DragonForce Ransomware Evolves with BYOVD to Kill EDR and Fixes Encryption Flaws in Conti V3 Codebase

The Acronis Threat Research Unit (TRU) has identified a new DragonForce ransomware variant that shows a dramatic evolution in both technical sophistication and organisational structure, with BYOVD techniques used to disable security software and terminate protected processes. The updated ransomware uses vulnerable drivers such as truesight.sys and rentdrv2.sys to kill antivirus and EDR software, and to correct encryption flaws previously associated with Akira ransomware, according to Acronis researchers.

DragonForce’s codebase remains rooted in Conti v3, but binaries are larger and compiled with MinGW, and the threat now features an encrypted configuration file that eliminates the need for command‑line parameters. Its encryption system employs a hybrid ChaCha20 + RSA scheme, with a unique ChaCha20 key per file encrypted under a public RSA key, while affiliates can define custom extensions, blacklists and a process‑kill list.

In early 2025 the group rebranded as a “cartel”, offering affiliates 80% profit shares and expanding collaborations, including a joint attack on Marks & Spencer alongside the Scattered Spider intrusion group, according to the report.