DragonForce is a financially motivated ransomware-as-a-service brand first observed in August 2023. Sophos Counter Threat Unit reported that it began as a conventional affiliate service and announced a new self-described cartel model in March 2025. The model is better understood as distributed or white-label affiliate branding: partners can use DragonForce infrastructure and ransomware while operating under their own names. This profile concerns the ransomware operation; the reviewed sources do not establish a relationship with the separate hacktivist name DragonForce Malaysia.
DragonForce has supported attacks across sectors and regions, including high-impact incidents affecting traditional IT and virtualized infrastructure. Sophos reported that the brand gained visibility during 2025 retail-sector intrusions and competed aggressively for affiliates after disruption or instability at other ransomware services. Those public attributions and DragonForce’s own victim claims require incident-specific corroboration; use of its ransomware can indicate an affiliate rather than direct action by the core operators.
The operation also targeted rival ransomware brands and promoted purported alliances or takeovers in underground forums. Sophos observed apparent defacements of BlackLock and Mamona sites and contested messaging around RansomHub. These events show competition and recruitment activity, but they do not prove that every advertised coalition or takeover produced a stable operational relationship.
DragonForce provides affiliates with ransomware, leak and negotiation infrastructure and operational support. Sophos reported emphasis on credential theft, Active Directory abuse, data exfiltration and encryption of both conventional systems and VMware ESXi environments. The service’s distributed model permits affiliates to bring their own access methods, malware and branding, which increases variation between incidents.
In a separate Sophos MDR investigation, an actor compromised a managed service provider’s SimpleHelp remote-management environment, inventoried customer systems and deployed DragonForce ransomware across multiple endpoints. Sophos assessed with medium confidence that the actor exploited a chain of SimpleHelp vulnerabilities, and documented both data exfiltration and downstream ransomware impact. That case demonstrates supply-chain reach through legitimate remote-management infrastructure but does not establish SimpleHelp exploitation as DragonForce’s universal access method.
DragonForce is best characterized as a financially motivated ransomware group operating a flexible service and affiliate ecosystem. Core operators supply shared infrastructure and tooling; affiliates may conduct access, choose victims and present attacks under independent brands. The cartel label is the operation’s own marketing term, not evidence of centralized control over every affiliated actor. Public sources do not identify the core operators, establish their jurisdiction or support state sponsorship.
DragonForce claimed AdvancedHEALTH and alleged theft of 390 GB including 2.3 million lines of patient data and corporate files. The victim did not confirm the claim.
DragonForce listed Strafford County NH using the historical strafford.nh.us domain. The tracker recorded discovery on June 16, 2025, at 20:37:18.024969 UTC; the original post’s publication time is not independently verified. Comparitech’s June 16-updated report describes an alleged 830.03 GB and a five-day publication threat that the county had not confirmed. In earlier March reporting, officials said no ransom demand had been received and did not then believe ransomware was involved. The listing does not independently establish responsibility, encryption, data theft, file volume or actual publication.
DragonForce claimed Mastery Schools. Comparitech reports a claimed 171 GB; responsibility and quantity are not victim-confirmed. Native tracker discovery is not original posting. Independent confirmation of encryption and theft does not identify the group.
Ransomware.live indexed a claim associated with DragonForce naming Oahu Transit Services and thebus.org. The index discovery timestamp is June 15, 2024; the original posting time is unverified. The text alleges possession of about 800,000 records and threatens consequences unless the organization makes contact. Listed database field names do not establish populated values or affected-person counts. Contemporary reporting described conflicting deadlines and possible impersonation. The claim does not independently confirm encryption, data theft, operator identity or payment.
DragonForce claimed the city as a victim; the city has not verified responsibility or the group’s asserted data volume.
