DragonForce Ransomware: How the Cartel Model Works and How to Defend Against It

DragonForce is a Ransomware-as-a-Service (RaaS) operation that has evolved into one of the most active extortion cartels in the current threat landscape. Its payload is built primarily from leaked source code associated with LockBit 3.0 (Black) and Conti.

By mid-2026, DragonForce had claimed over 590 victim organizations on its dark web leak site, placing it alongside Qilin, Akira, and INC Ransom as a top-tier active threat and accounting for roughly 7% of enterprise incident response caseloads globally.

From hacktivists to ransomware cartel (2023–2026)

Few ransomware operations have restructured as rapidly or ambitiously as DragonForce. Within three years of its first observed deployments, the group moved from a loosely affiliated payload user to the operator of a white-label extortion cartel with documented ties to other major RaaS groups.

That arc has direct consequences for defenders: the tools, affiliates, and pressure mechanisms now available under the DragonForce umbrella reach well beyond what any single operator could sustain independently.

Origins and early deployments (2023–2024)

DragonForce first appeared in mid-to-late 2023, sharing branding with DragonForce Malaysia, a pro-Palestinian hacktivist group. Security researchers assess with low-to-medium confidence that the link is genuine. An equally plausible interpretation is that financially motivated threat actors co-opted the name for initial notoriety.

Early deployments used leaked LockBit 3.0 builders and grew in visibility with a December 2023 incident involving the Ohio Lottery, where over 500,000 personal records were published on the group's leak site.

In June 2024, DragonForce formally launched a RaaS affiliate program on the Russian-language cybercrime forum RAMP, offering affiliates up to an 80% ransom split. Early targets included Oahu Transit Services, Yakult Australia, and Coca-Cola Singapore.

Operational evolution (2025)

March 2025 marked a structural shift: DragonForce rebranded as a "ransomware cartel," offering white-label infrastructure to third-party groups under a model called Ransom Bay. In August 2025, the group announced a formal cartel partnership with LockBit, taking a 20% cut to handle encryptors, infrastructure, and negotiation portals on behalf of partners.

DragonForce also introduced a "Data Analysis Service" for affiliates targeting organizations with revenue exceeding $15 million. The service automates risk audits on stolen data and generates tailored extortion call scripts, draft management letters, and pseudo-legal regulatory threat analysis to accelerate payments, with DragonForce charging between 0% and 23% of the ransom.

2026 Update: Sustained expansion

Activity through mid-2026 shows no deceleration. DragonForce logged 253 claimed victims in H1 2026 alone, averaging roughly 28–30 per month and bringing its cumulative total to over 590 organizations across DragonLeaks.

Who does DragonForce ransomware target?

DragonForce concentrates on mid-market to large global enterprises, including Fortune 500 corporations. The United States accounts for 52% of confirmed victims, followed by the United Kingdom at approximately 12%, with additional exposure across Australia, Singapore, the Middle East, and Europe.

Targeted sectors include retail and high-street commerce, managed service providers (MSPs), public transportation, manufacturing, healthcare, financial services, and government.

MSP targeting is particularly significant: by compromising shared remote monitoring and management (RMM) infrastructure, operators can push ransomware payloads simultaneously across multiple downstream client environments. The May 2025 SimpleHelp RMM campaign demonstrated this at scale, with multiple client organizations encrypted through a single MSP breach.

The attack chain

Reporting indicates that DragonForce operators conduct systematic pre-encryption work, scoping the environment, disabling defenses, identifying backup infrastructure, and staging data for exfiltration before detonating a payload.

Each phase creates detection opportunities. Capitalizing on them, however, requires telemetry across endpoints, identity systems, and network infrastructure.

Phase 1: Initial access

DragonForce gains entry through exploitation of unpatched edge devices and remote management tools. VPN gateways are accessed using stolen or brute-forced credentials. Phishing campaigns delivering malicious document lures represent a third observed initial access vector.

This identity-first pattern aligns with broader 2025–2026 incident response findings. According to Unit 42's 2026 Global Incident Response Report, identity weaknesses, including compromised credentials, session hijacking, and MFA bypass, contributed to nearly 90% of enterprise intrusions investigated.

Phase 2: Defense evasion and persistence

DragonForce deploys a Bring Your Own Vulnerable Driver (BYOVD) technique, loading legitimate but vulnerable signed kernel drivers to gain elevated system access and terminate endpoint detection and response (EDR) tools before encryption begins.

Four specific drivers have been associated with DragonForce operations:

• HWAudioOs2Ec.sys (Huawei, "Havoc Process Terminator")
• wsftprm.sys (Topaz Antifraud, CVE-2023-52271)
• Gamedriverx64.sys (Tower of Fantasy, CVE-2025-61155)
• K7RKScan.sys (K7 Security, CVE-2025-1055)

A Go-based backdoor called Backdoor.Turn is injected into DbgView64.exe and routes command-and-control (C2) traffic through anonymous Microsoft Teams TURN relay infrastructure. Because the traffic blends into legitimate Microsoft service communications, it evades standard perimeter inspection.

