, then encrypts local and network files concurrently. It uses unique ChaCha20 material per file, protects that material with an embedded 4096-bit RSA public key, appends encryption metadata, and marks affected files with the .df_win extension; it also drops a ransom note and changes file icons and desktop wallpaper. While the note claims data theft, the observed sample showed no data-exfiltration or separate upload capability.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
DragonForce restructured as a ransomware cartel in March 2025, offering white-label backend infrastructure that enabled affiliates to operate under their own brands.
DragonForce first surfaced in mid-to-late 2023, initially presenting itself as a hacktivist collective.
Analysis of a 32-bit DragonForce Windows payload found that it inventories hosts, attempts to terminate security and business processes, deletes Volume Shadow Copies, and enumerates local drives and SMB shares through existing ARP-cache entries. The sample concurrently encrypts local and network files with per-file ChaCha20 material protected by an embedded 4096-bit RSA key, appends a .df_win extension, and drops a cartel ransom note; the observed execution did not show data exfiltration or a separate upload channel.
The operation moved away from its apparent hacktivist persona and adopted a profit-driven ransomware model. Its payload lineage included code based first on leaked LockBit 3.0 source and later on the leaked Conti builder.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers published a technical breakdown of **DragonForce ransomware**, a ransomware operation that evolved from early underground forum activity into a broader *ransomware-as-a-service (RaaS)* model targeting both **Windows** and **VMware ESXi** environments. Reporting attributes DragonForce’s code lineage to leaked **LockBit 3.0** and **Conti** code, with a custom build that heavily obfuscates strings and supports flexible encryption modes across local disks and network shares. Observed intrusion tradecraft includes initial access via exposed remote services (notably RDP), followed by lateral movement tooling such as **Cobalt Strike** and **SystemBC**, culminating in encryption of file servers and virtual machines and pressure via a dark web presence advertising stolen data. S2W’s analysis describes DragonForce’s cryptography and operator options, including **ChaCha8** for file encryption with **RSA-4096** key protection, command-line flags to select local vs network targeting and partial-encryption ratios, and optional behaviors such as Base32-encoding original filenames and changing icons/wallpaper. Critically, S2W reports obtaining a **working decryptor** for certain DragonForce cases on both platforms: the Windows decryptor targets files with the `.RNP` extension, while the ESXi decryptor checks for `.RNP_esxi` files and a specific 8-byte magic value (`build_key`), potentially enabling recovery without ransom payment for affected victims. Separate reporting on **DeadLock ransomware** describes a different operation using Polygon smart contracts to rotate proxy infrastructure and is not part of the DragonForce activity.
Jun 29, 2026
**DragonForce**, a ransomware-as-a-service (RaaS) operation that emerged in 2023, has been linked to a growing set of intrusions targeting “critical business” environments across multiple industries, with a focus on **manufacturing, business services, technology, and construction**. Reporting attributes the group with **dual-extortion** tactics—stealing data prior to encryption and then threatening publication on a **data leak site (DLS)** to increase pressure on victims. Researchers also describe DragonForce as operationally adaptable, including changes in how it hosts and organizes leaked victim data. LevelBlue analysis cited in reporting indicates DragonForce has evolved its business approach beyond a typical affiliate program into a **“cartel” model**, allowing member groups to operate under their own brands while leveraging shared DragonForce infrastructure and services. Described offerings to affiliates include large-scale storage, continuous server monitoring, support services around file analysis/decryption, and assistance with test attacks; LevelBlue also highlighted an “**Company Data Audit**” service intended to help affiliates value stolen data and shape negotiation pressure (including prepared communications such as scripts and executive-facing letters). The group’s tooling is described as **multi-platform**, with the ability to target **Windows, Linux, ESXi, BSD, and NAS** systems and to use different encryption modes (e.g., full, header, partial), increasing potential impact across enterprise and virtualized environments.
Jun 29, 2026
DragonForce, a ransomware group that has evolved into a self-described "ransomware cartel," has intensified its global operations, targeting organizations with advanced tactics and forming alliances with other cybercriminal collectives. Security researchers have detailed how DragonForce leverages vulnerable drivers such as `truesight.sys` and `rentdrv2.sys` to disable security software and has improved its encryption methods to address previously exploited vulnerabilities. The group, which began by using the LockBit 3.0 builder and later adopted a modified Conti v3 source code, now operates a ransomware-as-a-service (RaaS) model, offering affiliates a significant share of profits and customizable tools to attract new participants. Notably, DragonForce has collaborated with groups like Scattered Spider and has been linked to the compromise of major organizations, including a high-profile breach of Marks & Spencer. Recently, DragonForce claimed responsibility for a significant breach at Mobilelink USA, a major dealer for Cricket Wireless, exfiltrating 5.04 TB of data and threatening to leak sensitive information, including personally identifiable and financial data of millions of customers across 21 states. The group has also reportedly allied with other ransomware gangs such as Qilin and LockBit, and has taken over operations or leak sites from other ransomware groups like RansomHub, BlackLock, and Mamona. In 2025 alone, DragonForce has impacted at least 185 organizations, with most attacks occurring in the last six months, underscoring the growing threat posed by this increasingly organized and aggressive ransomware operation.
Jun 29, 2026