dragonforce

Tácticas y técnicas observadas del actor, mapeadas a MITRE ATT&CK (clic para ver la ficha oficial). Útil para priorizar detecciones.

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
DragonForce ransomware
*/

rule DragonForce_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.dragonforce"
        description = "Detects DragonForce ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "DragonForce" ascii nocase
        $s2 = "DragonForce_README.txt" ascii nocase
        $s3 = ".DragonForce" ascii
        $s4 = "dragonforce.onion" ascii nocase

    condition:
        any of them
}

Conversaciones de rescate divulgadas, con fines de estudio defensivo. Contactos, enlaces y wallets redactados.

• #058f4b92-ae99-45c7-bf35-5d2d6754b3de19 mensajesno pagado
• #05f724f8-906e-4739-8177-815852cc2c3f29 mensajesno pagado
• #1e4a1771-ca8e-498c-a961-6e20180c091d55 mensajesno pagado
• #29BBE03074FDBB8D

Hello!
Your files (orcl, IADeAPP, [snip] dbs) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics.
All you need to do is contact us and pay.
--- Our communication process:
	1. You contact us.
	2. We send you a list of files that were stolen.
	3. We decrypt 1 file to confirm that our decryptor works.
	4. We agree on the amount, which must be paid using BTC.
	5. We delete your files, we give you a decryptor.
	6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
	Link for Tor Browser: [redactado]
	>>> Use this ID: [snip] to begin the recovery process.
	* In order to access the site, you will need Tor Browser,
	  you can download it from this link: [redactado]
--- Additional contacts:
	Support [redactado] [redactado]
--- Recommendations:
	DO NOT RESET OR SHUTDOWN - files may be damaged.
	DO NOT RENAME OR MOVE the encrypted and readme files.
	DO NOT DELETE readme files.
--- Important:
	If you refuse to pay or do not get in touch with us, we start publishing your files.
	21/01/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
	Blog: [redactado]
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101

• https://www.ransomware.live/group/dragonforce

• Manufacturing
  20
• Business Services
  19
• Not Found
  17
• Technology
  12
• Healthcare