dragonforce
ransomware group · aka DragonForce, DragonForce Ransomware, DragonForce Cartel · Malaysia (widely reported by vendors; leadership identity and exact origin not officially confirmed) · active since 2023-08
Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
71
All-time (tracked)
650since 2023-12-13
Last post
09-16 06:35UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
DragonForce is an active ransomware-as-a-service (RaaS) operation first observed in August 2023, widely reported to be Malaysia-linked, with some vendor research connecting its founders to the earlier 'Operation' (a.k.a. Operation Cronos) brand. It runs a 'cartel' model in which multiple affiliates share its encryptors and leak-site infrastructure, sometimes posting victims under their own branding, and it publicly recruited affiliates displaced by the 2024 LockBit and BlackCat/ALPHV law-enforcement takedowns. The group uses double extortion, publishing stolen victim data on its Tor leak blog, and provides encryptors for Windows, Linux, VMware ESXi, macOS, and NAS devices. It drew wide attention in 2025 when Scattered Spider-affiliated intrusions using its tooling hit major UK retailers, and it subsequently launched an updated RaaS panel and a speed-focused encryptor rework. Dashboard leak-site tracking shows sustained high-volume activity (76 victims in the past 90 days), confirming the group remains a major brand.
Tactics & tooling
- RaaS 'cartel' model: shares encryptors and leak infrastructure with affiliates that may post victims under their own branding
- Double extortion: exfiltrates data before encryption and publishes stolen files on its leak blog
- Initial access via IT help-desk social engineering by affiliates (Scattered Spider in the 2025 UK retail incidents)
- Exploitation of internet-facing edge devices and VPNs (e.g., SonicWall SSL VPN activity reported in 2024)
- Multi-platform encryptors covering Windows, Linux, VMware ESXi, macOS, and NAS devices
- 2025 encryptor rework adding distributed encryption across machines and partial-encryption options to accelerate attacks (vendor reporting)
- Public recruiting and rebranding of affiliates from other ransomware ecosystems onto shared infrastructure
Targeted sectors
retailmanufacturingprofessional serviceslegal servicesfinancial servicestechnology and MSPsconstruction
Notable public victims
Marks & Spencer (2025), Co-op Group (2025), Harrods (2025)
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims650 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| waypointsolutions.com | · May 27, 2026 | Waypoint Business Solutions partners with Dell Technologies to provide comprehensive IT solutions, including hardware, software, and professional services. |
| profundo.nl | · May 27, 2026 | Profundo is an independent research organization dedicated to advancing sustainable development and social justice through insightful, evidence-based research a... |
| jcripberger.com | · May 27, 2026 | J.C. Ripberger Construction Corporation is a full-service General Contractor, which self-performs Buildings/Structural Concrete, Carpentry, and Selective/Mass D... |
| pieralisi.com | · May 27, 2026 | Pieralisi is a leading company specializing in the production of equipment for the extraction and separation of liquids using centrifugal force, including decan... |
| nemd.com | · May 27, 2026 | NEMD Architects, Inc. specializes in innovative, functional, and sustainable architectural solutions that address the unique challenges of each project. |
| practicus.co.uk | · May 27, 2026 | Practicus specializes in interim management, executive search, and project management services. |
| refreshmentsystems.co.uk | · May 27, 2026 | Refreshment Systems is a UK-based vending machine company. |
| FWMK Law Offices | · May 27, 2026 | FWMK Law Offices is a full-service law firm known for its deep expertise in various legal areas, including high tech, mergers and acquisitions, and real estate.... |
| Ramos Rheumatology | · May 27, 2026 | Ramos Rheumatology is a leading care center in Avoca, PA, specializing in the diagnosis and treatment of autoimmune diseases such as lupus, rheumatoid arthritis... |
| dentonfirm.com | · May 27, 2026 | Denton Law Firm is committed to rapid response and providing real solutions. |
| hbroch.com | · May 27, 2026 | Founded in 1941, Henry Broch Foods is an American international food ingredient manufacturer, processor, and packaging company, sourcing high-quality natural in... |
| duboisag.com | · May 27, 2026 | To find a solution tailored to your situation, the company prioritizes your needs. The company's team's consulting, expertise, and high-quality service enhance ... |
| qlslogistics.com.au | · May 27, 2026 | QLS Group is Australia's leading supplier of large domestic appliances, serving the retail and consumer markets. Last year, the company shipped over 4 million a... |
| Greenway Technologies | · May 27, 2026 | Greenway Technologies is a leading fire protection company based in Phoenix, AZ, specializing in a comprehensive range of services including fire suppression sy... |
| Delbrook Capital Advisors | · May 27, 2026 | Delbrook Capital Advisors is an alternative investment manager that specializes in the global materials sector. The company focuses on providing investment solu... |
| WG Neukölln | · May 27, 2026 | WG Neukölln eG is a cooperative based in Berlin that offers various housing options and services, including apartments and residential projects. The organizatio... |
| allianceadjustment.com | · May 25, 2026 | Alliance Adjustment Group is a leading independent insurance claims adjuster serving Pennsylvania and New Jersey, specializing in handling a variety of insuranc... |
| xtr-global.de | · May 25, 2026 | Xchange Technology Rentals is a leading provider of IT and audiovisual equipment rental services for businesses, offering a wide range of devices with professio... |
| saver.nl | · May 25, 2026 | Saver NV operates in waste management, environmental services, and recycling. It employs 20 to 49 people and generates revenues of $5 to $10 million. The compan... |
| vegfresh.com | · May 25, 2026 | Veg-Fresh Farms is a family-owned business committed to providing its customers with the freshest and healthiest produce. The company offers a wide range of pro... |
| ggroupcpas.com | · May 25, 2026 | Goldklang Group CPAs specializes in audit and tax services for homeowners associations, condominiums, and housing cooperatives. With over 40 years of experience... |
| businessrecord.com | · May 25, 2026 | BusinessRecord.com provides RSS feeds free of charge for personal, non-commercial use. If you embed an RSS feed on a personal website, please include a link bac... |
| sphvalue.com | · May 25, 2026 | Since 1992, our team of experts in economics, accounting, finance, and valuation has earned an impeccable reputation for relentless analysis and exemplary quali... |
| ennsco.ca | · May 25, 2026 | Enns & Company Professional Corporation is a leading accounting and audit firm providing entrepreneurs with a full range of services, including auditing, tax co... |
| arsenalscaffold.com | · May 25, 2026 | Founded in 1998, Arsenal Scaffold Inc. specializes in providing professional scaffolding and vertical access solutions, including tubular and system scaffolding... |
| rolser.com | · May 25, 2026 | Rolser specializes in producing a variety of eco-friendly and practical products, including folding and non-folding shopping carts, eco-friendly ironing boards,... |
| epbinsurance.com | · May 25, 2026 | Ekblad, Pardee & Bewell, Inc. is an independent insurance agency licensed in Minnesota, Wisconsin, South Dakota, and Arizona, offering a wide range of insurance... |
| jakn.com | · May 25, 2026 | JAKN Network Support & Services LLC operates in the custom software development and IT services industry. It employs 10 to 19 people and generates revenues of $... |
| Heartland Growers | · May 24, 2026 | Heartland Growers is a full-service wholesale greenhouse located in Westfield, Indiana, owned and operated by the Gapinski Family since 1984. The company suppli... |
| HELIX INTERNATIONAL | · May 24, 2026 | Helix International is a software platform and managed services provider specializing in enterprise content management and data migration. They cater to medium,... |
| Prologic Construction | · May 24, 2026 | Prologic Construction is a trusted general contractor based in Alberta, specializing in high-quality construction solutions for both public and private sectors ... |
| Le Pain Quotidien US | · May 22, 2026 | Established in 1990 and headquartered in New York, New York, Le Pain Quotidien US is a chain of bakery restaurants specializing in baked goods, bread, salads, s... |
| Vega | · May 20, 2026 | Vega combines elite technical skills with personalized customer service and environmental stewardship to excel in the industrial and manufacturing sector. From ... |
| ZFG ALTHERM Engineering | · May 19, 2026 | ZFG ALTHERM Engineering GmbH specializes in engineering services for technical building equipment. The company focuses on providing high-quality planning and co... |
| TAURUS INVESTMENT HOLDINGS | · May 19, 2026 | Established in 1976, Taurus is a global real estate private equity firm with over 40 years of experience as a general partner, investor, and operator. Currently... |
| Ingelan | · May 17, 2026 | Ingelan is a provider of engineering solutions for systems and communications environments. It specializes in security of information systems, information syste... |
| Plan | · May 17, 2026 | Founded in 2013, Plan.com works with businesses using their platform to find telecom solutions. They are headquartered in Douglas, Isle of Man |
| AdvancedHEALTH. | · May 16, 2026 | We will Leak random amount of patient data everyday, until we've been paid or the timer hits 0. Check this description for Fresh leaks everyday. NEW RULE, WE DO... |
| AdvancedHEALTH | · May 16, 2026 | The leak contains 2,300,000 Lines of FULL patient data, partner agreements, management, payroll and HR files. Screenshot attached :) We Will Leak 1,000 Lines o... |
| LeRoy Surveyors & Engineers | · May 15, 2026 | LeRoy Surveyors & Engineers, INC. specializes in property boundary surveying, topographic surveys, and subdivision surveys, primarily serving clients in the Puy... |
| Advanced Medical Consultants | · May 15, 2026 | The leak contains 2,300,000 Lines of FULL patient data, partner agreements, management, payroll and HR files. Screenshot attached :) We Will Leak 1,000 Lines o... |
| MicroMarketing | · May 13, 2026 | MicroMarketing specializes in expert title selections for books, audio CDs, and DVDs, catering primarily to librarians and libraries. The company is known for i... |
| Pamil Modulsystem | · May 13, 2026 | Pamil Modulsystem specializes in renting flexible modular buildings tailored for various needs, including offices and schools. Established in 1963, the company ... |
| Tricon Infotech | · May 13, 2026 | Tricon Infotech delivers efficient, automated solutions and full digital transformations through custom products and enterprise implementations. The company's w... |
| CF Evans Construction | · May 8, 2026 | A recognized leader in the multi-family housing construction industry, CF Evans Construction provides a product for developers. The company has thrived amid six... |
| CMC Expertise Comptable | · May 8, 2026 | CMC Expertise Comptable is a certified accounting firm located in Martinique, dedicated to providing comprehensive support in accounting, social, legal, and fis... |
| Cult Wines | · May 4, 2026 | Cult Wines is revolutionizing the fine wine industry by leveraging expertise, digital platforms, and innovative technology to enhance the buying, selling, inves... |
| Promotion AB | · Apr 27, 2026 | Etablerad redan 1979 och genom en merger med Eclipse Display 2020 kör vi nu full gas framåt på vår resa att bli nordens bästa partner när det gäller att förenkl... |
| ibswebsite.com | · Apr 27, 2026 | The company helps commercial organizations invest in technology solutions for their businesses by offering technology consulting, as well as the design and inte... |
| delonhampton.com | · Apr 27, 2026 | An engineering and consulting firm specializing in civil and structural engineering, program management, and construction, delivering complex infrastructure pro... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .