Skip to main content
Mallory
Back to malware
MalwareRansomwareUsed by 5 actorsExploits 9 CVEs

DragonForce

DragonForce is a ransomware operation active since at least August 2023 that evolved from a ransomware-as-a-service (RaaS) offering into a self-described ransomware “cartel.” It conducts double-extortion attacks, combining data exfiltration with encryption and leak-site pressure, and operates centralized criminal infrastructure including a data leak site known as DragonBlog, negotiation/admin panels, file servers, and automated payment-handling mechanisms. DragonForce supports attacks against Windows, ESXi, Linux, BSD, and NAS environments, and advertises configurable encryption modes such as full, partial, header-based, and percentage-based encryption, along with features including delayed execution, multithreading, background execution, and dry-run testing.

Reported initial access methods include exposed services, credential compromise, and an integrated initial access broker marketplace called Suppliers, which offers access types such as VPN, Citrix, RDP, and botnet access. Post-compromise behavior described in the reporting includes reconnaissance, credential abuse in Active Directory environments, termination of security processes, deletion of backups and shadow copies, data exfiltration, and ransomware deployment. DragonForce has also been observed in intrusion chains where an EDR killer preceded ransomware execution. In one documented campaign investigated by Sophos, attackers exploited SimpleHelp RMM vulnerabilities CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726 to compromise an MSP and deploy DragonForce across downstream customer environments, with affected victims experiencing both encryption and data theft.

DragonForce is associated in reporting with Scattered Spider/UNC3944 in several 2025 retail intrusions. Multiple sources state that Scattered Spider used or may have used DragonForce ransomware in attacks affecting UK retailers including Marks & Spencer, Co-op, and Harrods, and trusted third-party/government reporting noted recent Scattered Spider deployment of DragonForce alongside its usual social-engineering-led tradecraft. Reporting also states DragonForce publicly claimed responsibility for attacks on Marks & Spencer, Co-op, and Harrods. More broadly, DragonForce is described as part of the Russian-speaking cybercriminal ecosystem, though its affiliate base appears increasingly international and includes English-speaking actors.

The group’s operating model changed over time. It introduced a cartel model in March 2025 allowing affiliates to create their own brands while using DragonForce infrastructure. Reported affiliate requirements shifted from stricter vetting and higher barriers—including verified access, victim revenue thresholds, and later a guarantor or roughly $10,000 Monero deposit—to a lower-barrier model by October 2025 requiring only a roughly $500 registration fee. DragonForce has advertised an 80/20 revenue split favoring affiliates, dual-payment ransom workflows, extortion-support services, and a partner service called Verified for stolen-data analysis, executive letters, and call scripts. It also publicly announced a purported coalition with LockBit and Qilin in September/October 2025, though one report noted no verified evidence of shared infrastructure or joint operations.

Targeting information in the content indicates DragonForce victim claims are concentrated in the United States, which accounted for 56% of observed claims in one report, with additional targeting across Western economies. Sectors specifically cited as heavily targeted include construction, IT services and consulting, manufacturing, architecture and planning, law practice, real estate, machinery manufacturing, software development, and transportation. DragonForce’s stated rules reportedly prohibit attacks on hospitals, government institutions, non-commercial entities, and Russian/CIS or former USSR targets, and separate reporting notes that DragonForce expressly prohibits affiliates from hitting Russian and other CIS organizations.

Activity metrics in the provided reporting show DragonForce as an increasingly prominent ransomware brand: it accounted for 4% of top variants in Q2 2025 in one source, claimed 56 victims in Q3 2025 after roughly tripling monthly victim volume following RansomHub’s shutdown, and posted 101 victims in Q1 2026, a 29% increase from Q4 2025. Additional reporting states DragonForce aggressively recruited affiliates from other ransomware operations, defaced rival leak sites in 2025, and was identified as a possible rival actor in the compromise of LockBit’s affiliate panel. One source also states that in client cases, DragonForce kept its word about deleting stolen data after payment and did not re-extort those victims.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

9 CVES
CVE-2024-57726SimpleHelp Missing Authorization Privilege EscalationExploited in the wild

The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.” | By mid-2025, a separate campaign attributed to the DragonForce Ransomware-as-a-Service (RaaS) group emerged, following a nearly identical intrusion vector.

via security online infosecurityonline.info
CVE-2024-57727Unauthenticated Path Traversal in SimpleHelpExploited in the wild

The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.” | By mid-2025, a separate campaign attributed to the DragonForce Ransomware-as-a-Service (RaaS) group emerged, following a nearly identical intrusion vector.

via security online infosecurityonline.info
CVE-2024-57728SimpleHelp Zip Slip Arbitrary File Upload Leading to RCEExploited in the wild

By mid-2025, a separate campaign attributed to the DragonForce Ransomware-as-a-Service (RaaS) group emerged, following a nearly identical intrusion vector. | The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.”

via security online infosecurityonline.info
CVE-2024-21887Command Injection in Ivanti Connect Secure and Policy Secure Web Components

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
CVE-2024-21412Windows Internet Shortcut Files SmartScreen Security Feature Bypass

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
CVE-2023-46805Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
CVE-2021-44228Log4Shell

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
CVE-2024-21893SSRF in Ivanti Connect Secure/Policy Secure/Neurons for ZTA SAML component

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
CVE-2024-55591FortiOS/FortiProxy Management Interface Authentication BypassExploited in the wild

Fortinet FortiOS CVE-2024-55591, a zero-day authentication bypass vulnerability disclosed in January 2025, had the highest count of ransomware groups attached to it as the year closed, with six named ransomware families (DragonForce, Hunters International, NightSpire, Qilin, RansomHub, and SuperBlack)...

via industrialcyberindustrialcyber.co
THREAT ACTORS

Groups observed using it

5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Scattered Spider

It said the hackers had then encrypted access to a server using software from the ransomware operator DragonForce last week.

via theguardiantheguardian.com
ShinyHunters

DragonForce posted 101 victims in Q1 2026 (an increase of 29% compared to Q4 2025), with a steep climb from 10 victims in January to 35 in February and 56 in March.

via checkpoint research blogresearch.checkpoint.com
DragonForce Malaysia

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
Water Tambanakua

“DragonForce ransomware was first identified in August 2023… DragonForce has two ransomware variants - one based on LockBit Ransomware and another based on the Conti Ransomware variant.”

via blackpoint cyberblackpointcyber.com
LAPSUS$

The final phase involves deploying ransomware. Recently we have seen the group prefer the DragonForce variant, particularly targeting virtualised environments.

via mdsec comdsec.co.uk
MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1566.004Spearphishing VoiceEvidence1

"The attackers gained initial access by impersonating an employee (found on LinkedIn) in a phone call to the IT help desk"; and WestJet was allegedly compromised by "performing a self-service password reset for an employee" and registering attacker-controlled MFA.

Collection

1 technique
T1074Data StagedEvidence1

The group claimed on its leak site that it has approximately 156 gigabytes of data stolen from the company.

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

The BBC reported on Friday that a group naming itself DragonForce had claimed responsibility for the three attacks and had obtained the personal data of Co-op members...

T1567Exfiltration Over Web ServiceEvidence1

Sophos researchers provided screen shots of the claim, which were posted Monday on the DragonForce leak site.

Impact

2 techniques
T1486Data Encrypted for ImpactEvidence10
TacticImpact

Sinnott said the situation was probably at the negotiation stage, where the hacker attempts to secure a “ransom” paid in cryptocurrency to reinstate encrypted files or return stolen data. | According to the same report that attributed the attack to Scattered Spider, the attackers used malicious software called DragonForce ... to cripple M&S systems under a ransomware-for-hire arrangement.

T1657Financial TheftEvidence1
TacticImpact

Ransomware gangs are known to put examples of stolen data on a “leak site” in a bid to gain leverage over their victim... Normally, evidence of M&S data being stolen would then appear on DragonForce’s website.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in app16 days ago
domain●●●●●●●●●●●●View more in app19 days ago
domain●●●●●●●●●●●●View more in app6 months ago
domain●●●●●●●●●●●●View more in app10 months ago
domain●●●●●●●●●●●●View more in app10 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution5

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities9

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.