ZeroHour

dragonforce

ransomware group · aka DragonForce, DragonForce Ransomware, DragonForce Cartel · Malaysia (widely reported by vendors; leadership identity and exact origin not officially confirmed) · active since 2023-08

Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
71
All-time (tracked)
650since 2023-12-13
Last post
09-16 06:35UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

DragonForce is an active ransomware-as-a-service (RaaS) operation first observed in August 2023, widely reported to be Malaysia-linked, with some vendor research connecting its founders to the earlier 'Operation' (a.k.a. Operation Cronos) brand. It runs a 'cartel' model in which multiple affiliates share its encryptors and leak-site infrastructure, sometimes posting victims under their own branding, and it publicly recruited affiliates displaced by the 2024 LockBit and BlackCat/ALPHV law-enforcement takedowns. The group uses double extortion, publishing stolen victim data on its Tor leak blog, and provides encryptors for Windows, Linux, VMware ESXi, macOS, and NAS devices. It drew wide attention in 2025 when Scattered Spider-affiliated intrusions using its tooling hit major UK retailers, and it subsequently launched an updated RaaS panel and a speed-focused encryptor rework. Dashboard leak-site tracking shows sustained high-volume activity (76 victims in the past 90 days), confirming the group remains a major brand.

Tactics & tooling
  • RaaS 'cartel' model: shares encryptors and leak infrastructure with affiliates that may post victims under their own branding
  • Double extortion: exfiltrates data before encryption and publishes stolen files on its leak blog
  • Initial access via IT help-desk social engineering by affiliates (Scattered Spider in the 2025 UK retail incidents)
  • Exploitation of internet-facing edge devices and VPNs (e.g., SonicWall SSL VPN activity reported in 2024)
  • Multi-platform encryptors covering Windows, Linux, VMware ESXi, macOS, and NAS devices
  • 2025 encryptor rework adding distributed encryption across machines and partial-encryption options to accelerate attacks (vendor reporting)
  • Public recruiting and rebranding of affiliates from other ransomware ecosystems onto shared infrastructure
Targeted sectors
retailmanufacturingprofessional serviceslegal servicesfinancial servicestechnology and MSPsconstruction
Notable public victims

Marks & Spencer (2025), Co-op Group (2025), Harrods (2025)

