dragonforce
ransomware group · aka DragonForce, DragonForce Ransomware, DragonForce Cartel · Malaysia (widely reported by vendors; leadership identity and exact origin not officially confirmed) · active since 2023-08
Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
71
All-time (tracked)
650since 2023-12-13
Last post
09-16 06:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
DragonForce is an active ransomware-as-a-service (RaaS) operation first observed in August 2023, widely reported to be Malaysia-linked, with some vendor research connecting its founders to the earlier 'Operation' (a.k.a. Operation Cronos) brand. It runs a 'cartel' model in which multiple affiliates share its encryptors and leak-site infrastructure, sometimes posting victims under their own branding, and it publicly recruited affiliates displaced by the 2024 LockBit and BlackCat/ALPHV law-enforcement takedowns. The group uses double extortion, publishing stolen victim data on its Tor leak blog, and provides encryptors for Windows, Linux, VMware ESXi, macOS, and NAS devices. It drew wide attention in 2025 when Scattered Spider-affiliated intrusions using its tooling hit major UK retailers, and it subsequently launched an updated RaaS panel and a speed-focused encryptor rework. Dashboard leak-site tracking shows sustained high-volume activity (76 victims in the past 90 days), confirming the group remains a major brand.
Tactics & tooling
- RaaS 'cartel' model: shares encryptors and leak infrastructure with affiliates that may post victims under their own branding
- Double extortion: exfiltrates data before encryption and publishes stolen files on its leak blog
- Initial access via IT help-desk social engineering by affiliates (Scattered Spider in the 2025 UK retail incidents)
- Exploitation of internet-facing edge devices and VPNs (e.g., SonicWall SSL VPN activity reported in 2024)
- Multi-platform encryptors covering Windows, Linux, VMware ESXi, macOS, and NAS devices
- 2025 encryptor rework adding distributed encryption across machines and partial-encryption options to accelerate attacks (vendor reporting)
- Public recruiting and rebranding of affiliates from other ransomware ecosystems onto shared infrastructure
Targeted sectors
retailmanufacturingprofessional serviceslegal servicesfinancial servicestechnology and MSPsconstruction
Notable public victims
Marks & Spencer (2025), Co-op Group (2025), Harrods (2025)
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims650 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Zimmerman & Walsh | · Nov 16, 2024 | — |
| Lyomark Pharma | · Nov 16, 2024 | — |
| Orbit Software, Inc. | · Nov 16, 2024 | — |
| Durham Region | · Nov 16, 2024 | — |
| Mastery Schools | · Nov 16, 2024 | — |
| Accuracy International | · Nov 16, 2024 | — |
| Scolari | · Nov 16, 2024 | — |
| Nunziaplast Srl | · Nov 16, 2024 | — |
| Sherwood Stainless & Aluminium | · Sep 10, 2024 | — |
| Igloo Cellulose | · Sep 10, 2024 | — |
| Raifalsa-Alelor Raifalsa-Alelor | · Sep 10, 2024 | — |
| PhD Services | · Sep 10, 2024 | — |
| Controlled Power | · Sep 10, 2024 | — |
| Arc-Com | · Sep 10, 2024 | — |
| Yang Enterprises | · Aug 19, 2024 | — |
| Carver Companies | · Aug 19, 2024 | — |
| J&J Network Engineering | · Aug 19, 2024 | — |
| PER4MANCE | · Aug 19, 2024 | — |
| SMK Ingenieurbüro | · Aug 19, 2024 | — |
| David E Shambach Architect | · Aug 2, 2024 | — |
| Hayes Beer Distributing | · Aug 2, 2024 | — |
| BK Aerospace | · Jul 25, 2024 | — |
| CertiCon | · Jul 25, 2024 | — |
| Dimbleby Funeral Homes | · Jul 24, 2024 | — |
| John Gallin & Son | · Jul 24, 2024 | — |
| Mainland Machinery | · Jul 16, 2024 | — |
| SBRPCA | · Jul 16, 2024 | — |
| Raffmetal Spa | · Jul 8, 2024 | — |
| Grand Rapids Gravel | · Jul 2, 2024 | — |
| Franciscan Friars of the Atonement | · Jul 2, 2024 | — |
| Elite Fitness | · Jul 2, 2024 | — |
| Gray & Adams | · Jul 2, 2024 | — |
| Vermont Panurgy | · Jul 2, 2024 | — |
| Super Gardens | · Jul 2, 2024 | — |
| Hampden Veterinary Hospital | · Jul 2, 2024 | — |
| Oahu Transit Services | · Jun 15, 2024 | — |
| Seafrigo | · Jun 11, 2024 | — |
| Barrett Eye Care | · Jun 9, 2024 | — |
| Parrish-McCall Constructors | · Jun 9, 2024 | — |
| EvoEvents | · Jun 9, 2024 | — |
| Hoppecke | · Jun 8, 2024 | — |
| Davis & Young | · Jun 5, 2024 | — |
| biremote.net | · May 31, 2024 | — |
| I.L.A. Local 1964 | · May 29, 2024 | — |
| Dean Lumber & Supply | · May 17, 2024 | — |
| WindCom | · May 17, 2024 | — |
| Connelly Security Systems | · May 14, 2024 | — |
| Motor Munich | · May 14, 2024 | — |
| Hardings Transport | · May 14, 2024 | — |
| Altipal | · May 14, 2024 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .