DragonForce Ransomware Expands Its Affiliate Model and Extortion Services

Oct 14, 2026 · Original article ↗

Summary

Bitsight profiles DragonForce’s ransomware operation, detailing its affiliate model, malware variants, attack techniques and reported incidents. The group is also recruiting technical specialists and offering analysis of stolen data to support extortion.

Key points

The financially motivated ransomware operation should not be conflated with DragonForce Malaysia; any connection between them remains unconfirmed.
DragonForce began with a LockBit 3.0-based build and later used a modified Conti v3 variant with configurable encryption and security-tool evasion features.
Its affiliate model provides ransomware builders, management tools, infrastructure, and a white-label option; affiliates conduct operations under their own brands.
Bitsight reported September 2026 leak-site posts recruiting developers, reverse engineers, and vulnerability researchers, and advertising analysis of stolen files to aid extortion.
In a May 2025 incident, responders linked a DragonForce deployment and data theft affecting an MSP and downstream clients to an attack on its SimpleHelp environment; analysts assessed a chain of three SimpleHelp flaws with medium confidence.
Reported techniques include valid-account access, help-desk impersonation, RMM abuse, Mimikatz, Cobalt Strike, SystemBC, data theft before encryption, and BYOVD to disable security tools.
The article recommends phishing-resistant MFA, patching and segmenting RMM systems, monitoring for data theft and tampering, and maintaining tested offline or immutable backups.

Article Details

Attack Vectors: Affiliates have used valid accounts, exposed remote access, help-desk impersonation, exploitation of public-facing applications, and compromised MSP or RMM environments for initial access.
In a May 2025 incident, investigators found a threat actor breached a managed service provider's SimpleHelp RMM environment and pivoted into customer networks; analysts assessed with medium confidence that CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726 were chained in the intrusion.
Reported post-compromise activity includes PowerShell execution, scheduled tasks, Mimikatz and LSASS credential dumping, discovery and network scanning, lateral movement over RDP, security-tool tampering, log and shadow-copy deletion, and data theft before encryption.
The article reports Cobalt Strike over HTTP and SystemBC use as a backdoor and proxy. DragonForce payloads have encrypted Windows and VMware ESXi environments.
Defensive Notes: Require phishing-resistant MFA for remote and privileged access; use documented identity verification and out-of-band callbacks for password resets or MFA re-enrollment.
Patch SimpleHelp and other RMM platforms, segment RMM infrastructure from customer networks, restrict vendor access, and monitor mass deployments and scripts.
Enable EDR tamper protection; apply Microsoft vulnerable-driver block rules and monitor for new kernel-driver installations, including TrueSight.sys and RentDrv.sys.
Separate VMware ESXi and vCenter management from user networks, use dedicated administrator identities and MFA, and monitor for PowerShell downloads, Cobalt Strike, SystemBC, Mimikatz, ADFind, unusual scanners, and unexpected RDP activity.
Detect bulk file access, archive creation, unusual outbound transfers, and data staging before encryption. Maintain offline or immutable backups, test restoration, and alert on shadow-copy deletion or backup tampering.
Treat DragonForce leak-site entries as unverified claims until corroborated.

Indicators of compromise

Type	Indicator	Context
IPV4	`185[.]73[.]125[.]8`	Historical Cobalt Strike infrastructure observed in a 2023 case.
IPV4	`94[.]232[.]46[.]202`	Historical SystemBC infrastructure observed in a 2023 case.
MD5	`2915b3f8b703eb744fc54c81f4a9c67f`	MD5 listed among Bitsight CTI indicators associated with DragonForce threat data.
MD5	`97b70e89b5313612a9e7a339ee82ab67`	Historical hash of a SystemBC sample from the same investigation as the reported infrastructure.
SHA1	`e10361a11f8a7f232ac3cb2125c1875a0a69a3e4`	SHA-1 listed among Bitsight CTI indicators associated with DragonForce threat data.
SHA256	`9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507`	SHA-256 listed among Bitsight CTI indicators associated with DragonForce threat data.