DragonForce Ransomware Attacking Critical Business to Exfiltrate Sensitive Information

Cybersecurity: DragonForce Ransomware Overview

As of late 2023, the DragonForce ransomware operation has emerged as a significant threat to global organizations. This sophisticated malware campaign targets critical business infrastructure across multiple industries by employing advanced techniques to encrypt files and exfiltrate sensitive corporate data.

DragonForce operates on a ransomware-as-a-service model, providing cybercriminal affiliates with a comprehensive toolkit to execute attacks. It employs a dual-extortion strategy wherein attackers encrypt business data while simultaneously stealing sensitive information before encryption occurs.

Extortion Tactics

The stolen data serves as leverage for extortion, with attackers threatening to publish it on dark web leak sites unless the ransom is paid. This tactic increases pressure on victims who might otherwise rely on backups for data recovery.

Targeted Sectors and Regions

The ransomware predominantly targets the manufacturing, business services, technology, and construction sectors. Organizations in the United States, United Kingdom, Germany, Australia, and Italy have reported the highest concentration of attacks.

Technical Capabilities

DragonForce is noted for its adaptability and multi-platform capabilities, affecting Windows, Linux, ESXi, BSD, and NAS systems. It supports various encryption modes, including full, header, and partial encryption, with customizable options for individual files and delayed-start features for timed attacks.

Technical Capabilities and Infection Methods

DragonForce's technical sophistication includes multithreading capabilities to enhance encryption performance and detailed logging for process tracking. The ransomware allows dry runs without actual encryption, enabling affiliates to test attacks. It offers unlimited storage with dedicated infrastructure and provides free partner services, including professional file analysis and decryption support.

During execution, DragonForce performs network reconnaissance by scanning SMB ports to identify vulnerable systems. It uses a mutex identifier documented in samples from leaked Conti ransomware source code, indicating code reuse. The ransomware deletes volume shadow copies using WMIC commands to prevent file recovery from backup snapshots.

Security Recommendations

Security experts recommend implementing multifactor authentication across all systems, maintaining rigorous patch management, and regularly backing up files to facilitate recovery. Enabling advanced endpoint detection, anti-ransomware protection with shadow copy preservation, and application control is advised to prevent unauthorized execution.