DragonForce: The Rise of a New “Ransomware Cartel” Built on LockBit and Conti DNA

S2W's analysis profiles DragonForce as a rapidly expanding, cartel-style ransomware operation called 'Ransombay' that customizes payloads for affiliates, recruits pentesters and initial access brokers, and has absorbed rival groups (e.g., BlackLock) via infrastructure compromise; the malware reuses LockBit/Conti code, employs ChaCha8 and RSA-4096, obfuscates strings, marks encrypted files with a .RNP extension, and researchers recovered a decryptor tied to a hardcoded RSA private key, indicating operational errors that may allow victim recovery.