DragonForce Ransomware Strikes Manufacturing Sector with Brute-Force, Exfiltrating Data Over SSH to Russian Host

Darktrace has published a detailed investigation into a DragonForce-affiliated ransomware attack that targeted a manufacturing organisation, detailing a multi-phase intrusion involving network scanning, brute-force credential attacks, data exfiltration, and file encryption. The operation, which Darktrace notes began during working hours in August 2025, moved from reconnaissance to encryption after eight days of dormancy, with ransom notes titled readme.txt and files bearing the .df_win extension.

During the intrusion, several infected devices were observed exfiltrating data to the malicious IP 45.135.232[.]229 via SSH, with the destination server registered to Proton66 OOO, a Russian-based hosting provider. The attackers are described as using compromised administrator credentials to enable lateral movement and SMB-based encryption, and the ransom note claimed DragonForce affiliation.

The report also highlights the use of OpenVAS in HTTP communications and the later deployment of encryption across internal shares, marking a notable manufacturing-sector compromise linked to the RaaS model. According to Darktrace, the threat group’s activity included Disney-like persistence mechanisms and a breach timeline that culminated in data exfiltration followed by file encryption.