DragonForce Goes Cartel: Ransomware Group Expands With Affiliate-Run Brands and Multi-Platform Encryption

DragonForce Cartel Ransomware

DragonForce is operating as a ransomware cartel, not a single threat actor. The group provides shared ransomware tooling, encryption engines, infrastructure, and negotiation platforms to multiple independent affiliates. Each affiliate conducts its own intrusion operations, victim selection, and branding, while leveraging the same underlying malware and support systems.

This model significantly increases attack volume, variability, and resilience. Even when one affiliate is disrupted, the broader ecosystem remains operational.

DragonForce attacks consistently involve credential-based access, security control suppression, data exfiltration, and multi-platform ransomware deployment targeting Windows, Linux, and VMware ESXi environments.

What Happened

Multiple ransomware incidents were identified in which:

Initial compromise methods differed
Ransom notes and file extensions varied
Negotiation portals appeared unrelated

However, forensic analysis revealed identical encryption logic, mutex usage, driver abuse techniques, and post-compromise workflows. These findings confirmed that the incidents were executed by separate affiliates using DragonForce-provided tooling rather than unrelated ransomware families.

How the Attack Works

1 Initial Access

DragonForce affiliates primarily rely on valid credentials, not zero-day exploits.

Observed access vectors include:

Phishing leading to credential theft
MFA fatigue attacks
Social engineering of help desks
Compromised VPN credentials
Exposed RDP services
Stolen MSP or third-party admin access

Most intrusions begin quietly, without malware deployment.

2 Foothold & Internal Reconnaissance

After access:

PowerShell and native Windows tools are used
Domain trusts, user groups, and admin accounts are enumerated
Security tools and backup software are identified
Network shares and high-value servers are mapped

Attackers deliberately blend in with normal administrative activity.

3 Privilege Escalation & Defense Evasion

Before deploying ransomware, affiliates disable security controls.

Key Technique: BYOVD (Bring Your Own Vulnerable Driver)

Observed drivers:

truesight.sys
rentdrv2.sys

Purpose:

Kill EDR and antivirus processes
Disable kernel protections
Prevent security agents from restarting

Once loaded, attackers gain unrestricted system control.

4 Lateral Movement

After neutralizing defenses:

SMB scanning identifies reachable hosts
Administrative shares are accessed
PsExec, WMI, scheduled tasks, and remote PowerShell are used
Domain controllers, file servers, backup servers, and ESXi hosts are prioritized

Movement is fast and deliberate.

5 Data Exfiltration (Double Extortion)

Before encryption:

Sensitive files are staged and archived
Archives are stored temporarily in ProgramData, Temp, or user folders
Data is exfiltrated via HTTPS, SFTP, or cloud storage
Only high-value data is stolen to maximize leverage

6 Ransomware Deployment

The DragonForce encryptor is deployed once control is complete.

Capabilities:

Windows, Linux, ESXi support
Multi-threaded encryption
Partial or full file encryption
Configurable delays and dry-run mode
Internal logging for affiliates

Pre-encryption actions:

Shadow copy deletion
Backup deletion
Service termination
Event log clearing

7 Extortion Phase

After encryption:

Custom ransom notes are dropped
Victims are contacted through affiliate-controlled portals
Stolen data is listed for leak if ransom is not paid

Branding varies per affiliate.

Impacted Assets

Common targets:

Domain controllers
File servers
Backup repositories
ESXi hypervisors
NAS devices
Shared cloud storage

Industries impacted:

Retail
Manufacturing
Logistics
Healthcare
Professional services
Managed service providers

Malware & Payload Characteristics

Lineage

Derived from leaked Conti ransomware
Modified for affiliate use
Hardened against analysis

Payload Formats

Windows: .exe
Linux: ELF binaries
ESXi: VM-specific encryptors

Encryption Behavior

Rapid file enumeration
Campaign-specific extensions
Encrypted headers with unique markers
Network share awareness

Known Indicators of Compromise (IOCs)

1 File Hashes

c5554ab2ea04e9d938a47b09ea34ebedb46c223a500aa70f08f4b2dc6864bd90
9baf3c61f6e0d0c21a7e4bb8e58fdb20a3e3d3bbf0cfd8d54a6d6c7f6b87c1aa
3a6f1b8f0e5d4a7a6b2c1f0d9e8a7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2
f71e8c09c4b5d2a1a3f6e4b8c7d9a0e1f2c3b4a5d6e7f8091a2b3c4d

2 Mutexes

hsfjuukjzloqu28oajh727190
Global\DFRuntimeLock
Global\EncryptSession
Global\DragonForce

3 Driver Abuse

truesight.sys
rentdrv2.sys

4 Ransom Note Filenames

README_RESTORE_FILES.txt
RECOVER-DRAGONFORCE.txt
HOW_TO_DECRYPT.html

5 Network Indicators

193.233.175.213
95.164.53.64
91.108.244.85
46.29.238.160
46.29.238.123
87.121.47.15
185.225.74.101
176.113.115.90

6 Suspicious Commands

vssadmin delete shadows /all /quiet
wmic shadowcopy delete
bcdedit /set {default} recoveryenabled No
net stop WinDefend
sc stop Sense
schtasks /create

Threat Hunting Queries

1 Windows – Shadow Copy Deletion

Splunk / SIEM

EventCode=4688
(ProcessName="vssadmin.exe" OR ProcessName="wmic.exe")
(CommandLine="*delete*" AND CommandLine="*shadow*")

2 Driver Installation Detection

EventCode=7045
(Image="*truesight.sys" OR Image="*rentdrv2.sys")

3 EDR Termination Attempts

EventCode=4688
(CommandLine="*sc stop*" OR CommandLine="*taskkill*")

4 Mass File Encryption Behavior

EventCode=4663
AccessMask=0x2
| stats count by ProcessName, Computer
| where count > 500

5 Lateral Movement via PsExec

ServiceName="PSEXESVC"

6 Data Exfiltration Hunt

OutboundBytes > 500MB
AND DestinationIP NOT IN known_business_ips
AND SourceRole IN ("FileServer","DomainController")

Detection Engineering Guidance

High-confidence detection requires correlation, not single alerts.

Trigger when:

Driver install
Shadow deletion
Mass file writes
occur within the same host and timeframe.

Behavioral chains are far more reliable than hashes.

Containment & Response Playbook

Immediate:

Network isolate affected hosts
Disable compromised accounts
Preserve memory and disk images
Block observed IPs

Short-term:
5. Remove vulnerable drivers
6. Rotate credentials
7. Rebuild systems from clean backups
8. Validate backup integrity

Long-term:
9. Enforce MFA everywhere
10. Block BYOVD via EDR
11. Segment networks
12. Monitor admin activity aggressively

Strategic Assessment

DragonForce’s cartel model ensures:

Faster attack cycles
Higher attack volume
Lower attribution confidence
Persistent threat even after takedowns

Organizations must prioritize identity security, EDR hardening, and behavioral detection.

This threat is operational, scalable, and ongoing.