Overview
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
- First tracked: 2023-12-13
- Discussed in our reports: Bahrain · France · Gulf summary · Saudi Arabia · Türkiye · UAE
What public reporting says
Also known as: DragonForce Malaysia (hacktivist predecessor, link unconfirmed)
- Began as a pro-Palestinian hacktivist collective said to be based in Malaysia, then moved into ransomware. Hard evidence tying the two is limited, so we do not map an origin country.
- Runs an affiliate cartel with an 80% revenue share. Its encryptors started from the leaked LockBit 3.0 builder and later moved to a customised Conti v3 codebase. It was linked in 2025 to attacks on UK retailers, alongside the Scattered Spider collective.
Infosecurity Magazine · Acronis
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America308
United Kingdom47
Germany32
Canada21
Italy19
Australia18
France13
Hong Kong11
Brazil10
India9
Exploited vulnerabilities
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
| Execution | Defense Evasion | Discovery | Impact |
|---|---|---|---|
| User Execution | Indicator Removal: File Deletion | File and Directory Discovery | Data Encrypted for Impact |
| Impair Defenses: Disable or Modify Tools |
Technique details
Execution (TA0002)
- T1204.002 · User Execution: Executes a malicious file on the victim's system.
Defense Evasion (TA0005)
- T1070.004 · Indicator Removal: File Deletion: The ransomware self-deletes after execution.
- T1562.001 · Impair Defenses: Disable or Modify Tools: Disables Windows Defender (if it is running).
Discovery (TA0007)
- T1083 · File and Directory Discovery: The ransomware enumerates directories to encrypt files.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: The ransomware uses data encryption to extort the victim.
Tools
- Mimikatz
- Advanced IP Scanner
- PingCastle
- SoftPerfect NetScan
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| DragonForce | Blog | DLS | xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd[.]onion | Yes |
| — | DLS | dragongoztkdfmnd7jkchznd3fvkpdmeh4vhbt6p3usrlsoy5dw2bhyd[.]onion | No |
| DragonForce | Leaks | Files | dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd[.]onion | No |
| DragonForce | Migration completed | Chat | 3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd[.]onion | Yes |
| DragonForce | Migration completed | DLS | z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11