DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA

A new analysis by security researchers at S2W details DragonForce as a growing ransomware operation described as a cartel, first detected in late 2023 and expanding rapidly by offering a centralised, highly configurable Ransomware-as-a-Service model. The group promotes its service as Ransombay, enabling affiliates to receive customised payloads and claiming an 80% split of ransom payments as part of its expansion, including aggressive recruitment of pentesters and initial access brokers.

S2W notes DragonForce has absorbed rival groups such as BlackLock, RansomHub and LockBit, with evidence of infrastructure migration and duplicate source code linking the operators. Code analysis shows DragonForce is built on LockBit 3.0 (Black) and Conti, with 93.7% of functions matching LockBit 3.0 and about 99% of consecutively executed commands and branch structures aligned, though DragonForce brings its own features, such as obfuscated strings and a ChaCha8/RSA-4096 encryption scheme.

The report also describes a decryptor recovered during threat hunting that can recover data from a victim system using a hardcoded RSA private key, suggesting potential recoveries despite the cartel’s growth. According to S2W, the group has even defaced a rival data leak site during the intrusions.