# DragonForce claims ARS Renacer data leak

Published: 2026-09-20 · Severity: high · Sectors: healthcare, financial-services
Canonical: https://vorant.io/reports/c23b81d6-638c-5f8f-b05d-e3ae6d45f0d4/dragonforce-claims-ars-renacer-data-leak

> DragonForce ransomware group claims a leak of 274,404 files from Dominican health insurer ARS Renacer, including PHI, financials, and IT credentials.

Ransomware.live reports that the DragonForce ransomware group has listed ARS Renacer, S.A., a private Health Risk Administrator (ARS) in the Dominican Republic, as a victim, publishing a large data dump. The claimed leak totals 274,404 files, with 158,693 flagged as critical or high-risk, spanning user account data, IT staff SSH keys and bash history, affiliate PII (national IDs, phone numbers, addresses), payroll records, and credentials/tokens for financial systems. A significant portion of the dump reportedly contains protected health information — medical service authorizations, pre-certifications, clinical records, prescriptions, and claims data — alongside financial transaction records, account data, and internal financial documents.

The exposure of SSH keys, bash history, .gitconfig files, and financial system tokens suggests attackers may have had privileged access to backend infrastructure, raising the risk of follow-on abuse such as credential-based intrusions, BEC targeting board/management contacts also present in the dump, or fraudulent use of the SISALRIL Traspaso Digital transfer system with stolen credentials. The scale and sensitivity of the data (immutable identifiers and medical histories) create durable risk for affiliates, including blackmail, synthetic identity fraud, and identity-based fraud that cannot be remediated by simple credential rotation.

Defenders at similarly regulated healthcare/insurance entities, particularly in Latin America, should treat this as a reminder to audit exposure of developer/IT secrets (SSH keys, git configs, shell history) in backup or file-share environments, rotate any financial system tokens broadly, and monitor for credential-stuffing or BEC attempts referencing leaked employee/board data. No technical intrusion vector, exploited CVE, or malware artifact is disclosed in this report; it is a data-leak disclosure rather than a technical exploitation write-up.

## Mentioned in this report

- Threat actors: DragonForce

## Detection guidance (public sample)

### Exfiltration of SSH Keys and Credential Files via Web Service

ATT&CK: T1567

Detects processes accessing and potentially exfiltrating SSH private keys, git credentials, and bash history files to web-accessible locations or network shares—common in data exfiltration post-compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exfiltration of SSH Keys and Credential Files via Web Service
description: Detects file access patterns consistent with collecting SSH keys, .git
  config files, bash history, and credential stores for exfiltration. Targets the
  distinctive file paths and extensions used by attackers to stage sensitive developer/IT
  secrets before uploading to web services or external storage.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: file_event
  product: windows
detection:
  selection_ssh_keys:
    TargetFilename|contains:
    - \.ssh\id_rsa
    - \.ssh\id_dsa
    - \.ssh\id_ecdsa
    - \.ssh\authorized_keys
    - \.git\config
    - .gitconfig
    - \.bash_history
    EventType: CreateKey
  selection_credential_access:
    TargetFilename|contains:
    - ssh
    - .git
    - bash_history
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \7z.exe
    - \tar.exe
    - \zip.exe
    CommandLine|contains:
    - copy
    - xcopy
    - robocopy
    - compress
    - archive
  filter_legitimate_admin:
    Image|endswith:
    - \git.exe
    - \ssh.exe
    CommandLine|contains:
    - clone
    - pull
  condition: selection_ssh_keys or (selection_credential_access and not filter_legitimate_admin)
falsepositives:
- Legitimate version control operations via git or SSH clients
- System administrators backing up SSH keys as part of disaster recovery
- Automated deployment tools staging credential files
level: high
id: 609548d7-c621-511a-99d7-2dda77895625
status: experimental
author: Vorant
```

### Collection of Sensitive Files from Cloud Storage or Backup Shares

ATT&CK: T1530

Detects bulk access to and aggregation of sensitive files (medical records, payroll, PII, financial documents) from network shares, cloud storage mounts, or backup directories—indicative of pre-exfiltration staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Collection of Sensitive Files from Cloud Storage or Backup Shares
description: Detects processes reading sensitive document types (medical records,
  payroll, financial data, identity documents) from cloud storage mount points or
  network backup shares. Focuses on the distinctive pattern of recursive or bulk file
  enumeration/read operations from high-risk paths rather than one-off legitimate
  access.
tags:
- attack.collection
- attack.t1530
logsource:
  category: file_event
  product: windows
detection:
  selection_cloud_storage:
    TargetFilename|contains:
    - \OneDrive\
    - \Dropbox\
    - \Google Drive\
    - \iCloudDrive\
    - \SharePoint\
    - \Sync.com\
    EventType: CreateKey
  selection_backup_share:
    TargetFilename|startswith: \\\\
    TargetFilename|contains:
    - backup
    - archive
    - exports
  selection_sensitive_docs:
    TargetFilename|contains:
    - payroll
    - medical
    - claim
    - pii
    - credential
    - token
  filter_legitimate_backup:
    Image|endswith:
    - \backup.exe
    - \robocopy.exe
    - \ntbackup.exe
    CommandLine|contains: /bk
  condition: (selection_cloud_storage or selection_backup_share) and selection_sensitive_docs
    and not filter_legitimate_backup
falsepositives:
- Legitimate backup tools performing scheduled exports from cloud storage
- Compliance audits accessing bulk sensitive data for review
- IT recovery operations restoring data from backup shares
level: medium
id: f99c3042-8cda-5100-ba3e-4435a09b859c
status: experimental
author: Vorant
```

### Exfiltration of Financial System Tokens and Credentials to External Host

ATT&CK: T1567.002

Detects transmission of authentication tokens, session cookies, or API credentials for financial/banking systems to external IP addresses or non-corporate domains—indicative of credential theft and exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exfiltration of Financial System Tokens and Credentials to External Host
description: Detects network connections from processes reading or staging financial
  system credentials, API tokens, or session keys, connecting to external hosts. Targets
  the distinctive pattern of credential file access followed by outbound web/HTTPS
  connections to non-whitelisted external IPs or domains.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_cred_staging:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \python.exe
    - \curl.exe
    - \wget.exe
    CommandLine|contains:
    - token
    - credential
    - password
    - api_key
    - secret
  selection_outbound:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
    Initiated: 'true'
  filter_internal:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  filter_corp_approved:
    DestinationHostname|contains:
    - .corp.
    - .internal
  condition: selection_cred_staging and selection_outbound and not filter_internal
    and not filter_corp_approved
falsepositives:
- Legitimate API client tools authenticating to external SaaS platforms
- Developer testing with cloud-hosted financial system sandboxes
- Third-party financial integration services connecting to external APIs
level: high
id: 58a7a7c9-b847-531e-b8fb-9182ee1e3154
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/YXJzcmVuYWNlci5jb21AZHJhZ29uZm9yY2U=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c23b81d6-638c-5f8f-b05d-e3ae6d45f0d4/dragonforce-claims-ars-renacer-data-leak.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup