Executive Summary

A new Ransomware-as-a-Service (RaaS) group, DragonForce, has been identified and is being monitored by security analysts. The group is notable for its strategy, which involves building its malware on the leaked source code of two of the most infamous ransomware families in history: LockBit 3.0 and Conti. DragonForce is marketing its services to affiliates via a platform named 'Ransombay' and appears to be consolidating power by absorbing smaller ransomware operations. This development highlights the continued evolution and industrialization of the ransomware threat, where dismantled groups' tools are quickly repurposed by new actors.

Threat Overview

The emergence of DragonForce as a self-proclaimed "ransomware cartel" is a significant development. By leveraging the proven and effective codebases of LockBit and Conti, the group can bypass much of the initial development effort and immediately deploy a sophisticated and feature-rich ransomware payload. This allows them to focus on recruitment, operations, and marketing their 'Ransombay' platform to a wide pool of potential affiliates. The strategy of absorbing rival groups suggests an ambition to quickly become a dominant player in the RaaS market, similar to how Conti operated at its peak.

Technical Analysis

While specific attacks have not yet been detailed, the malware's lineage provides insight into its likely capabilities:

• Inherited TTPs: The ransomware payload will likely incorporate the most effective features from both LockBit and Conti.
  • From Conti: Advanced lateral movement capabilities using tools like PsExec, multi-threading for rapid encryption, and the double-extortion model with a dedicated leak site.
  • From LockBit 3.0: Highly efficient and fast encryption, advanced anti-debugging and evasion techniques, and the ability to delete Volume Shadow Copies to inhibit recovery (T1490 - Inhibit System Recovery).
• RaaS Platform ('Ransombay'): This platform will provide affiliates with the ransomware builder, a management panel to track victims, and a negotiation portal. This lowers the barrier to entry for less skilled criminals to conduct ransomware attacks (T1608.003 - Install Digital Certificate).
• Likely Attack Chain: Affiliates will use common initial access vectors (phishing, stolen credentials, vulnerability exploitation) to gain entry, then use the DragonForce payload to encrypt the network and exfiltrate data.

Impact Assessment

The emergence of a well-organized group like DragonForce, armed with top-tier ransomware code, increases the threat level for organizations globally. The group's professionalized approach and RaaS model mean we can expect an increase in the frequency and scale of attacks as they onboard more affiliates. The use of proven code means that many existing defenses may be challenged. The cartel-like strategy could also lead to less competition and more collaboration among top-tier criminals, further refining their TTPs and increasing their success rate.

IOCs

Cyber Observables for Detection

As DragonForce uses Conti and LockBit code, observables for those families are relevant for hunting:

Detection & Response

• Behavioral Detection: Focus on detecting the behaviors of ransomware, not just signatures. EDR tools should be configured to alert on processes that rapidly read/write/rename large numbers of files, delete shadow copies, or disable security tools.
• D3FEND: Process Analysis (D3-PA): Since the code is based on known families, existing behavioral rules in EDRs for detecting Conti and LockBit should be effective against DragonForce, provided they haven't significantly altered the core logic.
• Threat Intelligence: Monitor threat intelligence feeds for new IOCs (hashes, C2 domains, wallet addresses) associated with DragonForce and its Ransombay platform as they become available.

Mitigation

Defenses against DragonForce are the same as for other top-tier ransomware groups:

• Security Fundamentals: Implement robust patch management, enforce MFA on all external services, and maintain a principle of least privilege.
• Immutable Backups: This is the single most important mitigation. Maintain tested, offline, and immutable backups to ensure you can recover without paying a ransom.
• Network Segmentation: Prevent lateral movement by segmenting the network. This can contain an infection to a single segment and prevent a full-scale enterprise-wide encryption event.
• User Training: Train users to spot and report phishing, a primary initial access vector for ransomware affiliates.