DragonForce Ransomware Breakdown and Decryptor for ESXi & Windows

Overview of DragonForce Ransomware Operation

Security researchers have released a comprehensive technical analysis of the DragonForce ransomware operation, including working decryptors for Windows and ESXi systems aimed at specific victims. By the time its dedicated Data Leak Site (DLS) was identified, 17 victim organizations had been listed.

DragonForce operates under a Ransomware-as-a-Service (RaaS) model, offering affiliates up to 80% of ransom proceeds. It heavily utilizes the leaked LockBit 3.0 and Conti code, with one variant being assessed as a Conti-lineage DragonForce variant. Binary similarity analysis indicates over 90% functional overlap with LockBit 3.0, suggesting the use of the leaked LockBit Black builder while retaining Conti-style logic and configuration behavior.

Infrastructure and code overlaps link DragonForce to other groups such as BlackLock and RansomHub, with shared or duplicated code and nearly identical ransom notes. DragonForce has compromised other groups' infrastructure through vulnerabilities, exposing internal data. The group has also attempted to form alliances with other ransomware groups for coordinated operations.

DragonForce ransomware employs custom string obfuscation, decrypting strings at runtime. It supports five command-line arguments, including the -m flag, which controls encryption mode (local, network, or mixed). File encryption uses the ChaCha8 stream cipher, with each file receiving a unique session key and metadata containing encryption details.

An RSA-4096–encrypted structure with the ChaCha8 key and nonce. A 1-byte encryption type constant (full, header-only, or partial). A 1-byte encryption ratio. An 8-byte field storing the original file size.

Encryption varies by file type and size, with full encryption applied to database-like formats and partial encryption for virtual machine and disk image files. Network mode targets specific share types via SMB while skipping ADMIN$. Additional options allow for filename encryption and desktop wallpaper modification.

Decryptor for Windows and ESXi Targets

The S2W Threat Research and Intelligence Center (TALON) has developed a DragonForce decryptor, tailored for specific victims. It includes a Windows decryptor and three ESXi decryptors. The Windows tool scans for files with the .RNP extension, decrypts them using the embedded RSA-4096 private key, and restores original content.

For ESXi, encrypted files are identified by a specific extension and a magic value derived from a "build_key". The decryptor verifies the match before proceeding with decryption, allowing complete recovery of affected data for specific victims. While the toolset is not universally applicable, it offers a chance for recovery and insight into the ransomware's encryption design.

Based on reporting by GBHackers.