Dragonforce

MITRE ATT&CK does not currently catalogue Dragonforce, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: dragonforce executes malicious payloads via PowerShell scripts injected into legitimate processes for command execution.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1685 Disable or Modify Tools Defense Impairment

   What they do: dragonforce disables antivirus tools by terminating security processes and modifying Windows Defender settings.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

3. T1027.002 Software Packing Stealth

   What they do: dragonforce packs its malware binaries to evade static detection by security tools.

   What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.

4. T1070.004 File Deletion Stealth

   What they do: dragonforce deletes Volume Shadow Copies via vssadmin /delete shadows to prevent rollback recovery.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

5. T1110 Brute Force Credential Access

   What they do: dragonforce brute-forces local accounts using Hydra to obtain credentials for initial access.

   What that means: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

6. T1018 Remote System Discovery Discovery

   What they do: dragonforce discovers remote hosts via SMB enumeration to identify high-value targets across networks.

   What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

7. T1135 Network Share Discovery Discovery

   What they do: dragonforce scans network shares using net use commands to discover victim file structures for targeting.

   What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

8. T1021.002 SMB/Windows Admin Shares Lateral Movement

   What they do: dragonforce moves laterally through SMB shares using mapped drives to access additional systems.

   What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

9. T1486 Data Encrypted for Impact Impact

   What they do: dragonforce encrypts victim files using a custom ransomware binary with AES-256 encryption keys.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

10. T1490 Inhibit System Recovery Impact

    What they do: dragonforce runs system shutdown commands to prevent recovery attempts and maximize disruption.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Software Dragonforce has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

The note this group leaves on a compromised machine. Click a filename to read it.

Good afternoon, 

As you can see you have been attacked by a ransomware program! We The DragonForce Ransomware Cartel offer you to make a deal with us. We can make a deal with you, all you need to do is contact us by following the instructions below. 
We are in no way connected to politics, we always keep our word. You have a chance to decrypt your files and avoid being published on our blog! Use this opportunity and also don't waste your time. 
The approximate date of deletion of the decryptor program, as well as publication on our blog 26/04/2025 00:00 UTC.

- # 1 Communication Process, 

	In order to contact us you need to click on the special link below, which is listed in #2. 
	After that the negotiation process begins, in which you have the opportunity to request several things from us, 
		
		1. make a test decrypt.
		2. get a list of the files stolen from you.
		
	At the conclusion of our negotiations we agree on a price, we set the price ourselves based on your income/your insurance. 
	We scrutinize your documents and are well aware of how much income your company has per year.

- # 2 Access to the meeting room, 

	To access us please download Tor Browser which is available here. (https://www.torproject.org/)
	Once you download the special anonymous browser you need to follow this link, http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
	Your unique ID: [snap] - use it to enter our meeting room. 

- # 3 Additional Support Contacts, 

	Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20

- # 4 Recommendations, 

	Do not try to recover your files with third-party programs, you will only do harm.
	Do not turn off / reboot your computer.
	Be courteous in our meeting room. 
	Do not procrastinate. 

- # 5 Blog and News,

	Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
	DragonNews: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news

Hello! 

Your files (orcl, IADeAPP, [snip] dbs) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics.
All you need to do is contact us and pay.

--- Our communication process:

	1. You contact us.
	2. We send you a list of files that were stolen.
	3. We decrypt 1 file to confirm that our decryptor works.
	4. We agree on the amount, which must be paid using BTC.
	5. We delete your files, we give you a decryptor.
	6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
   
--- Client area (use this site to contact us):

	Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
	>>> Use this ID: [snip] to begin the recovery process.
	
	* In order to access the site, you will need Tor Browser, 
	  you can download it from this link: https://www.torproject.org/

--- Additional contacts:

	Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20

--- Recommendations: 

	DO NOT RESET OR SHUTDOWN - files may be damaged.
	DO NOT RENAME OR MOVE the encrypted and readme files.
	DO NOT DELETE readme files.

--- Important:

	If you refuse to pay or do not get in touch with us, we start publishing your files.
	21/01/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
	
	Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101

Ransom-note text from RansomLook, licensed CC BY 4.0.