Inside the Ecosystem, Operations: DragonForce

Malware Analysis
1

Author: Byeongyeol An, Gahyun Choi | S2W TALON

This Figure was generated using Google Gemini Nano Banana

Executive Summary

  • (Introduction) DragonForce is a ransomware group active since December 2023. It operates under a Ransomware-as-a-Service (RaaS) model and promotes itself as a cartel to expand its influence.
  • (Victims) DragonForce ransomware carried out attacks against 363 companies from December 2023 to January 2026, showing an increasing trend in activity starting in 2025.
  • (Group Profiling) The DragonForce ransomware group is active on several dark web forums, including BreachForums, RAMP, and Exploit.
    - DragonForce distinguishes itself from other RaaS groups by offering services beyond standard ransomware operations.
    - DragonForce has targeted rival groups and formed public alliances to strengthen its position within the ransomware ecosystem.
  • (Other Related Group) Groups associated with DragonForce include BlackLock, RansomHub, Scattered Spider, DEVMAN, and LockBit.
  • (Affiliate Infiltration Findings) DragonForce’s affiliate panel provides functionality for client management, build generation, team coordination, content publishing, and support ticket handling.
  • (Binary Analysis) DragonForce ransomware exists in versions for Windows and Linux (ESXi, NAS, RHEL).

Introduction

DragonForce is a ransomware group that first emerged on December 13, 2023, when a user identified as @dragonforce on BreachForums uploaded stolen data. The group developed and deployed its own ransomware based on the leaked LockBit 3.0 (LockBit Black) and Conti source code. As of January 2026, we confirmed that the LockBit 3.0–based DragonForce builder is no longer available.

In addition, DragonForce operates the “RansomBay” service to support affiliates with customized payload generation and configuration options, while promoting itself as a ransomware cartel to expand its influence in the RaaS ecosystem.

Figure 1. A post uploaded to BreachForums by the user @dragonforceFigure 2. The DragonForce data leak site (DLS)

Victims

After posting its first victim to its Data Leak Site (DLS) on December 6, 2023, DragonForce began regularly publishing victim organizations. As of January 2026, the group listed a total of 363 victim companies on its DLS. In the early phase of its activity, DragonForce disclosed 22 victim organizations in December 2023, after which the number of published victims gradually increased. Activity peaked in December 2025, when the group published a monthly high of 35 victim companies, marking its highest level of activity.

Figure 3. Monthly attack trends of the DragonForce group

Group Profiling

DragonForce expanded its influence across dark web forums by recruiting affiliates and promoting its services while emphasizing its differentiation from other groups. This strategy increased its presence and scale within the RaaS market. We identified the group’s operational methods, inter-group relationships, internal rules, and the services offered on the dark web.

Operations

DragonForce operated on dark web forums to leak stolen data, promote its RaaS operations, and recruit pentesters. The group maintained a presence on BreachForums, RAMP, and Exploit, where it advertised its RaaS services and recruited affiliates and pentesters. In its recruitment efforts, DragonForce emphasized differentiated offerings — such as the DragonForce Ransomware cartel, RansomBay, Harassment Calling, and Data Analysis — to distinguish itself from other ransomware groups.

Table 1. DragonForce Operator Activity ListTable 2. Specialized Services

DDW Ecosystem: Associated & Adversarial Groups

Analysis of activity on the DDW forum indicates that DragonForce adopted different approaches toward other ransomware groups. In some cases, it engaged in adversarial relationships through infrastructure-level attacks, while in others, it demonstrated associations based on similarities in source code, binaries, and ransom notes. DragonForce also attempted public cooperation with Qilin and LockBit. The following groups either maintained adversarial relationships with DragonForce or showed signs of operational association.

Table 3. Groups adversarial to or associated with DragonForce

Affiliate Infiltration Findings

To better understand DragonForce’s operational model, we accessed the group’s affiliate panel and analyzed its internal services. The affiliate panel consists of eight subpages. In addition to victim tracking and build generation, it includes features that grant access permissions to external affiliates.

