Tag: dragonforce

4 Attack Reports | 0 Vulnerabilities

Attack reports

Shared secret: EDR killer in the kill chain

This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors,…

Published: August 7, 2025

Downloadable IOCs: 56

DEVMAN Ransomware: Analysis of New DragonForce Variant

A new ransomware strain resembling DragonForce but with unique traits has emerged, possibly connected to an entity called DEVMAN. The sample reuses DragonForce code but adds its own elements, including the .DEVMAN file extension. Attribution is unclear, as the ransom note is identical to DragonForc…

Published: July 2, 2025

Downloadable IOCs: 2

DragonForce Ransomware Group is Targeting Saudi Arabia

DragonForce ransomware has targeted organizations in Saudi Arabia, with a significant data leak from a Riyadh real estate and construction company. The group exfiltrated over 6 TB of data, setting a deadline just before Ramadan. DragonForce operates on a RaaS model, offering high commission rates f…

Published: February 27, 2025

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2024-21412, CVE-2024-21893

Downloadable IOCs: 17

Inside the Dragon: DragonForce Ransomware Group

In this blog, Group-IB delves into the inner workings of the DragonForce ransomware group. Discovered in August 2023, DragonForce has been targeting companies in critical sectors using a variant of a leaked LockBit3.0 builder, and more recently in July 2024 with their own variant of ransomware. Dr…

Published: September 27, 2024

Downloadable IOCs: 5

Click here to see more Attack Reports