DragonForce Ransomware Targets Major UK Retailers, Including Harrods, Marks & Spencer, and Co-Op

Major UK retailers including Harrods, Marks and Spencer, and Co-Op are currently experiencing significant service disruptions following a series of coordinated ransomware attacks attributed to the DragonForce group.

The attacks have affected critical business functions including payment systems, inventory management, and payroll processing.

This campaign marks a significant escalation in DragonForce’s operations, which previously targeted organizations including Honolulu OTS, the Government of Palau, Coca-Cola (Singapore), Ohio State Lottery, and Yakult Australia.

- Advertisement -

Technical analysis reveals that DragonForce’s initial access tactics primarily involve phishing emails and exploitation of known vulnerabilities in corporate networks.

The group is known to leverage leaked or stolen credentials to access internet-facing devices and deploys Cobalt Strike for campaign management.

Security researchers have linked several specific vulnerabilities to previous DragonForce intrusions, including CVE-2021-44228 (Log4Shell), CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure authentication bypass and command injection), CVE-2024-21412 (Microsoft Windows SmartScreen bypass), and CVE-2024-21893 (Ivanti Connect path traversal).

Once inside victim networks, the attackers utilize sophisticated tools including mimikatz for credential harvesting, Advanced IP Scanner for network reconnaissance, and PingCastle for Active Directory assessment.

The group also targets RDP services with credential stuffing attacks and exploits VPN weaknesses.

For persistence, DragonForce operators deploy the SystemBC backdoor, a multi-platform proxying malware that creates SOCKS5 tunnels through compromised networks.

Evolution of DragonForce’s Ransomware Payload

DragonForce’s technical capabilities have evolved significantly since its emergence in August 2023.

Initially, the group’s ransomware payloads were based entirely on the leaked LockBit 3.0 builder, but they have since developed more bespoke variants with roots in the Conti v3 codebase.

While earlier variants used AES for file encryption and RSA for key security, newer Conti-derived samples implement the ChaCha8 algorithm, which provides improved encryption speed.

The ransomware now features a sophisticated affiliate panel that enables customization of payloads for specific platforms including Windows, Linux, EXSi, and NAS devices.

The malware supports multiple command-line options for controlling encryption behavior, file discovery modes, and execution timing.

Technical specifications indicate that affiliates can manage multiple builds per platform for each victim, with options to customize encryption behaviors, appended file extensions, and process termination configurations.

Operations Growth and Defence Advice

In early 2025, DragonForce expanded its business model by introducing a ‘white-label’ branding service that allows affiliates to disguise the ransomware as a different strain for an additional fee.

This service, called RansomBay, allows affiliates to keep 80% of ransom payments while DragonForce takes 20%.

This evolution positions DragonForce as a “Ransomware Cartel” with infrastructure and malware support similar to operations like RansomHub, Rabbit Hole, and Dispossessor.

Cybersecurity experts recommend organizations implement robust defenses including endpoint protection platforms with behavioral ransomware detection capabilities.

SentinelOne’s Singularity Platform has introduced enhanced detection via a Live Security Update in March 2025 specifically targeting DragonForce variants.

Security teams should also prioritize patching the specific vulnerabilities exploited by the group, implement multi-factor authentication, and develop comprehensive incident response procedures to mitigate potential damage from DragonForce attacks.

As DragonForce continues to blur the lines between hacktivism and financial motivation, organizations must maintain strong cybersecurity practices, efficient configuration management, and complete visibility into their digital assets to defend against these increasingly sophisticated ransomware attacks.

Indicators of Compromise(IOC):

Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download