dragonforce Ransomware
Tracked since Dec 13, 2023
1
victims recorded
1
in the last 30 days
0
CVEs
1d
Last activity
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Execution
T1204.002 User Execution Defense Evasion
T1070.004 Indicator Removal: File DeletionT1562.001 Impair Defenses: Disable or Modify Tools Discovery
T1083 File and Directory Discovery Impact
T1486 Data Encrypted for Impact Observed tools
Credential Theft
Mimikatz
Discovery Enum
Advanced IP Scanner · PingCastle · SoftPerfect NetScan
Most affected countries (30 days)
- United States1
Most affected sectors (30 days)
- Manufacturing1
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live