Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

DragonForce encryptor

Destructive Impact

Impact

DragonForce is a ransomware-as-a-service operation whose affiliates deploy configurable, sample-specific payloads rather than one universal encryptor binary. Group-IB documented Windows builds derived from LockBit 3.0 and ContiV3; separate reporting describes Linux and ESXi variants. Payload behavior and indicators vary by build and affiliate configuration. Observed effects include file encryption and ransom-note creation; analyzed Windows builds may also delete Volume Shadow Copies.

Source

https://www.group-ib.com/blog/dragonforce-ransomware/

References

group-ib.com microsoft.com trendaisecurity.com go.intel471.com attack.mitre.org

+1 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER