Inside the Dragon: DragonForce Ransomware Group

**Executive summary:** Group-IB provides a technical analysis of the DragonForce ransomware RaaS (active Aug 2023–Aug 2024) that leverages two ransomware builds (a LockBit 3.0 fork and a ContiV3-derived variant with BYOVD), an affiliate program offering 80% payouts, double-extortion tactics with a dedicated leak site, and operational tooling (SystemBC, Cobalt Strike, Mimikatz, network scanners); the report includes TTP mappings, a DFIR case study, IOCs (IPs and file hashes), and prioritized mitigations (MFA, EDR/XDR tuning, backups, patching, and incident response).