DragonForce Ransomware
A public, research-focused overview of DragonForce: its evolution from opportunistic ransomware-as-a-service into a cartel-style extortion platform, its affiliate model, reported tooling, and practical SOC watchpoints.
Executive summary
DragonForce is a financially motivated ransomware-as-a-service operation that emerged around 2023 and matured rapidly through 2024–2025. Public reporting describes it as both an affiliate program and, more recently, a cartel-style platform that allows affiliates to use DragonForce tooling, infrastructure, leak sites, and negotiation support under either DragonForce or white-label branding.
The group is notable less because its tradecraft is novel and more because it combines proven ransomware codebases, aggressive affiliate recruitment, double-extortion operations, and flexible branding.
For SOC teams, the meaningful signal is upstream of encryption: identity compromise, helpdesk social engineering, valid-account abuse, remote management tooling, data staging, endpoint-defense tampering, and lateral movement.
Contents
Timeline visual
Background
DragonForce first appeared publicly as a ransomware threat around 2023. Some reporting discusses possible name overlap or historic association with a Malaysian hacktivist identity, but the ransomware operation observed from 2023 onward is primarily financially motivated. The safest public assessment is that direct continuity between earlier hacktivist activity and the modern ransomware operation remains uncertain.
By mid-2024, DragonForce was advertising an affiliate program on underground forums. Group-IB reported that the affiliate program offered an 80/20 split in favour of affiliates and provided attack-management features such as client tracking, automated file delivery, secure affiliate access, team management, publication controls, and ransomware builder options.
Operational model
Affiliate recruitment
The group recruits access brokers, intrusion operators, penetration-test-style crews, and ransomware affiliates. Some public reporting says DragonForce has required affiliates to arrive with existing access and proof of exfiltrated data.
Infrastructure provisioning
DragonForce provides ransomware tooling, leak-site infrastructure, negotiation portals, storage, and affiliate control panels. White-label support reportedly allows affiliates to create their own brand while relying on DragonForce back-end services.
Double extortion
Victim data is exfiltrated before or alongside encryption. Pressure is framed around business interruption, disclosure risk, regulatory exposure, reputational harm, and executive attention.
Data-analysis extortion
Recent reporting describes services to analyse stolen data for negotiation leverage. This reflects a broader ransomware trend: monetisation depends on the perceived sensitivity of stolen data, not only encryption impact.
Victimology and targeting
Public reporting indicates broad, opportunistic targeting across multiple sectors rather than a narrow sector-specific mission. Reported sectors include retail, manufacturing, construction, transportation, real estate, healthcare, IT and managed service providers, professional services, public sector entities, and critical infrastructure-adjacent organisations.
Victim counts should be treated cautiously because ransomware leak-site data is adversary-controlled. Groups may duplicate, exaggerate, recycle, or selectively publish victims. The useful defensive conclusion is not the exact count, but the breadth of targeting and the affiliate-driven nature of the operation.
Scattered Spider relationship
CISA’s July 2025 update to the Scattered Spider advisory states that Scattered Spider actors have used several ransomware variants in data-extortion attacks, most recently including DragonForce ransomware.
This should be treated as affiliate or ecosystem overlap rather than a clean merger. In practice, SOC teams should expect DragonForce deployments to be preceded by identity-centric intrusion behaviours where Scattered Spider tradecraft is suspected.
- helpdesk social engineering
- phishing and credential capture
- MFA push abuse or bypass workflows
- SIM swapping
- remote access tool installation
- valid account abuse
Payloads and tooling
Public analysis describes early LockBit 3.0-derived payloads and later Conti/ContiV3-derived builds. Reported capabilities include configurable encryption, process and service termination, Windows Event Log clearing, scheduled execution, anti-analysis features, and BYOVD-enabled endpoint-defense evasion.
Reported supporting tools and malware include SystemBC, Cobalt Strike, Mimikatz, SoftPerfect Network Scanner / NetScan-like tooling, AdFind, PowerShell, schtasks.exe, wmic.exe, and legitimate or abused remote management tools.
SOC watchlist
Prioritise behaviour chains over final-stage ransomware hashes. Useful watchpoints for Sentinel, QRadar, Defender, Sophos, and NDR workflows include:
Hardening priorities
- Deploy phishing-resistant MFA for privileged and remote access.
- Harden helpdesk identity proofing before password or MFA resets.
- Govern RMM tooling with allowlists and alerting on unapproved installs.
- Remove standing domain admin use; apply tiered administration and JIT access.
- Enable and monitor EDR tamper protection and vulnerable-driver blocking.
- Maintain offline or immutable backups and test restore paths.
- Patch and monitor internet-facing VPN, RDP gateways, remote access, web apps, and identity infrastructure.
- Centralise logs quickly; assume local logs may be cleared late in the attack.
Public-safe conclusion
DragonForce represents the modern ransomware market’s direction: flexible affiliate ecosystems, borrowed malware foundations, identity-centric intrusion paths, and extortion models that increasingly monetise stolen data rather than relying only on encryption.
The group’s cartel posture should be read as a business model: lower friction for affiliates, white-label flexibility, and centralised criminal infrastructure. Defenders disrupt this model through identity resilience, remote-access governance, early lateral movement detection, hardened EDR controls, tested recovery paths, and fast triage of social-engineering-led intrusion signals.
Limitations
- Ransomware leak-site victim counts are adversary-controlled and may be inflated, duplicated, delayed, or selectively published.
- Attribution between DragonForce, Scattered Spider, affiliates, and other RaaS brands is fluid. Publicly reported links should be treated as operational overlap unless supported by direct evidence.
- Public sources vary on the extent of DragonForce’s hacktivist roots. This report avoids asserting a firm lineage between DragonForce Malaysia and the modern ransomware operation.
- This report intentionally avoids live dark-web collection, victim data reproduction, ransomware sample handling, and detailed exploit instructions.
Sources reviewed
| Source | Relevant contribution |
|---|---|
| CISA | Updated Scattered Spider advisory noting recent use of DragonForce ransomware and social-engineering-led TTPs. |
| Group-IB | DragonForce RaaS analysis, affiliate program details, LockBit/Conti lineage, TTPs, and supporting malware observations. |
| SentinelOne / Acronis / Trend Micro | Evolution from hacktivist-adjacent branding into financially motivated RaaS/cartel operations and 2025 ecosystem links. |
| FortiGuard / AttackIQ / Bridewell / Darktrace | Technique mapping, tooling observations, emulation case studies, and intrusion-chain behaviour. |
| Check Point / The Register / Picus / LevelBlue | Cartel positioning, retail-sector reporting, affiliate economics, and ecosystem context. |