Hackers exploit LOCKBIT Builder due to its versatility in creating customized ransomware payloads which enable them to tailor attacks to specific targets and evade detection by security measures. DragonForce Ransomware emerged in November 2023, employing double extortion tactics – data theft followed by encryption, with victims’ data leaked if the ransom is unpaid.  Though sharing the name with a Malaysian hacktivist group, the origins of the DragonForce Ransomware are unclear.  Cyble’s cybersecurity researchers’ analysis recently revealed that the DragonForce’s binary is based on the leaked LOCKBIT Black builder, allowing customization like encryption modes, filename obfuscation, process impersonation, file & folder exclusions, and ransom note templating.

Source: GBHackers