Researchers Breakdown DragonForce Ransomware Along with Decryptor for ESXi and Windows Systems

Cybersecurity: DragonForce Ransomware Analysis

DragonForce has emerged as a ransomware-as-a-service (RaaS) operation, targeting both Windows and VMware ESXi environments. Initially identified in Dec 2023 on BreachForums, this group employs stolen data and a dark web platform to apply pressure on victims.

The ransomware payload is derived from the leaked LockBit 3.0 and Conti code, optimized for high-speed encryption of local disks and network shares. Access is usually obtained through exposed remote desktop servers, with tools like Cobalt Strike and SystemBC facilitating lateral movement before ransomware deployment.

Impact includes encrypted file servers, virtual machines, and potential public release of stolen data.

The DragonForce ransomware employs ChaCha8 and RSA-4096 encryption for secure file encryption. Configuration settings allow affiliates to select targets and adjust encryption parameters for efficiency.

Command-line flags enable specific operations, such as:

This command directs the malware to target network paths using multiple threads.

S2W researchers have developed a decryptor for both Windows and ESXi systems, enabling some victims to recover without paying a ransom. The Windows tool identifies .RNP files, while the ESXi version targets .RNP_esxi files with a specific build_key.

These tools map the decryption process from RSA key loading to metadata parsing and file restoration.

The ransomware skips critical system areas during its scan of local and remote paths, encrypting selected files. For large virtual disk images, it encrypts only sections to conserve time. Encrypted files contain metadata with an RSA-encrypted ChaCha8 key and flags denoting mode, ratio, and original size.

This technical analysis provides valuable insights into DragonForce's operations and available recovery options.

Based on reporting by Cyber Security News.