DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel

When people discuss DragonForce, two distinct names usually come up: DragonForce Ransomware and DragonForce Malaysia. To set the record straight, the ransomware operation isn't necessarily the same entity as DragonForce Malaysia. DragonForce Malaysia operates as a politically driven hacktivist collective known for pro-Palestinian campaigns, defacing websites, launching DDoS attacks, and leaking data.

The ransomware group we're diving into here, on the other hand, is purely financially motivated. While security reports sometimes link the two, that connection hasn't been confirmed. The ransomware group gained notoriety during a wave of UK retail attacks in April 2025. Cybersecurity analysts linked affiliates of Scattered Spider (a group based in the United States and United Kingdom) to this activity. It began as a standard social engineering tactic and quickly snowballed into major operational disruptions.

Who is DragonForce ransomware group?

Data from Bitsight Threat Intelligence shows that DragonForce's attacks mostly focus on the US and the UK, though their reach also extends to organizations in Australia, Canada, Italy, and beyond. Rather than zeroing in on a single industry, they tend to be pragmatic opportunists. A broad mix of sectors including professional services, manufacturing, real estate, logistics, retail, healthcare, and technology have surfaced in public intelligence reports or on the group's dedicated leak site (DLS).

DragonForce first popped up on the ransomware scene back in August 2023. In the beginning, their early iterations relied on leaked code from LockBit 3.0. Later on, security researchers spotted a different build built on Conti v3 source code, packed with upgraded capabilities like adjustable encryption settings, scheduled runs, embedded drivers, and features designed to neutralize security tools.

By June 2024, the group started heavily pitching an affiliate program. They enticed partners with an 80% cut of ransom payouts alongside a full-featured management panel for generating payloads, tracking victims, setting team permissions, running negotiations, timing data leaks, and issuing decryption keys. Fast forward to March 2025, and DragonForce began branding their service as a “cartel.” In practice, this shift introduced a white-label arrangement that gave affiliates the freedom to leverage DragonForce tools and infrastructure while running operations under their own brand names.

DragonForce hasn't shied away from fighting for market share in the ransomware space, either. Industry reporting tied them to defacement attacks against the BlackLock and Mamona leak sites, as well as a heated rivalry with RansomHub. Then, in 2025, DragonForce, LockBit, and Qilin went public with a strategic alliance. That partnership signaled a clear push to pool resources and expand their collective reach across the affiliate market.

How does DragonForce’s model work?

At its core, DragonForce supplies the backend infrastructure for ransomware operations. Across their promo materials, they've highlighted capabilities such as:

DragonForce’s affiliate tools and services

• Ransomware builders and customized victim payloads
• Windows and VMware ESXi encryption capabilities
• Claimed NAS support in affiliate advertisements
• Leak-site hosting and distributed file storage
• Victim, team, and access management panels
• Negotiation, call, and decryption services
• Publication scheduling and hidden victim pages
• Options intended to disable or bypass endpoint security tools
• Data analysis intended to strengthen extortion and negotiation pressure

A newer focus on recruitment and data analysis

On September 22, 2026, Bitsight Threat Intelligence flagged a new post on DragonForce's leak site. The group was actively recruiting developers skilled in C/C++, Rust, and Go, alongside reverse engineers and researchers holding zero-day exploits, offering a revenue-sharing partnership model. In the post-frontier AI world, this highlights just how eager threat actors remain to acquire zero-days for initial compromise.

In a separate leak site post, the group rolled out a tailored “data analysis service.” DragonForce claimed it could go through exfiltrated corporate files, map out key legal and operational vulnerabilities, put together an analysis report, write up call scripts, and draft extortion letters aimed directly at executives. As an example, they showcased an analysis of specialized files allegedly stolen from a mining enterprise, covering geological models, drilling logs, geophysics data, geostatistical evaluations, and detailed engineering plans.

Essentially, DragonForce is attempting to turn raw stolen data into actionable pressure points that affiliates can lean on during extortion talks. This service also lowers the barrier to entry for affiliates who can breach networks and siphon data but lack the domain expertise to know what that data is actually worth. In effect, it opens up advanced extortion tactics to a broader range of cybercriminals.

Who does DragonForce ransomware target?

Because DragonForce relies on a classic affiliate model where independent operators bring their own targets, their activity isn't confined to any single region or sector.

Geography

Based on Bitsight threat intelligence, the most frequently targeted countries include:

• United States
• United Kingdom
• Australia
• Canada
• Italy

Sectors

Observed incidents and public reporting show activity across several industries:

• Manufacturing and industrial organizations
• Professional and legal services
• Real estate and property management
• Transportation and logistics
• Retail and e-commerce
• Healthcare
• Technology providers and MSPs
• Media and business services

Notable DragonForce ransomware activity

MSP and downstream customer compromise, May 2025

Incident responders investigated a major attack where a threat actor breached a managed service provider's SimpleHelp RMM environment to pivot directly into customer networks. The resulting DragonForce deployment and data theft impacted both the MSP and multiple downstream clients. Analysts concluded with medium confidence that the attacker chained together three SimpleHelp flaws disclosed in January 2025: CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726.

This incident highlights one of the biggest third-party risks associated with DragonForce. When an RMM platform gets compromised, a single initial foothold can quickly cascade into widespread breaches across multiple client environments.

