Emulating the Blazing DragonForce Ransomware

EXTRACT IOC

DragonForce is a ransomware strain that evolved from a pro-Palestine hacktivist group into a financially motivated Ransomware-as-a-Service (RaaS) operation using custom payloads based on Conti V3. It utilizes a double extortion approach, advanced post-exploitation tools, and Bring Your Own Vulnerable Driver (BYOVD) techniques, with AttackIQ providing detailed emulations to help organizations validate their defenses. #DragonForce #Conti #SystemBC #Mimikatz #CobaltStrike

Keypoints

DragonForce ransomware emerged in August 2023 and evolved from a politically motivated hacktivist group to a hybrid RaaS operation focused on financial extortion.
In July 2024, DragonForce introduced a customized ransomware variant based on the Conti V3 codebase, with an affiliate program offering up to 80% ransom shares.
The group employs a double extortion strategy by encrypting victim data and leaking sensitive information on their Dedicated Leak Site and RansomBay platforms.
Operators use the BYOVD technique to disable security controls and clear Windows Event Logs post-encryption to evade detection and forensic analysis.
DragonForce’s toolkit includes SystemBC (backdoor), Mimikatz (credential theft), SoftPerfect Network Scanner (reconnaissance), and Cobalt Strike for lateral movement and persistence.
Initial infection often begins with encoded PowerShell commands deploying Cobalt Strike, followed by credential harvesting and network reconnaissance to enable domain-wide ransomware deployment.
AttackIQ released attack graphs simulating DragonForce TTPs, enabling organizations to assess and improve detection, prevention, and response capabilities against this threat.

MITRE Techniques

[T1059.001] Command and Scripting Interpreter: PowerShell – Encoded PowerShell commands executed to download and deploy Cobalt Strike Beacon (‘encoded PowerShell script into base64 and then executed using PowerShell’s -encodedCommand parameter’).
[T1543.003] Create or Modify System Process: Windows Service – Persistence via new Windows service creation using the SC utility (‘creates a service through the SC Windows utility’).
[T1105] Ingress Tool Transfer – Downloading additional payloads into memory or disk to advance operations (‘downloads to memory and saves to disk in independent scenarios to test network and endpoint controls’).
[T1547.001] Logon Autostart Execution: Registry Run Keys – Establishing persistence by creating registry run keys to execute commands on startup (‘creates an entry under HKLMSoftwareMicrosoftWindowsCurrentVersionRun’).
[T1018] Remote System Discovery – Using AdFind to gather Active Directory information including accounts and groups (‘leverages the AdFind utility to discover details about the Active Directory configuration’).
[T1003] OS Credential Dumping – Using an obfuscated Mimikatz variant to extract system credentials (‘uses an obfuscated version of Mimikatz to dump passwords and hashes’).
[T1021.001] Remote Services: Remote Desktop Protocol – Moving laterally via RDP connections (‘attempts to remotely connect to an accessible system via Remote Desktop Protocol’).
[T1106] Native API – Using CreateProcessA API to spawn new malicious processes (‘executes the CreateProcessA Windows API call to create a new process’).
[T1082] System Information Discovery – Enumerating system info with RtlGetVersion, NetWkstaGetInfo, NtQuerySystemInformation APIs (‘executes RtlGetVersion and NetWkstaGetInfo API calls to enumerate system information’).
[T1007] System Service Discovery – Collecting information on system services using EnumServiceStatus, QueryServiceStatusEx, and EnumDependentServices APIs (‘executes the EnumServiceStatus Windows API to gather information’).
[T1490] Inhibit System Recovery – Deleting Volume Shadow Copies via WMI and WMIC commands to block recovery options (‘executes Get-WMIObject Win32_ShadowCopy and wmic.exe commands to delete shadow copies’).
[T1083] File and Directory Discovery – Enumerating file systems with FindFirstFileW and FindNextFileW APIs to locate files for encryption (‘calls FindFirstFileW and FindNextFileW for file system enumeration’).
[T1486] Data Encrypted for Impact – Encrypting files using ChaCha8 and RSA-1024 algorithms to impact victim data (‘encrypts the identified files using a combination of ChaCha8 and RSA-1024’).

Indicators of Compromise

[File Names] — Indicators related to vulnerable drivers used for BYOVD technique: Truesight.sys, RentDrv.sys referenced as drivers to terminate EDR/XDR processes.
[Tools] — Post-exploitation tool names observed: SystemBC (aka Coroxy), Mimikatz, SoftPerfect Network Scanner, Cobalt Strike used for persistence, credential theft, reconnaissance, and lateral movement.
[IOCs] — PowerShell commands and utilities indicative of malicious activity, e.g., use of encoded PowerShell scripts, ‘vssadmin Delete Shadows’ commands, and WMIC invocations for Volume Shadow Copy deletion.

Tags: SIEM, INITIAL ACCESS, PAYLOAD, WINDOWS, BACKDOOR, FINANCIAL, CREDENTIAL, LEAK