Full Report
In this blog, we look at the DragonForce ransomware group, which poses a severe threat with two variants—a LockBit fork and a customized Conti fork with advanced features and SystemBC malware.
Analysis Summary
# Threat Actor: DragonForce
## Attribution & Identity
* **Actor Name:** DragonForce
* **Aliases/Associated Groups:** Not to be confused with the Malaysian hacktivist group of the same name. DragonForce (ransomware) is a distinct Cybercrime-as-a-Service (CaaS) operation.
* **Known Associations:** The group utilizes codebases derived from high-profile leaks, specifically employing a **LockBit 3.0 (LockBit Black)** fork and a customized **Conti** fork.
## Activity Summary
DragonForce is an emerging ransomware-as-a-service threat characterized by the use of "double extortion" tactics—encrypting data and threatening to leak it on a dedicated leak site (DLS). Recent operations demonstrate a high level of sophistication, involving the use of specialized tools for persistence and lateral movement, such as SystemBC and Cobalt Strike, to facilitate large-scale encryption events.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of compromised valid domain accounts (**T1078.002**).
* **Execution:** Extensive use of PowerShell (**T1059.001**) to download and execute payloads like Cobalt Strike.
* **Persistence:** Establishing Windows Services (**T1543.003**) for SystemBC and modifying Registry Run Keys (**T1547.001**).
* **Defense Evasion:** Clearing Windows Event Logs (**T1070.001**) to mask activity.
* **Credential Access:** Dumping LSASS memory using Mimikatz (**T1003.001**).
* **Discovery:** Using tools like **ADFind** for Domain Trust Discovery (**T1482**) and **netscanold.exe** for Remote System Discovery (**T1018**).
* **Lateral Movement:** Moving through the environment via Remote Desktop Protocol (RDP) (**T1021.001**).
* **Impact:** Final deployment of ransomware to encrypt files (**T1486**).
## Targeting
* **Sectors:** The group targets a wide range of industries including Manufacturing, Real Estate, Transportation, Government, and Healthcare.
* **Geography:** Global targeting; specific activity noted in APAC, EU, NA, MEA, and LATAM regions.
* **Victims:** Organizations capable of paying high ransoms, often targeted via "big game hunting" profiles.
## Tools & Infrastructure
* **Malware Families:**
* **DragonForce Ransomware:** LockBit 3.0 fork and Conti fork.
* **SystemBC:** A proxy/backdoor used for C2 communication and persistence.
* **Cobalt Strike:** Used for post-exploitation and lateral movement.
* **Mimikatz:** Used for credential harvesting.
* **Infrastructure:**
* **C2 IP Addresses:**
* 185[.]172[.]128[.]46
* 193[.]233[.]202[.]202
* 45[.]12[.]253[.]46
* 69[.]4[.]234[.]20
* 2[.]147[.]68[.]96
* 185[.]59[.]221[.]75
## Implications
DragonForce represents a significant threat due to its ability to adapt leaked source code from premier ransomware groups (LockBit/Conti) and integrate them with reliable backdoors like SystemBC. Their use of valid credentials suggests a focus on credential harvesting or purchasing access from Initial Access Brokers (IABs), making them difficult to detect via traditional signature-based tools during the early stages of an intrusion.
## Mitigations
* **Enforce MFA:** Implement Multi-Factor Authentication on all remote access points (RDP, VPN) to mitigate the use of compromised valid accounts.
* **Log Monitoring:** Monitor for and alert on the clearing of Windows Event Logs and the execution of unauthorized PowerShell scripts.
* **Privileged Access Management:** Restrict access to LSASS and monitor for tools like Mimikatz or ADFind within the network.
* **Endpoint Protection:** Deploy EDR/XDR solutions to detect the lateral movement and persistence mechanisms (Registry changes, new services) used by SystemBC and Cobalt Strike.
* **Network Segmentation:** Segment critical assets to prevent widespread lateral movement via RDP.