DragonForce Ransomware Decryption & Data Recovery

DragonForce first appeared in August 2023, initially generating payloads straight from the leaked LockBit 3.0 builder. It opened an affiliate programme in June 2024, shipped its own encryptor built on modified Conti v3 source in July 2024, and added a Linux variant tuned for VMware ESXi in November 2024.

The turning point came in March 2025, when DragonForce rebranded itself as a ransomware cartel and launched RansomBay, a white-label service letting affiliates run their own brand while DragonForce supplies the encryptor, negotiation portal, leak-site hosting and technical support for roughly a 20% cut. The practical consequence is that ransom-note branding varies wildly across incidents while the underlying encryptor and infrastructure stay the same, which genuinely complicates family attribution.

In spring 2025 DragonForce entered mainstream awareness through the chain of UK retail attacks: Marks & Spencer, Co-op and Harrods were hit within weeks. Public analysis attributes initial access to English-speaking crews in the Scattered Spider mould - specialists in voice social engineering, help-desk impersonation and MFA fatigue - with DragonForce handling deployment and extortion. That pairing of social-engineering access with a mature encryptor sidesteps defences built primarily around vulnerability scanning.

Activity has not slowed: through the first half of 2026 DragonForce kept posting roughly 28 to 30 victims a month, passing roughly 650 named organisations across 65 countries, concentrated in professional services, manufacturing and technology. No public report confirms a targeted campaign against mainland China organisations, but its preferred entry points - edge vulnerabilities of the Ivanti and Log4j class, compromised RMM platforms enabling supply-chain style spread, and exposed ESXi - are just as common locally, and Chinese branches of multinationals should treat this as in scope.

Extension and naming. The in-house encryptor replaces the entire original filename with a random Base32 string and appends .dragonforce_encrypted, so contract.pdf becomes something like 3krbgdxb.dragonforce_encrypted. Original names cannot be recovered from the encrypted file itself, which materially complicates putting restored data back where it belongs. The .df_win extension has also been observed, while early LockBit 3.0-builder payloads used random-character extensions.

Ransom note. readme.txt (Contact Us.txt in some samples) is dropped on the desktop and in each encrypted directory, and frequently also into web roots such as inetpub and wwwroot so it is visible externally. It supplies a Tor portal and a victim-specific token, with no email address.

Attribution difficulty created by the cartel. Under RansomBay white-labelling, the note may carry an entirely unfamiliar brand and point to a different leak site, while the encryptor behaviour, file trailer structure and ESXi-side command patterns remain identical. Identification therefore depends on sample analysis rather than the brand name.

Other indicators. Mimikatz, PsExec, OpenVAS scanning traces, unusual SMB traffic, and tampered registry keys and security software. In ESXi cases, VM files under /vmfs/volumes are encrypted while the host still boots - the encryptor carries whitelists specifically to preserve host bootability.

DragonForce's affiliate ecosystem is large and access methods vary, but public analysis keeps surfacing the same categories:

• Edge device exploitation. Ivanti Connect Secure flaws (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893) and Apache Log4j2 among others, used to take a DMZ foothold directly.
• Social-engineering access. Working with Scattered Spider-style crews that call the IT service desk impersonating staff to force password resets, run MFA fatigue campaigns, or use SIM swapping to obtain legitimate accounts. Such intrusions look entirely legitimate in logs and were central to the UK retail chain of incidents.
• RMM platforms. Exploiting flaws in remote management products such as SimpleHelp to enter a service provider environment and then push payloads to downstream customers through the management channel - a supply-chain style spread that is especially dangerous for MSPs and shared group IT platforms.
• Stolen credentials and VPN. Accounts sourced from infostealer logs and dark-web markets.
• Lateral movement and escalation. Mimikatz credential dumping, PsExec, RDP and domain admin takeover, prioritising domain controllers and the virtualisation management plane.
• Exfiltration completed before encryption, feeding double extortion and harassment calls.

From a Chinese perspective the last two deserve the most attention: group enterprises and manufacturers commonly run a shared IT services platform with a broad array of remote maintenance tools, and once that management channel falls, spread is far faster than host-by-host intrusion.

Algorithms. The in-house encryptor uses ChaCha8 for content and RSA-4096 to protect each file's symmetric key; early LockBit 3.0-builder payloads inherit LockBit's scheme. Both are designed so that without the operator's private key there is nothing to reverse.

Speed optimisation. Large files are encrypted in blocks with skipping (block size and stride are visible in configuration parameters) so a whole estate can be processed inside a short window. For recovery this means virtual disks and database files may retain long untouched stretches, the main basis for structural repair - though how usable that is must be measured per sample.

Virtualisation. The Linux/ESXi variant encrypts VM files directly under /vmfs/volumes while maintaining whitelists of system directories, extensions and filenames so the host still boots. Keeping the host alive while the business stops is deliberate: it preserves the negotiation channel.

Recovery inhibition. Volume shadow copies deleted, boot-time recovery options disabled, database and backup services stopped, and reachable backup storage and network shares encrypted where possible.

Filename randomisation. Original names are replaced entirely, so restoring directory structure later relies on backup catalogues, database-internal metadata or content-based identification.

Beyond double extortion. The DragonForce ecosystem also sells harassment calling against victims and data analysis services to sharpen extortion leverage.