Tracking a Dragon: Investigating a DragonForce-affiliated ransomware attack with Darktrace

Darktrace reports a DragonForce-affiliated ransomware attack that targeted the manufacturing sector, outlining an attack lifecycle beginning with network scanning and credential brute-forcing during August 2025, followed by eight days of inactivity before multiple devices started encrypting files over SMB using a DragonForce-associated extension.

Ransom notes referencing the group appeared, with readme.txt written to various locations and a claim of DragonForce affiliation, though this affiliation has not been confirmed. The campaign also involved data exfiltration over SSH to the external endpoint 45.135.232[.]229, traced to an ASN associated with Proton66 and geolocated in Russia, with the endpoint details including the IP 45.135.232[.]229 and port 22.

Darktrace notes internal devices performed network scanning, credential brute-forcing, and unusual Windows Registry operations, such as updates to WMI Security keys and Schedule\\Taskcache\\Tasks, suggesting attempts at persistence. The investigation highlights that the initial access vector was not clearly defined, but likely built on methods previously used by DragonForce affiliates, including phishing, exploiting public-facing apps, web shells, and abusing remote management tools.

It also notes that the attacker progressed to data exfiltration before ransomware deployment, and that enabling Autonomous Response could have interrupted the attack earlier.