Amr Fathy, Senior DFIR Engineer at Proven Data, notes that the BYOVD technique creates a forensic challenge organizations routinely underestimate. When a vulnerable driver is loaded into kernel mode and used to terminate EDR agents and remove kernel callbacks, the visibility window for detecting what data was accessed or exfiltrated closes almost immediately, often before any alert is generated or logged.

In his assessment, post-incident scoping in DragonForce cases cannot rely on endpoint telemetry alone. Organizations should anticipate gaps that require correlation across network logs, identity provider records, and SaaS audit trails to reconstruct the full exfiltration timeline. What EDR did not see, the network and identity layers may still record.

Additional persistence mechanisms include:

• Registry run keys (HKEY_CLASSES_ROOT\dragonforce_encrypted)
• Scheduled tasks
• WMI modifications
• Custom mutex (hsfjuukjzloqu28oajh727190)

DLL side-loading into trusted signed binaries, including VirtualBox executables loading a malicious vboxrt.dll, has also been observed.

Phase 3: Lateral movement and reconnaissance

Internal reconnaissance relies on network scanning tools that leave delete.me file artifacts, AdFind for Active Directory mapping, and standard Windows commands (ipconfig, systeminfo).

HTTP traffic carrying the OpenVAS-VT user-agent string has been identified during internal scanning phases.

Propagation tools include RDP abuse, Admin Shares (via the -psex command flag), Group Policy modifications (-gspd flag), Cobalt Strike beacons, PsExec, and SystemBC backdoors.

This reliance on built-in system tools and trusted administrative utilities follows the broader living-off-the-land binary pattern, making DragonForce intrusions difficult to distinguish from routine administrative activity during the lateral movement phase.

Phase 4: Exfiltration and encryption

The payload encrypts files using ChaCha8 symmetric encryption, generating a unique 32-byte key and 8-byte nonce per file via the Windows CryptGenRandom function, with per-file keys protected by RSA-4096 asymmetric encryption.

The combination of session-level ChaCha8 keys and RSA-4096 key wrapping makes unauthorized decryption mathematically infeasible without the private key.

System recovery is inhibited through Volume Shadow Copy deletion (vssadmin.exe delete shadows /all /quiet), bcdedit recovery disablement, and wbadmin backup deletion.

The binary appends 534 bytes of metadata to each encrypted file and drops ransom notes named readme.txt or Contact Us.txt.

Extortion tactics and pressure methods

Beyond file encryption, DragonForce operates a double extortion model that combines payload deployment with mass data exfiltration to DragonLeaks.

Affiliates receive structured scripts for direct telephone calls to board members and executives, while the ransomware payload overwrites desktop wallpaper and hijacks connected network printers to output continuous physical ransom notes.

These tactics reflect a broader operational shift documented by reports on incident response data: encryption appeared in roughly 78% of extortion cases, down from above 90% in prior years, as threat actors increasingly found data exposure and direct organizational pressure sufficient to generate leverage without file-locking.

DragonForce's Data Analysis Service scales this pressure phase, making it available to any affiliate whose target meets the revenue threshold.

Indicators of Compromise

Security teams should treat the following artifacts as investigative starting points where DragonForce activity is suspected, not as definitive confirmation.

MITRE ATT&CK Techniques

The following techniques map to observed DragonForce tactics across confirmed incident response engagements.

Security checklist

The following controls address DragonForce's observed attack patterns, organized by the phase of the attack chain they interrupt.

Reduce initial access exposure

• Patch SimpleHelp RMM and other internet-facing management platforms on an accelerated cycle, prioritizing CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728
• Enforce FIDO2/hardware MFA on all VPN and RDP gateways; push-based MFA is insufficient against bypass techniques active in DragonForce campaigns
• Audit and remove stale RMM agent installations across managed environments before they become lateral pivot points

Counter BYOVD and EDR evasion

• Enable Microsoft's Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI) or Credential Guard
• Alert on loading of any BYOVD driver listed above and monitor for unexpected kernel callback removal events

Detect Backdoor.Turn C2 traffic

• Inspect outbound UDP/TCP originating from DbgView64.exe or similar system-level utilities
• Hunt for outbound connections to *.turn.teams.microsoft.com from non-Teams processes
• Flag anonymous Microsoft Teams visitor token requests originating from non-standard system processes

Identify lateral movement

• Alert on delete.me artifacts appearing on SMB shares, a known indicator of NetScan reconnaissance activity
• Flag internal HTTP/HTTPS traffic matching the OpenVAS-VT user-agent string
• Alert on registry writes to HKLM\SOFTWARE\Classes\dragonforce_encrypted

Protect backup and recovery infrastructure

• Isolate backup control-plane credentials from the domain; DragonForce operators target backup admin access before detonating encryption
• Test restoration procedures regularly; ransomware recovery capability is only reliable when validated ahead of an incident, not during one

If a DragonForce deployment is confirmed or suspected, initiate structured incident response steps immediately and contain before attempting remediation. Organizations using shared RMM infrastructure should also assess downstream client exposure in parallel with their own containment, as the MSP attack surface is a primary operational vector for this group.