DragonForce
DragonForce is a ransomware operation active since at least August 2023 that evolved from a ransomware-as-a-service (RaaS) offering into a self-described ransomware “cartel.” It conducts double-extortion attacks, combining data exfiltration with encryption and leak-site pressure, and operates centralized criminal infrastructure including a data leak site known as DragonBlog, negotiation/admin panels, file servers, and automated payment-handling mechanisms. DragonForce supports attacks against Windows, ESXi, Linux, BSD, and NAS environments, and advertises configurable encryption modes such as full, partial, header-based, and percentage-based encryption, along with features including delayed execution, multithreading, background execution, and dry-run testing.
Reported initial access methods include exposed services, credential compromise, and an integrated initial access broker marketplace called Suppliers, which offers access types such as VPN, Citrix, RDP, and botnet access. Post-compromise behavior described in the reporting includes reconnaissance, credential abuse in Active Directory environments, termination of security processes, deletion of backups and shadow copies, data exfiltration, and ransomware deployment. DragonForce has also been observed in intrusion chains where an EDR killer preceded ransomware execution. In one documented campaign investigated by Sophos, attackers exploited SimpleHelp RMM vulnerabilities CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726 to compromise an MSP and deploy DragonForce across downstream customer environments, with affected victims experiencing both encryption and data theft.
DragonForce is associated in reporting with Scattered Spider/UNC3944 in several 2025 retail intrusions. Multiple sources state that Scattered Spider used or may have used DragonForce ransomware in attacks affecting UK retailers including Marks & Spencer, Co-op, and Harrods, and trusted third-party/government reporting noted recent Scattered Spider deployment of DragonForce alongside its usual social-engineering-led tradecraft. Reporting also states DragonForce publicly claimed responsibility for attacks on Marks & Spencer, Co-op, and Harrods. More broadly, DragonForce is described as part of the Russian-speaking cybercriminal ecosystem, though its affiliate base appears increasingly international and includes English-speaking actors.
The group’s operating model changed over time. It introduced a cartel model in March 2025 allowing affiliates to create their own brands while using DragonForce infrastructure. Reported affiliate requirements shifted from stricter vetting and higher barriers—including verified access, victim revenue thresholds, and later a guarantor or roughly $10,000 Monero deposit—to a lower-barrier model by October 2025 requiring only a roughly $500 registration fee. DragonForce has advertised an 80/20 revenue split favoring affiliates, dual-payment ransom workflows, extortion-support services, and a partner service called Verified for stolen-data analysis, executive letters, and call scripts. It also publicly announced a purported coalition with LockBit and Qilin in September/October 2025, though one report noted no verified evidence of shared infrastructure or joint operations.
Targeting information in the content indicates DragonForce victim claims are concentrated in the United States, which accounted for 56% of observed claims in one report, with additional targeting across Western economies. Sectors specifically cited as heavily targeted include construction, IT services and consulting, manufacturing, architecture and planning, law practice, real estate, machinery manufacturing, software development, and transportation. DragonForce’s stated rules reportedly prohibit attacks on hospitals, government institutions, non-commercial entities, and Russian/CIS or former USSR targets, and separate reporting notes that DragonForce expressly prohibits affiliates from hitting Russian and other CIS organizations.
Activity metrics in the provided reporting show DragonForce as an increasingly prominent ransomware brand: it accounted for 4% of top variants in Q2 2025 in one source, claimed 56 victims in Q3 2025 after roughly tripling monthly victim volume following RansomHub’s shutdown, and posted 101 victims in Q1 2026, a 29% increase from Q4 2025. Additional reporting states DragonForce aggressively recruited affiliates from other ransomware operations, defaced rival leak sites in 2025, and was identified as a possible rival actor in the compromise of LockBit’s affiliate panel. One source also states that in client cases, DragonForce kept its word about deleting stolen data after payment and did not re-extort those victims.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.” | By mid-2025, a separate campaign attributed to the DragonForce Ransomware-as-a-Service (RaaS) group emerged, following a nearly identical intrusion vector.
The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.” | By mid-2025, a separate campaign attributed to the DragonForce Ransomware-as-a-Service (RaaS) group emerged, following a nearly identical intrusion vector.
By mid-2025, a separate campaign attributed to the DragonForce Ransomware-as-a-Service (RaaS) group emerged, following a nearly identical intrusion vector. | The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.”
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
Fortinet FortiOS CVE-2024-55591, a zero-day authentication bypass vulnerability disclosed in January 2025, had the highest count of ransomware groups attached to it as the year closed, with six named ransomware families (DragonForce, Hunters International, NightSpire, Qilin, RansomHub, and SuperBlack)...
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It said the hackers had then encrypted access to a server using software from the ransomware operator DragonForce last week.
DragonForce posted 101 victims in Q1 2026 (an increase of 29% compared to Q4 2025), with a steep climb from 10 victims in January to 35 in February and 56 in March.
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”
The final phase involves deploying ransomware. Recently we have seen the group prefer the DragonForce variant, particularly targeting virtualised environments.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"The attackers gained initial access by impersonating an employee (found on LinkedIn) in a phone call to the IT help desk"; and WestJet was allegedly compromised by "performing a self-service password reset for an employee" and registering attacker-controlled MFA.
Collection
1 techniqueThe group claimed on its leak site that it has approximately 156 gigabytes of data stolen from the company.
Exfiltration
2 techniquesThe BBC reported on Friday that a group naming itself DragonForce had claimed responsibility for the three attacks and had obtained the personal data of Co-op members...
Sophos researchers provided screen shots of the claim, which were posted Monday on the DragonForce leak site.
Impact
2 techniquesSinnott said the situation was probably at the negotiation stage, where the hacker attempts to secure a “ransom” paid in cryptocurrency to reinstate encrypted files or return stolen data. | According to the same report that attributed the attack to Scattered Spider, the attackers used malicious software called DragonForce ... to cripple M&S systems under a ransomware-for-hire arrangement.
Ransomware gangs are known to put examples of stolen data on a “leak site” in a bid to gain leverage over their victim... Normally, evidence of M&S data being stolen would then appear on DragonForce’s website.
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
91 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a ransomware cartel that prohibits affiliates from targeting Russian and other CIS organizations.
Ransomware-as-a-service operation observed since August 2023 that conducts double extortion attacks globally. It provides affiliates with cross-platform ransomware deployment, encryption tooling, leak-site infrastructure, negotiation support, and integrated initial access brokerage.
A ransomware operation branding itself as a cartel or umbrella organization, with multi-platform support, affiliate recruitment, and a data-audit service to improve extortion leverage.
A ransomware family mentioned as using similar ESXi and AD compromise playbooks in hypervisor-targeted campaigns.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.