Summary
DragonForce is a Ransomware-as-a-Service (RaaS) operation that has evolved from a hacktivist collective into a financially motivated cartel. The malware employs advanced techniques including ChaCha20 encryption, RSA-4096 key protection, and ARP-based network discovery to propagate across local and network drives. It also targets security and backup-related processes to maximize the impact of file encryption.
Investigation
The investigation included an in-depth technical analysis of a Windows DragonForce sample, following execution from the initial process entry through its primary routine. Analysts examined runtime initialization, API resolution methods, encoded string handling, and the malware’s multi-threaded encryption engine. The research also documented techniques used for shadow-copy deletion and desktop customization.
Mitigation
To mitigate DragonForce, organizations should enforce strict access controls on administrative SMB shares and monitor for unauthorized WMIC activity used to delete shadow copies. Preventing unauthorized process termination and maintaining offline, immutable backups are essential defensive measures. Security teams should also monitor unusual ARP cache activity and rapid file-renaming behavior as potential early detection indicators.
Response
When DragonForce activity is detected, immediately isolate affected hosts from the network to stop lateral movement through SMB. Terminate suspicious processes and investigate unauthorized changes to registry keys or wallpaper settings. Perform a comprehensive forensic analysis of the C:\Users\Public\log.log file, where available, to help reconstruct the attack timeline and related encryption activity.
