Loading threat actor…
DragonForce, also known as Dragon Force and Slippery Scorpius, is a financially motivated ransomware operation identified in 2023. It adopted a ransomware-as-a-service model in 2024 and announced a cartel model in March 2025, allowing affiliates to use its infrastructure under their own branding. Its affiliate offering includes customizable ransomware, administrative panels, negotiation and publication infrastructure, storage, and technical support, with partners offered 80% of ransom proceeds. DragonForce conducts double extortion by stealing sensitive information, encrypting systems, and threatening to publish stolen data through its leak infrastructure. It targets organizations internationally, including manufacturing, construction, technology, healthcare, retail, transportation, and financial services. Documented targeting spans the United States, United Kingdom, Canada, Italy, Australia, France, Brazil, Taiwan, and Peru. Its ransomware supports Windows, Linux, and VMware ESXi environments and has used both leaked LockBit 3.0 tooling and Conti-derived code, with configurable full and partial encryption. DragonForce and its affiliates obtain access through phishing, compromised credentials, exposed remote-access services, and exploitation of public-facing applications. In a documented campaign, the operation exploited SimpleHelp vulnerabilities to compromise a managed service provider and distribute malicious tooling and ransomware into downstream customer networks through legitimate remote-management infrastructure. Associated activity included credential harvesting, network reconnaissance, privilege escalation, lateral movement, and data exfiltration. Its operations also employ scheduled tasks, legitimate administration tools, anti-analysis measures, security-tool interference, and log removal. DragonForce aggressively recruits access specialists and penetration testers through cybercriminal forums and has defaced competing ransomware operations' leak sites.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
49 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
15 CVEs this actor has used in observed campaigns. 15 of them exploited in the wild.
CVE-2024-57727 (CVSS 7.5): A set of path traversal flaws that allow attackers to navigate directories and access restricted files.
CVE-2024-57728 (CVSS 7.2): An arbitrary file upload vulnerability enabling attackers to introduce malicious payloads into the environment.
The attackers abused the legitimate but vulnerable K7RKScan.sys driver (CVE-2025-1055) in a Bring Your Own Vulnerable Driver attack to disable security software. The same driver had previously been abused by DragonForce ransomware actors.
CVE-2024-57726 (CVSS 9.9): A privilege escalation flaw that grants elevated permissions once initial access is gained.
Researchers said the attackers used a new tool called Havoc Process Terminator to exploit a Huawei audio driver, tracked as HWAudioOs2Ec.sys. They also exploited three documented driver vulnerabilities CVE-2023-52271 in Topaz Antifraud, CVE-2025-61155 in Tower of Fantasy, and CVE-2025-1055 in K7 Security Anti-Malware.
10 more CVEs tied to this actor tracked in Mallory.
138 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware operation mentioned as claiming attacks against three UK retailers. It appears as background context; the article does not attribute the Legal Aid Agency breach to DragonForce.
Identified as a ransomware group operating a cartel model. The content promotes an article about its activities but provides no specific targets, attack techniques, or indicators of compromise.
The content attributes a ransomware attack against Lane Equipment, a Texas-based commercial kitchen equipment company, to DragonForce. The reported breach occurred on October 14, 2026, at 00:11 UTC and was discovered at 00:30 UTC. No technical details, specific malware family, exploited vulnerabilities, or attribution evidence are provided.
DragonForce listed Lane Equipment Company, a Texas-based commercial kitchen equipment sales and service business, as a victim. The listing was discovered on October 14, 2026, but provides no stolen-data details, proof of compromise, ransom demand, or deadline.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.