Friday, May 24, 2024

New DragonForce Ransomware Emerged From The Leaked LOCKBIT Builder

Hackers exploit LOCKBIT Builder due to its versatility in creating customized ransomware payloads which enable them to tailor attacks to specific targets and evade detection by security measures.

DragonForce Ransomware emerged in November 2023, employing double extortion tactics – data theft followed by encryption, with victims’ data leaked if the ransom is unpaid. 

Though sharing the name with a Malaysian hacktivist group, the origins of the DragonForce Ransomware are unclear. 

Cyble’s cybersecurity researchers’ analysis recently revealed that the DragonForce’s binary is based on the leaked LOCKBIT Black builder, allowing customization like encryption modes, filename obfuscation, process impersonation, file & folder exclusions, and ransom note templating.

DragonForce Leak Site (Source – Cyble)

DragonForce LOCKBIT Builder

Over 25 global victims have been disclosed so far, and the group leverages the leaked LOCKBIT infrastructure for operational efficiency while maintaining anonymity through the rebranded “DragonForce” identity.

After analyzing the code, it was found that DragonForce ransomware uses the leaked LOCKBIT builder, which shares many characteristics in terms of design and functionalities.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Upon execution, this virus stops many processes and services such as Oracle, Microsoft Office apps, antivirus software, and even backup solutions to speed up encryption. 

The encrypted files are given a random name followed by the ‘.AoVOpni2N’ extension. 

Encrypted Files (Source – Cyble)

The criminals also put a ransom note called ‘AoVOpni2N.README.txt’ into each encrypted folder. It contains instructions on how to pay for decryption.

Ransom Note (Source – Cyble)

What DragonForce does is take advantage of their knowledge about Lockbit, which they got from another leak, to make their attacks fast, but it is not easy to attribute them back through rebranding themselves.

The DragonForce ransomware shows how dangerous the situation becomes with leaked malware builders such as LOCKBIT Black. 

These types of programs allow threat actors to create personalized ransomware quickly and without much effort, making it harder for international companies to protect themselves against them. 

This data-stealing and encrypting method demonstrates that cyber attackers continuously evolve their strategies to impose maximum monetary harm through ransomware attacks, such as those performed by groups such as DragonForce, which utilizes the “double extortion” method, reads Cyble report.

This particular case serves as another reminder of why strong safeguards should always exist against the ever-changing threats posed by ransomware groups that take advantage when developers leak their tools into the public domain.


Here below we have mentioned all the recommendations:-

  • Verify links and email attachments before opening.
  • Regularly backup data and store it offline.
  • Enable automatic software updates on all devices.
  • Utilize reputable antivirus and security software.
  • Disconnect infected devices from the network.
  • Disconnect external storage devices if connected.
  • Monitor system logs for suspicious activity.

Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles