DragonForce is a ransomware group that has rapidly evolved into a cartel-style operation, extending its reach across the cybercrime ecosystem since late 2023.
Operating under a Ransomware-as-a-Service (RaaS) model, the group now positions itself not just as a single gang, but as a platform for other threat actors and affiliate crews.
Over time, the group shifted from a single-operation model into a RaaS “cartel,” inviting other ransomware operators and affiliates to join under its umbrella while retaining their own branding.
Its infrastructure includes the “RansomBay” service, which lets partners generate customized payloads and configure attacks, further reinforcing its cartel-like role in the underground economy.
DragonForce first appeared in December 2023, when a user known as @dragonforce on BreachForums published stolen data and began advertising custom ransomware built from leaked LockBit 3.0 and Conti source code.
DragonForce Ransomware Group
DragonForce’s first victim appeared on its public Data Leak Site (DLS) on December 6, 2023, marking the start of a sustained campaign of data extortion.
From December 2023 through January 2026, the group listed 363 victim organizations on its DLS, with activity increasing sharply from 2025 onward. The group initially disclosed 22 victims in December 2023.
Steadily ramped up operations, peaking in December 2025 with 35 victims posted in a single month, its highest recorded level of activity.
These disclosures, combined with high-profile attacks in sectors such as retail, manufacturing, and services, reflect a deliberate strategy to maximize pressure and visibility in ransom negotiations.
To maintain its influence, DragonForce actively operates on major dark web forums, including BreachForums, RAMP, and Exploit, where it leaks data, recruits affiliates, and markets its services.
Recruitment posts highlight a differentiated service portfolio: the DragonForce “ransomware cartel” brand, the RansomBay builder service, harassment calling operations against victims, and data analysis offerings designed to increase leverage during extortion.
Encryption Ratio field in its metadata structure from 1 byte to 4 bytes, resulting in a 3-byte increase in the total metadata size appended to encrypted files.
Service stack goes beyond typical RaaS schemes, DragonForce as a multi-service crime hub rather than just a ransomware distributor.
DragonForce’s cartel strategy also relies on managing relationships with other cybercrime groups across the dark web.
Public activity shows both collaboration and aggression: the group has sought cooperation with LockBit and Qilin, while simultaneously clashing with rivals such as RansomHub and BlackLock, including attacks on their infrastructure and leak sites.
Intelligence reporting further links DragonForce to or alongside groups such as BlackLock, RansomHub, Scattered Spider, DEVMAN, and LockBit in either cooperative or adversarial contexts, underscoring its embedded role in a crowded ransomware ecosystem.
Technical evolution
Under the hood, DragonForce has continued to refine both its malware and its affiliate tooling.
After encrypting files, the ransomware encodes file names and modifies the MOTD file, completing the execution flow.
Its affiliate panel exposes extensive capabilities, including victim management, payload (build) generation, team coordination, content and leak publishing, and integrated support ticket handling for affiliates.
Earlier panel versions exposed BYOVD (Bring Your Own Vulnerable Driver) options and a LockBit-based builder, but these have since been removed from the interface, even though BYOVD-powered process termination remains embedded in newly generated binaries.
Recent updates also added an extension-based encryption mode feature, allowing operators to choose full, partial, or header-only encryption per file type to balance impact and speed.
The malware itself is cross-platform, with Windows and Linux versions (including ESXi, NAS, and RHEL builds) sharing core encryption and configuration logic, while the ESXi variant adds virtual machine shutdown and environment collection for maximum disruption in virtualized environments.
Changes to DragonForce’s panel, builder, and binaries since 2024 show that the group is actively maintaining and modernizing its tools rather than running a one-off campaign.
Combined with its cartel branding, aggressive targeting of rivals, and a growing pool of 363 known victim organizations, DragonForce is poised to remain a key actor in the ransomware landscape and a priority threat for defenders through 2026.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
