Ransomware Intelligence / Groups / dragonforce

Ransomware group

dragonforce

DragonForce is a ransomware-as-a-service (RaaS) group first identified in late 2023. Originally linked to hacktivist activity, the group pivoted to financially motivated operations by early 2024. Since then, it has accelerated into a highly organized cartel-like network, providing customizable payloads to affiliates, a sophisticated affiliate portal, and shared infrastructure for leak sites and campaigns. The group has targeted a wide range of sectors globally, including major UK retailers such as M&S, Harrods, and Co-op, along with organizations in government, logistics, and manufacturing. Its operations are known for strategic branding flexibility, enabling affiliates to operate under their own labels using DragonForce’s backend services.

  • 1claims, 7 days
  • 10claims, 30 days
  • 32claims, 90 days
  • 2026-04-01first seen
  • 2026-10-30last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-05-11: 9Week of 2026-05-18: 7Week of 2026-05-25: 37Week of 2026-06-01: 6Week of 2026-06-08: 13Week of 2026-06-15: 1Week of 2026-06-22: 3Week of 2026-06-29: 5Week of 2026-07-06: 4Week of 2026-07-13: 29Week of 2026-07-20: 5Week of 2026-07-27: 4Week of 2026-08-03: 7Week of 2026-08-10: 2Week of 2026-08-17: 3Week of 2026-08-24: 4Week of 2026-08-31: 4Week of 2026-09-07: 1Week of 2026-09-14: 2Week of 2026-09-21: 6Week of 2026-09-28: 0Week of 2026-10-05: 4Week of 2026-10-12: 3Week of 2026-10-19: 0Week of 2026-10-26: 3Week of 2026-11-02: 0
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Sectors claimed, last 90 days

  1. Manufacturing 10
  2. Professional services 4
  3. Retail 4
  4. Technology 3
  5. Construction 2
  6. Critical infrastructure 2
  7. Financial services 2
  8. Healthcare 2
  9. Other 2
  10. Higher education 1

Countries claimed, last 90 days

  1. United States 12
  2. Brazil 3
  3. Unknown 2
  4. Argentina 2
  5. Canada 2
  6. France 2
  7. United Kingdom 2
  8. Taiwan 2
  9. United Arab Emirates 1
  10. Peru 1
  11. Poland 1
  12. Thailand 1
  13. UA 1

Vulnerabilities dragonforce exploits

CVEs attributed to dragonforce by Ransomware.live, most severe first. Patch these first if this group is in your threat model.

CVE Vendor / product CVSS CISA KEV
CVE-2021-44228 Apache Log4j 10.0 Critical Listed 2021-12-10, ransomware use
CVE-2024-57726 SimpleHelp SimpleHelp RMM 9.9 Critical Listed 2026-04-24, ransomware use
CVE-2024-55591 Fortinet FortiOS & FortiProxy 9.8 Critical Listed 2025-01-14, ransomware use
CVE-2024-40766 SonicWall SonicOS SSL-VPN 9.8 Critical Listed 2024-09-09, ransomware use
CVE-2024-21762 Fortinet FortiOS & FortiProxy 9.8 Critical Listed 2024-02-09, ransomware use
CVE-2025-5777 Citrix NetScaler ADC & Gateway 9.3 Critical Listed 2025-07-10, ransomware use
CVE-2024-21887 Ivanti ICS 9.1 Critical Listed 2024-01-10, ransomware use
CVE-2024-21893 Pulse Secure / Ivanti Ivanti Connect Secure 8.2 High Listed 2024-01-31, ransomware use
CVE-2023-46805 Pulse Secure / Ivanti Ivanti Connect Secure 8.2 High Listed 2024-01-10, ransomware use
CVE-2024-21412 Windows SmartScreen 8.1 High Listed 2024-02-13, ransomware use
CVE-2024-57727 SimpleHelp SimpleHelp RMM 7.5 High Listed 2025-02-13, ransomware use
CVE-2024-57728 SimpleHelp SimpleHelp RMM 7.2 High Listed 2026-04-24, ransomware use

70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →

Newest vulnerabilities used by any ransomware group (CISA KEV)
Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Tactics and techniques

MITRE ATT&CK techniques reported for dragonforce by Ransomware.live, in attack order.

Execution
Defense Evasion
Discovery
Impact

Ransom demands

Opening demands in 19 leaked negotiation chats from 2024–2026.

  • $100k–$7Mrange
  • $955kmedian opening demand
  • 19chats
  • 2024–2026years

From 193 leaked negotiation chats (Ransomchats, MIT license). Leaked and contributed chats are not a representative sample: a few groups and years dominate, and big cases are over-represented. Amounts are the group's first stated total demand in US dollars. 11 of these demands were made in bitcoin and are converted at the bitcoin price on the day of the chat. Crypto demands from chats with no known date are not included. How these figures are extracted.

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 13 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology