DragonForce Cartel Surfaces from Leaked Conti v3 Ransomware Source Code

According to Acronis Threat Research Unit, DragonForce has emerged from leaked Conti v3 ransomware source code, rebranding itself as a ransomware cartel and increasing its global activity. The latest sample leverages vulnerable drivers such as truesight.sys and rentdrv2.sys to disable security software, terminate protected processes and address encryption weaknesses linked to Akira ransomware.

The group’s updated encryptor uses a single ChaCha20 key per file, encrypted with a public RSA key and prepended to the resulting file, and its operations are said to reflect extensive overlap with Conti’s leaked code. DragonForce announced an affiliate programme offering 80 percent of profits and access to its infrastructure, enabling others to deploy under their own brand.

More than 200 victims have been exposed on DragonForce’s leak site since late 2023, with notable targets including Marks & Spencer in collaboration with Scattered Spider. The group began as a ransomware‑as‑a‑service operation in 2023 and has since used BYOVD attacks to neutralise endpoint protections while expanding its cartel branding and partnerships.