Flare says Scattered Spider, LAPSUS$ and ShinyHunters are separate clusters
Shared branding does not prove one gang; Flare treats original LAPSUS$ as defunct after September 2022.
48
Malware
DragonForce
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenAug 17, 2026
- Last mentioned11d ago
Timeline
4 articles · newest firstMicrosoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
Microsoft says affiliate Storm-2570 reused one playbook across Qilin, DragonForce, Anubis, and BERT.
74
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
70
Dragonforce Turf War Ransomware
Infosecurity Magazine reports a turf war within the DragonForce ransomware operation, which could affect its cartel-style affiliate ecosystem.
55
Appears with
- Anubismalware · 2
- Qilinmalware · 2
- Microsoftorganization · 2
- BERTmalware · 2
- Storm-2570threat actor · 2
- commercial facilitiesvictim · 1
- ShinyHuntersthreat actor · 1
- Storm-2570ai model · 1
- MeshAgentproduct · 1
- financial servicesorganization · 1
- information technology (IT)victim · 1
- energyorganization · 1
- ransomware affiliateproduct · 1
- ngrokproduct · 1
- healthcarevictim · 1
- government agenciesorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.