{"id":9890,"date":"2026-01-15T10:04:11","date_gmt":"2026-01-15T10:04:11","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/15\/researchers-breakdown-dragonforce-ransomware-along-with-decryptor-for-esxi-and-windows-systems\/"},"modified":"2026-01-15T10:04:11","modified_gmt":"2026-01-15T10:04:11","slug":"researchers-breakdown-dragonforce-ransomware-along-with-decryptor-for-esxi-and-windows-systems","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/15\/researchers-breakdown-dragonforce-ransomware-along-with-decryptor-for-esxi-and-windows-systems\/","title":{"rendered":"Researchers Breakdown DragonForce Ransomware Along with Decryptor for ESXi and Windows Systems"},"content":{"rendered":"

Researchers Breakdown DragonForce Ransomware Along with Decryptor for ESXi and Windows Systems
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

DragonForce is the latest ransomware brand to move from noisy forum posts to full RaaS operations, targeting both Windows and VMware ESXi environments. <\/p>\n

First seen in December 2023 on BreachForums, the group advertises stolen data and uses a dark web blog to pressure victims. The early leak post revealed the new cartel-style operation.<\/p>\n

The group built its payload from leaked LockBit<\/a> 3.0 and Conti code, but tuned it for flexible, high-speed encryption across local disks and network shares. <\/p>\n

Operators usually gain access through exposed remote desktop servers, then use tools like Cobalt Strike<\/a> and SystemBC to move laterally before launching the ransomware. Impact ranges from encrypted file servers and virtual machines to stolen data prepared for public release.<\/p>\n

\n
\"Post
Post uploaded to BreachForums (Source \u2013 Medium)<\/figcaption><\/figure>\n<\/div>\n

S2W analysts identified<\/a> a custom DragonForce build that hides nearly all strings with a home-grown deobfuscation routine and relies on ChaCha8 plus RSA-4096 for file encryption. <\/p>\n

Their research shows that command-line flags let affiliates choose local, network-only, or mixed modes, and even tune partial encryption ratios to speed up attacks. While its DLS shows the internal workflow from configuration decryption to process killing and file scrambling.<\/p>\n

\n
\"DragonForce\u2019s
DragonForce\u2019s DLS as of December 2023 (Source \u2013 Medium)<\/figcaption><\/figure>\n<\/div>\n

During wider threat hunting, S2W researchers obtained a working decryptor for both Windows and ESXi systems, giving some victims a path to recovery without paying ransom. <\/p>\n

The Windows tool looks for files with the .RNP extension, while the ESXi version checks for .RNP_esxi files that also end with a specific eight-byte magic value called build_key. Besides this it maps the full decryption chain from RSA key loading to metadata parsing and file restoration.<\/p>\n

\n
\"DragonForce
DragonForce \u2014 we invite you to join our family (Source \u2013 Medium)<\/figcaption><\/figure>\n<\/div>\n

This complete technical breakdown gives defenders insight into DragonForce tools and recovery options.<\/p>\n

Encryption and Decryption Workflow<\/strong><\/h2>\n

On execution, the ransomware<\/a> first decrypts its internal configuration using ChaCha8, then reads options such as encryption mode and target path. <\/p>\n

\n
\"Post
Post announcing the migration of the RansomHub infrastructure to DragonForce (Source \u2013 Medium)<\/figcaption><\/figure>\n<\/div>\n

A common command seen by S2W analysts is dragonforce.exe -m net -p C:\\ -j 8<\/code>, which tells the malware to hit network targets under that path with multiple worker threads.<\/p>\n

\n
\"DragonForce
DragonForce Ransomware Execution Flow (Source \u2013 Medium)<\/figcaption><\/figure>\n<\/div>\n

As it scans local and remote paths, DragonForce<\/a> skips core system areas, then encrypts chosen files. For big virtual disk images it encrypts only chunks instead of the whole file to save time. <\/p>\n

At the end of each file it writes 534 bytes of metadata with an RSA-encrypted ChaCha8 key and nonce plus flags that store mode, ratio, and original size.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Researchers Breakdown DragonForce Ransomware Along with Decryptor for ESXi and Windows Systems<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers Breakdown DragonForce Ransomware Along with Decryptor for ESXi and Windows Systems DragonForce is the latest ransomware brand to move from noisy forum posts to full RaaS operations, targeting both Windows and VMware ESXi environments. First seen in December 2023 on BreachForums, the group advertises stolen data and uses a dark web blog to pressure […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-9890","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9890"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9890"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9890\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}