CVEs linked to their intrusions
Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
A C Scott Electric · Mar 6, 2026A.C. Scott Electric Company was established in 1967 by Dexter C. Ricker and Frederik C. Nielsen as a partnership. On May 14, 1968 the company succeeded to incor...
ICS Electrical Services · Mar 6, 2026ICS Electrical Services is a Cincinnati based electrical contracting company that has been specializing in complex industrial installations since 1997. We prov...
C.A. LINDMAN Inc. · Mar 6, 2026Numerous data items, including financial and project details, were leaked from servers located at the company's headquarters in Florida, Maryland, and North Car...
North Central HIDTA · Mar 6, 2026North Central HIDTA is a federal program aimed at uniting federal, state, local, and tribal law enforcement agencies to combat drug trafficking activities in Mi...
salfordcc.ac.uk · Mar 6, 2026Salford City College is one of the largest further education providers in Greater Manchester. It was established in 2009 following a merger between several pred...
Öztekin Group · Mar 4, 2026Öztekin Group specializes in project design and construction of industrial, residential, and commercial buildings. The company emphasizes commitment to promises...
Environmental Air · Mar 4, 2026Environmental Air, Inc. has been a trusted provider of Sheet Metal Fabrication, Custom Ductwork Fittings, Welding, and HVAC Installation services for over 40 ye...
Tenteks Tente · Mar 4, 2026Tenteks specializes in high-quality awning and shading systems, offering a wide range of models suitable for various applications. The company provides solution...
AHMED MUBARAK DEBT COLLECTION · Mar 4, 2026With over 14 years of experience, Ahmed Mubarak Debt Collection (AMDC) is licensed by the Government of Sharjah as “Debt Collectors” for consumer & commercial d...
Pantomath Group · Mar 4, 2026Pantomath is a mid-market investment bank that offers a range of financial services including investment banking, corporate advisory, asset management, and stru...
Huffman Insurance Agency · Mar 4, 2026Huffman Insurance Agency was founded in 1975 and operates in the Richlands, Virginia area with an office in Ashland, Kentucky. Huffman represents a strong netwo...
NEW GENERATION MEDIA · Mar 4, 2026NGM is a new generation media and production company founded on the understanding that producing content for the television industry is 'not just a commercial ...
Bravo Electro Components · Mar 4, 2026Bravo Electro specializes in providing a wide range of power supplies, including AC/DC converters, medical power supplies, and modular power solutions. They als...
Lincoln Green Brewing · Mar 4, 2026Lincoln Green Brewing Company Ltd. specializes in crafting a wide range of beers, including core, occasional, and special brews, available for online purchase. ...
importservices.co.uk · Mar 4, 2026Import Services Ltd (importservices.co.uk) is a Southampton-based UK logistics company specializing in retail supply chain services, contract warehousing, freig...
Lawrence Journal - World · Mar 3, 2026Lawrence Journal-World is a news organization based in Lawrence, Kansas, providing coverage on diverse topics including news, sports, opinion, and community eve...
Minogue Associates · Mar 3, 2026Minogue Associates, Inc. specializes in comprehensive construction valuation reports and estimates for both commercial and residential properties, as well as co...
ukimportservices.com · Mar 3, 2026Import Services Ltd (importservices.co.uk) is a Southampton-based UK logistics company specializing in retail supply chain services, contract warehousing, freig...
Encompass · Mar 3, 2026Founded in 2001 and headquartered in Clarksville, Virginia, Encompass Solutions is a preferred Epicor partner and Value-Added Re-seller (VAR), that delivers mis...
TIW Group · Mar 2, 2026TIW Group consists of two related contracting entities: Tidewater Interior Wall and Ceiling, Inc. and Mid-Atlantic Painting, Inc., offering Class-A drywall and ...
fgv.br · Mar 2, 2026Fundação Getulio Vargas (FGV) is a prestigious educational institution in Brazil, offering a wide range of programs including undergraduate, MBA, master's, and ...
Aegis Project Controls · Feb 28, 2026Aegis Project Controls is a construction company providing 4d scheduling, training, and construction scheduling services. 214GB of files, projects, and documen...
Audexia group · Feb 27, 2026Audexia Bourges - Volkswagen is a dealership known for its strong customer service and expertise in the automotive field. Located in Saint-Doulchard, France, it...
Salvatori Group of Companies · Feb 26, 2026Salvatori Group is a leading provider of transport and distribution services in Kent, specializing in UK and European logistics. They offer a comprehensive rang...
Hudson Awning · Feb 24, 2026Hudson Awning has been providing exceptional products and services since 1881, specializing in a wide variety of awnings, including fabric awnings, metal canopi...
Middlesex Transporters · Feb 24, 2026Middlesex Transporters LLC specializes in non-emergency medical transportation services aimed at providing cost-effective solutions for patients with healthcare...
Jac Vandenberg · Feb 24, 2026Jac Vandenberg is a company dedicated to providing fresh produce, including citrus, grapes, pome fruits, and stone fruits, sourced responsibly from farm to stor...
Zelenkofske Axelrod · Feb 23, 2026Zelenkofske Axelrod, LLC (ZA) is a regional CPA firm based in Pennsylvania, with multiple offices providing auditing, accounting consulting, and tax services pr...
fivestates.com · Feb 19, 2026Five States Energy is a private investment firm based in Dallas, Texas, with over 30 years of experience in the energy sector. The company specializes in acquir...
cepezed.nl · Feb 19, 2026cepezed is an award-winning spatial design firm. Its projects address challenges in urban planning, industry, interior design, and, especially, architecture. ce...
CCR Solutions · Feb 18, 2026Here is porn with the CEO of the company and his naked photos. CCR Solutions is a diverse and talented group of problem solvers, imaginative thinkers and caring...
hh2home.com · Feb 16, 2026For 30 years, we have been the preferred wholesale partner for many of your favorite retailers. During this time, we have continued to develop our passion for i...
faswealthpartners.com · Feb 16, 2026FAS Wealth Partners, Inc. is a fee-based financial advisory firm located in Kansas City. The company offers a wide range of services, including asset management...
traceenv.com · Feb 16, 2026Trace Environmental Systems Inc. is an innovative organization specializing in providing continuous stack emission monitoring systems and data collection soluti...
mapsweb.com · Feb 16, 2026Modern Advanced Print Solutions (MAPS, Inc.) is a leading independent corporation located in Leavenworth, Kansas, specializing in a wide range of products for ...
adelphi.uk.com · Feb 16, 2026The Adelphi Group supplies a wide range of packaging and processing equipment for various industries.
wiproferretto.com · Feb 16, 2026Wipro Ferretto Group Srl develops and manufactures material handling and storage solutions for various industries.Its product range includes automated warehouse...
Bigso · Feb 15, 2026Bigso Box, established in 1963, specializes in premium storage and packaging solutions that are both sustainable and stylish. Their product range includes custo...
Betesan · Feb 14, 2026Betesan is a leading engineering company established in 1992 in Tuzla, specializing in ship electrical contracting and supply of electrical materials. The compa...
MAIRIE DE FUMEL · Feb 14, 2026Fumel is a commune in the Lot-et-Garonne department in south-western France. Situated at the right bank of the river Lot, it is the centre of a small agglomerat...
SPIR STAR Asia · Feb 14, 2026Headquartered in Mörlenbach, Germany, SPIR STAR designs and manufactures a wide range of thermoplastic high pressure hoses for working pressures up to 3200 bar ...
Shining Labels · Feb 14, 2026Shining Labels specializes in high-quality apparel accessories, including reusable face masks made from breathable 100% polyester fabric. The company integrates...
Yem Chio Co · Feb 14, 2026Yem Chio Co., Ltd. was founded in 1978 by Mr. Chih Hsien Lee who is the current President and CEO. Although our business was started with low capital and easy e...
Elite Screens Inc. · Feb 13, 2026Founded in 2004, Elite Screens Inc. is a US-based projection screen manufacturing company with its world headquarters in California and satellite offices in Aus...
Empire Express · Feb 13, 2026Empire Express, Inc. provides trucking transportation services. The company offers transports clothing and apparel, air cargo, home and office products, packagi...
Yelete Group Inc · Feb 12, 2026Yelete Group, Inc. specializes in wholesale activewear, apparel, and lingerie, offering a wide range of products including leggings, tights, and various clothin...
A1 Capital · Feb 12, 2026A1 Capital offers specialized solutions in various fields of capital markets, including equity, Eurobond, Futures and Options (Viop), investment consultancy, po...
Atlantic Refinishing & Restoration · Feb 11, 2026The data leaked from the company's servers includes all project work(Exp. PENTAGON), employee information, confidential company agreements and etc. In particul...
R.J. Zavoral & Sons, Inc. · Feb 11, 2026Established in 1951, R.J. Zavoral and Sons, Inc. is a leading earth moving and construction services contractor based in East Grand Forks, MN, specializing in a...
Esposito Bros. Construction Ltd · Feb 6, 2026Esposito Bros. Construction Ltd. is a leading construction company based in Bolton, Ontario, recognized as one of the top bridge contractors. With over four dec...

In the newsAll →

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .