DragonForce-Linked Ransomware Attack Exfiltrated Data Before Encrypting Manufacturing Systems

Summary

Darktrace describes a manufacturing customer attack involving scanning, credential brute-forcing, data exfiltration over SSH, and file encryption over SMB. The ransom note claimed DragonForce affiliation, which the case study says is unconfirmed.

Key points

An infected device scanned the internal network and attempted to brute-force administrative credentials; the initial access method was not established.
After an eight-day lull, suspicious Windows Registry activity and first-time use of a privileged administrator credential were observed.
Multiple devices exfiltrated data over SSH to 45.135.232[.]229, an endpoint associated with hosting provider Proton66.
On September 9, devices wrote a ransom note and encrypted files over SMB using the .df_win extension.
The ransom note claimed DragonForce affiliation, but the case study did not confirm the attackers’ relationship to the group.
Darktrace detected activity during the attack, but Autonomous Response was not configured, and the incident progressed to exfiltration and encryption.

Article Details

Victim Organization: Not disclosed
Incident Type: DragonForce-linked ransomware attack involving data exfiltration and file encryption over SMB. The ransom note claimed affiliation with DragonForce, but that affiliation was not confirmed.
Disclosure Date: 2025-11-05
Operational Impact: Multiple devices were observed exfiltrating data and encrypting files. The source does not report the number of affected devices or any broader operational disruption.
Ransom Or Extortion: Ransom notes were written to multiple locations and claimed DragonForce affiliation. No ransom demand, payment, or confirmed extortion outcome was reported.
Claim Status: confirmed