Full Report
DragonForce ransomware group is targeting major UK retailers. Learn about this evolving threat and what steps can be taken to mitigate risk.
Analysis Summary
# Threat Actor: DragonForce Ransomware Gang
## Attribution & Identity
* **Primary Identification:** DragonForce Ransomware Group.
* **Origin:** Emerged in August 2023, primarily out of Malaysia (DragonForce Malaysia).
* **Evolution:** Originally a Pro-Palestine hacktivist-style operation, it has shifted focus primarily toward financial gain/extortion, making it a hybrid actor.
* **Alias/Association Notes:** Some components of recent UK retail attacks have been loosely attributed to an individual affiliated with 'The Com' collective, but this attribution is inconclusive due to a lack of strong technical evidence and shifting group boundaries.
## Activity Summary
DragonForce engages in coordinated ransomware attacks using a multi-extortion model (data leakage via dedicated leak sites plus reputational damage).
* **Recent Campaigns:** Targeted UK retailers, causing major service disruptions affecting payment systems, inventory, and payroll.
* **Historical Incidents:** Attacks on Honolulu OTS (Oahu Transit Services), the Government of Palau, Coca-Cola (Singapore), the Ohio State Lottery, and Yakult Australia.
## Tactics, Techniques & Procedures
* **Initial Access:**
* Phishing emails.
* Exploitation of known vulnerabilities (especially on internet-facing devices).
* Leveraging leaked or stolen credentials.
* Credential stuffing attacks targeting RDP services.
* Exploiting VPN weaknesses.
* **Lateral Movement & Execution:**
* Use of Cobalt Strike for campaign management, payload execution, and implants.
* Use of tools like mimikatz, Advanced IP Scanner, PingCastle, and Remote Management tools for privilege escalation and persistence.
* **Persistence:** Deployment of the **SystemBC** backdoor for SOCKS5 proxy tunneling.
* **Ransomware Payload:**
* Early variants based on the leaked LockBit 3.0/Black builder.
* Evolved to use a bespoke offshoot with roots in the **Conti v3 codebase**.
* Encryption uses AES with RSA for key securing in earlier variants; newer Conti-derived samples use the **ChaCha8 algorithm** for speed.
* Affiliates can build variants tailored for Windows, Linux, ESXi, and NAS platforms, customizing filenames, extensions, and execution scripts via an affiliate panel.
* **Vulnerabilities Exploited:**
* CVE-2021-44228 (Apache Log4j2 RCE, "Log4Shell")
* CVE-2023-46805 (Ivanti Connect Secure Authentication Bypass)
* CVE-2024-21412 (Microsoft Windows SmartScreen Security Feature Bypass)
* CVE-2024-21887 (Ivanti Connect Secure Command Injection)
* CVE-2024-21893 (Ivanti Connect Secure Path Traversal)
## Targeting
* **Sectors:** Retail, Government entities, Law firms, Medical practices, Commercial enterprises, and organizations aligned with specific political causes.
* **Geography:** United Kingdom (recent focus), Israel, India, Saudi Arabia, and Palau.
* **Victims:** Harrods, Marks and Spencer, Co-Op, Honolulu OTS, Government of Palau, Coca-Cola (Singapore), Ohio State Lottery, Yakult Australia.
## Tools & Infrastructure
* **Malware Families Used:** DragonForce Ransomware (LockBit and Conti derived variants), SystemBC backdoor, Cobalt Strike.
* **Commercially Available/Stolen Tools:** mimikatz, Advanced IP Scanner, PingCastle, Remote Management tools.
* **Infrastructure:** Not explicitly detailed beyond the use of COTS tools and proprietary affiliate panel functionality.
## Implications
DragonForce presents a hybrid threat, blending political/ideological alignment with profit-driven ransomware extortion. Their rapid adoption of evolved ransomware codebases (moving from LockBit leaks to Conti v3 derivatives) and targeting of critical infrastructure (retail, government) indicates increasing operational maturity and a significant, evolving financial threat.
## Mitigations
* Implement robust endpoint detection and response capable of identifying post-exploitation activity (Cobalt Strike, mimikatz usage).
* Prioritize patching for public-facing applications, especially perimeter defenses (VPNs/T بوابة) known to be targeted (e.g., Ivanti products).
* Implement multi-factor authentication (MFA) on all remote access services, especially RDP and VPNs, to counter credential stuffing and stolen credential usage.
* Monitor networks for SystemBC beaconing activity (SOCKS5 proxy tunnels).
* Ensure comprehensive backups that are isolated from the primary network environment.