TL;DR

DragonForce is no longer a ransomware group. It is a ransomware platform — a cartel-style franchise that lets criminal affiliates conduct attacks under their own brand names while quietly running on shared DragonForce infrastructure, tooling, and extortion support. Built on the leaked source code of LockBit 3.0 and Conti V3, the group has logged 504 confirmed victims as of today, struck four U.S. targets in a single 24-hour window on April 27, 2026 (including a Massachusetts state development agency), and previously crippled three of the UK's largest retailers simultaneously. This is not a group you can afford to treat as a named APT you monitor from a distance. DragonForce is the infrastructure layer for a growing slice of ransomware attacks you will encounter in 2026.

---

Background: From Protest to Profit

DragonForce first appeared in late 2023 as a pro-Palestine hacktivist collective, conducting DDoS attacks and website defacements typical of politically motivated threat actors. By early 2024, the group made a decision most security researchers did not anticipate at the time: it pivoted entirely to financially motivated ransomware operations, discarding the hacktivist label while quietly retaining the geopolitical intelligence instincts that now inform target selection.

The acceleration was rapid. Within six months of its ideological pivot, DragonForce was recruiting on underground forums — specifically RAMP, the Russian Anonymous Marketplace Proxy — openly advertising affiliate positions and partnership arrangements. By mid-2024 it had released two distinct ransomware variants and launched a dedicated Tor leak site. By Q4 2024, it had begun offering what would become its defining innovation: a white-label "cartel" model allowing affiliates to operate their own ransomware brands using DragonForce backend infrastructure.

That innovation is what separates DragonForce from legacy RaaS operators like LockBit or Conti, and why it represents a qualitatively different threat in 2026.

---

Technical Analysis

The Ransomware Stack: Standing on Giants' Shoulders

DragonForce's technical effectiveness is grounded in a smart piece of strategic theft: its payload lineage traces directly to leaked source code from LockBit 3.0 (LockBit Black) and Conti V3. Rather than building encryption routines from scratch — a notoriously difficult engineering challenge — DragonForce's developers began with battle-tested, operationally proven code and extended it.

Variant 1 (Early 2024): The initial payload used LockBit 3.0 as its foundation, inheriting LockBit's highly efficient ChaCha20/ECDH encryption scheme, its anti-analysis features (debugger detection, anti-emulation loops), and its shadow copy deletion routines. Notably, the original DragonForce variant added comprehensive logging of all file operations during encryption — a forensic detail that allows operators to confirm successful payload execution but also leaves artifacts that defensive tools can detect.

Variant 2 (July 2024): Four months after Variant 1, DragonForce released a second payload built on Conti V3 source code, offering affiliates a choice of codebase. The Conti-derived variant provided enhanced customization options, different ransom note templates, and modified persistence mechanisms. The parallel availability of both variants through the affiliate portal ("Ransombay") means two different attacks attributed to DragonForce may exhibit entirely different technical signatures — a deliberate detection evasion strategy.

Current cross-platform targeting:

• Windows (primary target, both variants)
• Linux / VMware ESXi (encrypted using the Conti-lineage variant)
• BSD and NAS devices (affiliate-configurable)

Attack Chain: Initial Access Through High-Value Vulnerabilities

DragonForce and its affiliates have been documented exploiting a range of known vulnerabilities for initial access, with a clear preference for publicly disclosed, high-CVSS vulnerabilities in perimeter-facing software during the window between patch release and widespread deployment:

• VPN appliances: Fortinet FortiOS, Citrix Netscaler (CVE-2023-4966, "CitrixBleed")
• File transfer services: MOVEit Transfer, GoAnywhere MFT
• Exchange servers: ProxyShell-family vulnerabilities
• RDP exposure: Brute-forced or credential-stuffed RDP as tertiary access vector

Post-access, the group follows a structured playbook:

1. Reconnaissance: whoami, net user, nltest commands; BloodHound AD enumeration

2. Credential harvesting: Mimikatz, LaZagne; LSASS memory dump via comsvcs.dll

3. Lateral movement: PsExec, WMI, DCOM-based propagation; living-off-the-land via PowerShell

4. Data staging: 7-Zip archiving to temp directories; Rclone for exfiltration to affiliate-controlled cloud storage

5. Defense evasion: VSS deletion (vssadmin.exe delete shadows /all /quiet), Windows Defender disablement via registry modification

6. Deployment: Batch scripts deploying encrypted payload via GPO or PsExec across domain-joined systems

The White-Label Cartel: Technical Architecture of a Franchise

This is the genuinely novel innovation. The "Ransombay" affiliate portal — accessible via authenticated Tor onion address — provides affiliates with:

• Customizable payload builder: Affiliates configure encryption targets, excluded directories, ransom note text, and contact details. The underlying binary remains DragonForce infrastructure but surface indicators point to the affiliate's brand.
• Shared leak site hosting: Victims' stolen data is listed on DragonForce's main leak site OR on affiliate-branded sub-sites sharing the same backend infrastructure.
• Negotiation support: DragonForce operators handle ransom negotiations for affiliates who lack the English fluency or operational experience to manage them.
• Revenue split: DragonForce retains 20% of ransom payments; affiliates keep 80%.

The practical consequence: a ransomware attack you attribute to "VendorForce Ransomware" or some other named brand may, under the hood, be running DragonForce tooling, exfiltrating to DragonForce servers, and generating revenue for DragonForce operators. Attribution becomes deliberately obfuscated. Victim count figures for "DragonForce" are likely significant undercounts.

---

Recent Victim Activity (April 27, 2026 — 24 Hours Prior)

In a single 24-hour window ending April 28, DragonForce claimed responsibility for four confirmed attacks:

| Victim | Sector | Country | Significance |

|--------|--------|---------|--------------|

| MassDevelopment (massdevelopment.com) | State Government / Finance & Development Agency | USA (Massachusetts) | Critical state infrastructure; handles municipal bonds, brownfield redevelopment, financing programs |

| AOTCO Metal Finishing, LLC (aotco.com) | Defense Industrial Base / Manufacturing | USA | Metal finishing for defense and aerospace components — supply chain exposure |

| Delon Hampton & Associates (delonhampton.com) | Engineering Consulting | USA | Infrastructure design; potential access to project blueprints and government facility data |

| Andrew T. Johnson (andrewtjohnson.com) | Printing / Reprographics | USA | Lower strategic value; likely opportunistic affiliate |

The MassDevelopment hit is the most operationally significant. State development agencies maintain financial records, active financing arrangements with municipal governments, and sensitive economic development plans. Data exfiltrated from a target of this type has downstream value well beyond the ransom payment itself.

Historical High-Profile Victims

The M&S / Harrods / Co-op trifecta in 2025 remains DragonForce's most visible operational achievement. Three of the UK's most recognized retail brands were compromised in a coordinated window, causing significant operational disruption and customer data exposure. Reuters confirmed DragonForce's attribution for the M&S incident in July 2025.

---

IOCs / Indicators of Compromise

Network Infrastructure (Active as of April 28, 2026)

| Type | Indicator | Status |

|------|-----------|--------|

| Leak Site (Tor) | z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog | ✅ Active (100% 30d uptime) |

| Primary File Server (Tor) | dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion | ✅ Active (100% 30d uptime) |

| Victim Chat Server (Tor) | 3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion/login | ✅ Active (100% 30d uptime) |

| Tox Contact | 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 | Verified PGP-signed |

File System Indicators

| Indicator | Notes |

|-----------|-------|

| Ransom note: [RANDOMSTRING].README.txt | LockBit 3.0-lineage variant |

| Ransom note: readme.xt (note: .xt not .txt) | Conti V3-lineage variant |

| Encrypted file extension: .[random_alpha] (varies per affiliate build) | Configurable via Ransombay |

| Dropper: Batch/PowerShell scripts in %TEMP% or %APPDATA% | Stage 2 delivery |

| Rclone binary (renamed): often masquerades as svchost.exe, explorer.exe, or MicrosoftEdgeUpdate.exe | Data exfil utility |

MITRE ATT&CK Mapping (Key Techniques)

| ATT&CK ID | Technique | DragonForce Usage |

|-----------|-----------|-------------------|

| T1190 | Exploit Public-Facing Application | FortiOS, CitrixBleed, MOVEit |

| T1003.001 | LSASS Memory Dump | Mimikatz, comsvcs.dll |

| T1482 | Domain Trust Discovery | nltest, BloodHound |

| T1021.002 | SMB/Windows Admin Shares | PsExec lateral movement |

| T1490 | Inhibit System Recovery | VSS deletion |

| T1041 | Exfiltration Over C2 | Rclone to attacker cloud storage |

| T1486 | Data Encrypted for Impact | ChaCha20/ECDH (LockBit lineage), AES-256 (Conti lineage) |

---

Lyrie Take

The DragonForce cartel model is the clearest example yet of why threat actor attribution is becoming operationally insufficient for defense. When a single threat actor's tooling and infrastructure powers dozens of named "sub-brands," the label on the ransom note tells you less than it used to. Blocking or hunting for "DragonForce IOCs" misses every affiliate brand that runs on the same backend.

The deeper problem is structural: the economics of ransomware have inverted. In 2021, sophisticated ransomware required sophisticated operators. Today, DragonForce's Ransombay means that operational sophistication is for rent by the campaign. The skill floor has dropped while the payout ceiling has risen.

Lyrie's autonomous monitoring layer addresses this at the behavior level rather than the attribution level — the encryption activity patterns, VSS deletion sequences, Rclone exfiltration signatures, and LSASS access behaviors are invariant across DragonForce-lineage attacks regardless of which affiliate brand is painted on top. Behavioral detection at machine speed is the only response model that scales against a franchise threat.

One additional concern: state-adjacent targeting is increasing. The MassDevelopment hit is not the first government-adjacent DragonForce claim, and the pattern of hitting U.S. state infrastructure, defense-adjacent manufacturing, and engineering firms suggests either deliberate escalation or affiliate selection bias toward high-ransom public-sector targets. Either way, this is no longer just a commercial risk.

---

Defender Playbook

Immediate Actions (0-48 Hours)

1. Block all known DragonForce Tor onion addresses at DNS/proxy layers — even if you're not in a live incident, denying callhome capability limits damage propagation.

2. Audit Rclone presence — run where rclone and hunt for renamed Rclone binaries masquerading as Windows system processes. Baseline legitimate Rclone installations.

3. Review FortiOS, Citrix, and MOVEit patch status — if any are behind by more than 30 days on CVE patches, treat them as potentially compromised and investigate authentication logs.

4. Enable LSASS protection — set HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1 to enable Protected Process Light for LSASS.

Detection Rules

VSS Deletion (High Confidence):

process where process.name == "vssadmin.exe" and
process.args contains "delete shadows"

Suspicious Rclone Execution (Medium Confidence):

process where process.name not in ("rclone.exe") and
process.args contains ("copy", "sync") and
network.destination.port in (443, 2083, 2087) and
network.destination.address matches wildcard("*.rclone.org*", "*.backblazeb2.com*", "*.mega.io*")

Ransom Note Creation (High Confidence):

file where file.name matches wildcard("*.README.txt", "readme.xt") and
file.path not matches wildcard("*Documents*", "*Downloads*") and
process.name not in ("notepad.exe", "explorer.exe")

Strategic Hardening

• MFA everywhere — VPN, RDP, OWA. Credential-based initial access accounts for the majority of DragonForce affiliate entry points.
• Segment file servers — restrict DFS share access to role-required users; aggressive least-privilege on CIFS/SMB.
• Offline backups, tested quarterly — DragonForce VSS deletion makes VSS snapshots worthless in an active incident. You need air-gapped or immutable backups.
• Canary files — deploy decoy README.txt files in commonly targeted directories; alert on creation of adjacent .README.txt files.
• Behavioral EDR tuning — ensure your EDR is tuned to alert on comsvcs.dll MiniDump invocations, nltest /dclist, and BloodHound execution patterns.

---

Sources

1. RansomLook — DragonForce Group Intelligence: https://www.ransomlook.io/group/dragonforce

2. Loginsoft — DragonForce Technical Analysis (Feb 2026): https://www.loginsoft.com/post/dragonforce-ransomware-technical-analysis-and-mitigation-strategies

3. SentinelOne — From Hacktivists to High Street Extortionists: https://www.sentinelone.com/blog/dragonforce-ransomware-gang-from-hacktivists-to-high-street-extortionists/

4. Trend Micro — Ransomware Spotlight: DragonForce (Oct 2025): https://www.trendmicro.com/vinfo/gb/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce

5. DeXpose — DragonForce Compromises MassDevelopment (Apr 27, 2026): https://www.dexpose.io/dragonforce-compromises-massdevelopment-in-usa-ransomware-attack/

6. Reuters — M&S Cyberattack Carried Out by DragonForce (Jul 2025): https://www.reuters.com/business/retail-consumer/ms-cyberattack-was-carried-out-by-dragonforce-chairman-says-2025-07-08/

7. Hybrid Analysis — DragonForce LockBit/Conti Code Analysis (May 2025): https://hybrid-analysis.blogspot.com/2025/05/shuffling-greatest-hits-how-dragonforce.html

8. Check Point — March 2026 Cyber Threat Report: https://blog.checkpoint.com/research/march-2026-cyber-threat-landscape-shows-no-relief-as-ransomware-rebounds-and-genai-risks-intensify

9. Swiss Cyber Institute — 10 Most Notorious Ransomware Groups in 2026: https://swisscyberinstitute.com/blog/10-most-notorious-ransomware-groups-2026/

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk