DragonForce Malaysia
DragonForce Malaysia is a pro-Palestinian hacktivist group that has conducted politically motivated operations targeting Israel and entities directly or indirectly supporting Israel. It returned for a third year with an anti-Israel campaign branded OpsPetir, which replaced its earlier OpsBedil branding and overlapped with the broader OpIsrael campaign. Reported early OpsPetir targets included Israeli universities and financial institutions, and expected target sectors also included religious organizations, healthcare, service providers, transportation entities, and government agencies. Reported DragonForce Malaysia activity focuses on threat messaging, mobilization, and disruptive operations rather than confirmed ransomware activity. Radware assessed that its likely attack methods include scanning, exploitation, data dumps, denial-of-service attacks, and website defacements. The group has used or promoted a DDoS tool called CyberTroopers, described as an obfuscated Python program with TCP, UDP, and HTTP flooding capabilities that can pull free proxy and SOCKS lists from free-proxy-list[.]net and proxyscrape[.]com to help randomize apparent attack origin and complicate Layer 7 mitigation. The group operates an active forum used for campaign announcements and discussion of tactics, techniques, and procedures, and also maintains a Telegram channel with content replicated to Discord and other social media platforms. It has been observed collaborating with T3 dimension Team, Reliks Crew, and AnonGhost. Known campaigns mentioned in the content include OpsBedil (launched in June 2021), OpsBedil Reloaded (April 2022), OpsPetir, and OpsPatuk targeting India. During the 28 February to 1 March 2026 Middle East escalation, DragonForce Malaysia was also named among hacktivist groups active or claiming activity. One report notes only an unconfirmed possibility of a relationship between DragonForce Malaysia and DragonForce ransomware; this linkage is not confirmed in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Health Care Equipment & Services
- Banks
- Transportation
- Government & Administration
- Academia & Research
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
- 🇮🇳 India
Where they're from
Attributed origin per open-source reporting.
- MY
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group primarily engaged in threat messaging/mobilization directed at Israeli infrastructure (per the report).
Hacktivist operations targeting Israel under the OpsPetir campaign, with attacks against universities, financial institutions, and expected targeting of religious organizations, healthcare, service providers, transportation, and government agencies. Activity includes scanning and exploiting, data dumps, denial-of-service attacks, and website defacements.
Hacktivist group from Malaysia that publicly discussed plans to develop a ransomware operation (unconfirmed linkage to DragonForce).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.