Full Report
The DragonForce ransomware group claims to be taking over the infrastructure of RansomHub, the biggest ransomware group in the last year, Cyble threat intelligence researchers reported in an advisory to clients today. Cyble said the moniker behind the operators of DragonForce announced a new “project” on RAMP forum and subsequently posted the same information on their onion-based data leak site (DLS). DragonForce said the group is launching fresh infrastructure – with two new onion links secured by CAPTCHA, similar to DragonForce's native tor site approach – but displayed the logo of RansomHub ransomware. While it’s unclear if DragonForce acquired RansomHub or simply compromised it, the official RansomHub onion site has been offline since March 31, fueling speculation of a possible takeover, Cyble said. DragonForce and RansomHub: New Relationship Unclear DragonForce’s post on RAMP read: “Hi. Don’t worry RansomHub will be up soon, they just decided to move to our infrastructure! We are Reliable partners. “A good example of how “projects” work, a new option from the DragonForce Ransomware Cartel!” A postscript read (image below): “RansomHub hope you are doing well, consider our offer! We are waiting for everyone in our ranks” DragonForce made a similar claim on the group’s Tor-based Data Leak Site (DLS) - and previewed a new onion site bearing the RansomHub logo (image below). [caption id="attachment_101814" align="aligncenter" width="927"] Preview of new onion site posted by DragonForce on RAMP forum and bearing the RansomHub Logo[/caption] DragonForce Ransomware Emerges As a Significant Player While it is unclear what the nature of the new arrangement is between the two groups, the announcement follows a March 18 announcement by DragonForce of a major expansion of its ransomware-as-a-service (RaaS) operation, Cyble said. The group introduced a franchise-like model allowing affiliates to launch their own ransomware brands under the DragonForce Ransomware Cartel. Affiliates receive full backend support, including admin/client panels, data hosting, and 24/7 infrastructure with anti-DDoS protection, providing autonomy while maintaining centralized control. DragonForce also rolled out technical upgrades across its ransomware lockers for ESXi, NAS, BSD, and Windows systems. Enhancements include encryption status tracking, detached execution, persistent UI messaging, and improved recovery mechanisms. The encryption engine was further hardened with two-pass header protection and BearSSL AES-CTR implementation using external entropy sources, “signaling DragonForce's ambition to scale its operations with a more professionalized and affiliate-friendly infrastructure,” Cyble said. RansomHub Future Uncertain While it’s not clear what happened between the two ransomware groups, RansomHub put together an impressive run, besting all competitors since February 2024 (image below). RansomHub’s staying power at the top has been driven by multiple factors, in Cyble’s analysis, including perceptions of greater transparency than predecessor groups, predictable payouts, and well-packaged attack playbooks for affiliates. It remains to be seen what form RansomHub and DragonForce will take on next. We will continue to follow this breaking story and update it as new information becomes available.
Analysis Summary
# Threat Actor: DragonForce (Associated with RansomHub)
## Attribution & Identity
The threat actor is **DragonForce**. This group has recently claimed to be taking over the infrastructure of the **RansomHub** ransomware operation. DragonForce is expanding its operations by launching a Ransomware-as-a-Service (RaaS) model under the name **DragonForce Ransomware Cartel**.
## Activity Summary
DragonForce is expanding its RaaS operation by absorbing or merging with RansomHub. This follows a major expansion announced on March 18, where DragonForce introduced a franchise-like RaaS model. RansomHub had previously shown impressive staying power since February 2024, attributed to transparency, predictable payouts, and well-packaged playbooks.
## Tactics, Techniques & Procedures
- **Ransomware-as-a-Service (RaaS)**: Operating a franchise-like model where affiliates can launch their own ransomware brands under the DragonForce Ransomware Cartel.
- **Affiliate Support**: Providing affiliates with full backend support, including admin/client panels, data hosting, and 24/7 infrastructure with anti-DDoS protection.
- **Technical Upgrades**: Rolling out technical enhancements across ransomware lockers targeting ESXi, NAS, BSD, and Windows systems.
- **Encryption Enhancements**: Hardening the encryption engine with two-pass header protection and BearSSL AES-CTR implementation using external entropy sources.
- **Operational Features**: Implementing encryption status tracking, detached execution, persistent UI messaging, and improved recovery mechanisms.
## Targeting
- Sectors: Not explicitly detailed, but based on RaaS targets, they target organizations using **ESXi (virtualization)**, **NAS storage**, **BSD**, and **Windows systems**.
- Geography: Not specified.
- Victims: No specific victim names were mentioned in the context provided.
## Tools & Infrastructure
- **Malware families used**: **DragonForce Ransomware** locker.
- **Infrastructure**: Affiliates benefit from centralized, managed infrastructure including admin/client panels, data hosting, and anti-DDoS protected infrastructure.
## Implications
The merger/takeover suggests DragonForce is aiming for significant scaling and professionalization within the RaaS ecosystem. By incorporating RansomHub's successful elements and offering robust, centralized support (including anti-DDoS protection) to affiliates, DragonForce aims to become a dominant force in the ransomware landscape. The technical upgrades indicate an effort to improve operational resilience and encryption efficacy.
## Mitigations
- Implement robust defense strategies against widely deployed ransomware targeting **ESXi, NAS, and Windows environments**.
- Understand the operational models of modern RaaS operations, including centralized support structures.
- Maintain strong backup and recovery mechanisms, acknowledging the focus on improved recovery within the new ransomware build.