DragonForce Ransomware Recovery Guide
DragonForce first appeared in August 2023 as a ransomware-as-a-service operation and restructured into a broader ransomware cartel model in 2025, offering affiliates an 80% revenue share. It's been linked to high-profile UK retail breaches, including Marks & Spencer, Co-op and Harrods.
A conventional but thorough attack chain
Its toolkit — Mimikatz for credential harvesting, Advanced IP Scanner and PingCastle for network reconnaissance, Windows Defender disabling — points to a fairly conventional Windows enterprise attack chain. The real damage tends to come from how thoroughly it maps and encrypts reachable network storage before anyone notices, rather than from anything technically exotic in the encryption itself.
What this means for recovery
Because the attack chain relies on standard credential theft and network mapping rather than novel encryption, recovery planning centres on scope: identifying every share, server and backup location the compromised credentials had reach to, and assessing each independently rather than assuming the visible damage is the full extent of it.
Veeam backups, SQL Server or Oracle databases encrypted by DragonForce?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
Facing this problem? Contact us now.
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST