Sure! Here’s a rephrased version of your title for improved SEO: “Comprehensive Analysis of DragonForce Ransomware Attack: Targeted Victims, Tactics, Techniques, Procedures (TTPs), and Indicators of Compromise (IoCs)
DragonForce represents a sophisticated and rapidly evolving ransomware operation that has emerged as a significant threat in the cybersecurity landscape since late 2023. Operating under a Ransomware-as-a-Service (RaaS) model, this group has demonstrated exceptional adaptability by leveraging leaked ransomware builders from notorious families like LockBit 3.0 and Conti to create customised attack variants. The organisation has successfully targeted high-profile victims across multiple sectors, including government entities, retail giants, and critical infrastructure, with notable attacks against the Ohio Lottery, Palau Government, and major UK retailers like Marks & Spencer. Their operations combine advanced technical capabilities with professional business practices, offering affiliates up to 80% of ransom payments while providing comprehensive attack infrastructure and support services.
DragonForce first appeared in December 2023 with the launch of their “DragonLeaks” dark web portal, quickly establishing themselves as a formidable player in the ransomware ecosystem. The group’s origins trace back to possible connections with DragonForce Malaysia, a hacktivist collective, though the current operation has evolved into a purely profit-driven enterprise. By 2025, DragonForce has matured into a sophisticated RaaS platform that attracts both displaced affiliates from dismantled ransomware operations and freelance threat actors seeking robust infrastructure. The organisation operates two distinct ransomware variants based on leaked source code from established families. Their initial variant utilised the leaked LockBit 3.0 (Black) builder, allowing them to rapidly deploy effective ransomware without developing complex encryption mechanisms from scratch. In July 2024, DragonForce introduced a second variant based on the Conti V3 codebase, providing affiliates with enhanced customisation capabilities. This dual-variant approach demonstrates the group’s technical sophistication and commitment to providing affiliates with diverse attack options.
Categories: Ransomware-as-a-Service, Cybercrime Operations, Attack Vectors
Tags: Ransomware, DragonForce, Ransomware-as-a-Service, Cybersecurity, Attack Variants, Phishing, Critical Infrastructure, Customization, Affiliates, Dark Web