Continued activity in 2026

Bitsight intelligence indicates sustained leak site claims and threat tracking across the US, UK, Australia, Canada, and Europe throughout 2026. Keep in mind that not all of these claims represent verified breaches. To protect privacy, organizations without public coverage remain anonymous here. Reported targets span professional services, healthcare, property management, manufacturing, logistics, media, and public sector organizations.

The recruitment drives and data analysis offerings spotted in September 2026 prove that DragonForce is actively refining its model. They aren't just hosting a static leak site — they're continually working to recruit skilled affiliates and make stolen files far more damaging during ransom negotiations.

DragonForce attack lifecycle and techniques

Since independent affiliates execute most DragonForce attacks, there isn't a single playbook that covers every breach. However, the following tactics and techniques consistently show up in incident investigations and threat reports.

Ransomware and tooling

Ransomware builds

• LockBit 3.0-based variant: An early DragonForce option built from the leaked LockBit 3.0 builder.
• Conti v3-based variant: Marketed as an original DragonForce build but assessed by researchers as a modified Conti v3 fork.
• Windows and ESXi payloads: The affiliate panel has generated victim-specific samples for Windows and VMware ESXi environments.
• Configurable encryption: Affiliates can set encryption scope, percentage, filenames, extensions, excluded paths, process termination, ransom-note names, and scheduled execution.

Defense evasion

The Conti-derived payload introduced Bring Your Own Vulnerable Driver (BYOVD) tactics. Attackers leveraged drivers like TrueSight.sys and RentDrv.sys to disable security monitoring tools. Other observed behaviors include:

• Clearing Windows Event Logs after encryption
• Deleting shadow copies
• Killing selected processes and services
• Encrypting filenames
• Using embedded configuration to reduce command-line requirements
• Obfuscating strings and resolving APIs by hash
• Comparing loaded functions with clean copies as an anti-hooking measure

Post-compromise tools

Confirmed intrusions frequently involve the following tools during post-exploitation:

• Cobalt Strike
• SystemBC
• Mimikatz
• ADFind
• SoftPerfect Network Scanner or similarly named network-scanning executables
• PowerShell
• RDP and legitimate administrative utilities

Because these tools are standard across many cybercrime operations, finding them isn't definitive proof on its own. Their presence should be analyzed alongside user activity, network traffic, and file encryption patterns before confirming attribution.

Vulnerabilities associated with DragonForce activity

Directly supported campaign link

CVEs surfaced in related Bitsight CTI reporting

Bitsight CTI also highlights CVE-2024-21893, CVE-2024-21887, CVE-2023-46805, CVE-2024-21412, and CVE-2021-44228 in relation to DragonForce threat data.

• CVE-2024-21893, CVE-2024-21887, and CVE-2023-46805 affect Ivanti products and were widely exploited by several actors.
• CVE-2024-21412 is a Microsoft Defender SmartScreen bypass publicly associated with other malware campaigns.
• CVE-2021-44228 is Log4Shell, a broadly exploited vulnerability used across the threat landscape.

Indicators of compromise

Bitsight CTI indicators

Historical public indicators

How to defend against DragonForce ransomware

Protect identity and help desk workflows

• Require phishing-resistant MFA for remote access and privileged accounts.
• Use a documented identity-verification process before password resets or MFA re-enrollment. Require an out-of-band callback to a number already on file for privileged users.
• Alert on unexpected MFA device enrollment, help-desk resets, new administrator accounts, and unusual logins using valid accounts.
• Revoke active sessions and tokens after suspected account compromise. A password reset alone may not end an attacker’s access.

Reduce third-party and RMM risk

• Identify every MSP, remote-support tool, and vendor account with access to the environment.
• Confirm that SimpleHelp and other remote monitoring and management (RMM) platforms are fully patched, especially against CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728.
• Segment RMM infrastructure from customer environments and limit which endpoints a vendor can reach.
• Require approval and monitoring for mass software deployment, scripts, and configuration changes initiated through RMM tools.
• Include downstream notification, logging, and incident-response obligations in MSP contracts.

Harden endpoints and hypervisors

• Enable EDR tamper protection and monitor for security services stopping unexpectedly.
• Apply Microsoft’s vulnerable-driver block rules and alert on new kernel-driver installation, particularly TrueSight.sys, RentDrv.sys, or renamed copies.
• Separate VMware ESXi and vCenter management from the user network. Use dedicated administrator identities and MFA.
• Monitor for PowerShell download activity, Cobalt Strike behavior, SystemBC persistence, Mimikatz, ADFind, unexpected network scanners, and unusual RDP movement.

Detect data theft before encryption

• Alert on bulk file access, large archive creation, unusual outbound transfers, and new cloud-storage tools on servers.
• Monitor executive mailboxes, legal repositories, file shares, and backup systems for abnormal access.
• Treat unexplained data staging as a possible pre-ransomware event, even if no encryptor has been detected.

Make recovery harder to disrupt

• Maintain offline or immutable backups using credentials separate from the production domain.
• Test restoration of critical systems and VMware workloads.
• Alert on shadow-copy deletion, backup-agent tampering, and changes to recovery settings.
• Exercise a double-extortion scenario that includes legal, privacy, communications, insurance, and law-enforcement decisions.

Monitor the operation carefully

• Monitor the DragonForce DLS, Telegram, and relevant underground sources for references to the organization, executives, brands, suppliers, and subsidiaries.
• Treat DLS entries as unverified claims until corroborated.
• Focus on defending against core attacker behaviors and access points rather than just tracking the group's name. Because of the affiliate structure, tactics can shift rapidly even while the DragonForce brand stays the same.