Compared to the findings published by Group-IB in December 2024, DragonForce’s affiliate panel no longer exposes the vulnerable driver selection option related to BYOVD (Bring Your Own Vulnerable Driver) techniques and has removed the LockBit source code–based builder. However, analysis of the generated ransomware binaries shows that the BYOVD-based process termination functionality remains integrated into the binary and continues to operate as part of the default implementation. At the same time, the panel introduced a beta version that enables extension-based encryption mode configuration.

Figure 4. DragonForce affiliate panelTable 4. Functional roles of pages within the DragonForce affiliate panel

Binary Analysis: Windows Version

Compared to the DragonForce ransomware analyzed in December 2025, samples generated through the panel’s builder maintained identical core functions, including the encryption routine and process termination via the BYOVD (Bring Your Own Vulnerable Driver) technique. However, they introduced structural changes in the metadata and configuration layout. This report highlights these differences, while a detailed analysis of the previously examined DragonForce ransomware appears below.

Default Build Option

In general, operational settings like the encryption scope (All, Local, Network, Paths) and exclusion lists depend on the values chosen during the build process. The default configuration values in the panel are as follows.

Table 5. Default build options (Windows version)

Config

The config structure is identical to the previous version, except for the addition of the “encryption_rules” field. Upon execution, the ransomware decrypts the embedded config using the ChaCha8 algorithm, and this decryption routine remains unchanged from the previous build.

In beta build, the newly introduced “encryption_rules” field defines per–file extension encryption mode overrides. If the operator does not configure the per-extension override option (Extension for overridden mode, Pick locker mode for this extension), the ransomware applies full, partial, or header-based encryption according to file size. When the operator explicitly assigns an encryption mode to specific file extensions, the ransomware applies the defined method (full, partial, or header) to those extensions regardless of file size.

Figure 5. File extension–based encryption mode override feature in the builderTable 6. DragonForce configuration details

Metadata

Our analysis shows that the DragonForce ransomware expanded the Encryption Ratio field in its metadata structure from 1 byte to 4 bytes, resulting in a 3-byte increase in the total metadata size appended to encrypted files (from 534 bytes to 537 bytes). The updated metadata structure is shown below.

Figure 6. Updated structure of the appended metadata

Binary Analysis: Linux Version(ESXi, NAS, RHEL)

The Linux versions (ESXi, NAS, and RHEL) are functionally identical. The core processes, including configuration decryption and encryption algorithms, are identical to those in the Windows version. However, the ESXi version additionally implements virtual machine shutdown handling and collects ESXi environment and user information. These features are absent in the NAS and RHEL versions.

The Linux version of the DragonForce ransomware performs the following key behaviors. Upon execution, it parses command-line arguments and runs as a background daemon when invoked with the “-d” option. It then performs logging, delayed execution, and system information collection before initiating file encryption. After encrypting files, the ransomware encodes file names and modifies the MOTD file, completing the execution flow.

Figure 7. Execution flow of the DragonForce ransomware (Linux version)

Default Build Option

The Linux builder, similar to the Windows version, applies encryption modes and exclusion lists based on user-defined settings. The panel provides the following default configuration values.

In the Linux build, when the extension-based encryption mode override feature (Extension for overridden mode, Pick locker mode for this extension) is not configured, the ransomware encrypts files according to the default encryption mode(full, partial, or header) specified at build time.

When the attacker defines a specific encryption mode for selected file extensions through the builder options, the ransomware encrypts those extensions using the specified mode, regardless of the default encryption mode.

Table 7. Default build options (Linux version)

Key Takeaways

  • (Ecosystem-Driven Expansion of Influence) DragonForce has been expanding its operational scope through attacks on other groups as well as through cooperative relationships, which is assessed as an effort to strengthen its position within the ransomware ecosystem.
  • (A Shift in DragonForce Strategic Objectives) Compared to findings reported by Group-IB, changes in both the affiliate panel and the ransomware binaries indicate that DragonForce has continuously developed and maintained its infrastructure and malware.
Figure 8. Diamond Model:DragonForce

copyrightⓒ 2026 All rights reserved by S2W Inc.

Inside the Ecosystem, Operations: DragonForce was originally published in S2W BLOG on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: https://medium.com/s2wblog/inside-the-ecosystem-operations-dragonforce-11048db4cbb0?source=rss----30a8766b5c42---4