DragonForce

DragonForce is a ransomware and extortion threat actor widely tracked as a ransomware-as-a-service operation and sometimes branding itself as a broader ransomware cartel. High-confidence reporting also links the name to earlier Malaysia-based hacktivist activity, including pro-Palestinian operations against Israeli and Indian targets, indicating that the DragonForce brand has been associated with both ideological and financially motivated campaigns over time. The actor is also referred to as Slippery Scorpius. As a ransomware operation, DragonForce has been among the most active groups observed in 2026, with a particularly strong concentration of victims in the United States and additional activity across Europe and the Americas. Reported victims and sectoral analyses indicate targeting of business services, healthcare, manufacturing, technology, construction, financial services, and other commercial organizations. Multiple assessments characterize its targeting as supply-chain-aware rather than purely opportunistic. DragonForce operates a leak site and uses extortion pressure based on stolen data in addition to encryption. Reported tactics include dedicated victim pages, countdown-based pressure, publication of stolen data, and release of negotiation material when victims do not pay. The group has been described as using a double-extortion model and as supporting affiliates who receive a substantial share of ransom proceeds. Technical reporting attributes mature tradecraft to DragonForce intrusions. In one major 2025 intrusion against a US services firm, operators reportedly maintained access for up to two months before ransomware deployment. They used a Go-based remote access trojan known as Backdoor.Turn to conceal command-and-control traffic within Microsoft Teams TURN relay infrastructure, combined with multi-vector bring-your-own-vulnerable-driver evasion. Observed post-compromise actions included creation of user accounts, modification of firewall rules, weakening of security settings, internal network scanning, browser credential theft, credential-based lateral movement, data exfiltration, and eventual encryption. Malware analysis of DragonForce ransomware indicates code lineage or derivation from leaked builder ecosystems associated with LockBit and, separately, use of Conti-derived code as a basis in 2023. Reported functionality includes dynamic API resolution, ChaCha20-based file encryption, process and service termination, shadow-copy discovery, local-drive and network-share enumeration, privilege checks, anti-forensics options, and encryption of network-accessible resources. DragonForce intrusions have also been associated with tooling such as ThrottleBlood. Earlier DragonForce activity was tied to hacktivist campaigns using website targeting, vulnerability exploitation, reconnaissance through search-engine and internet-exposure discovery, and HTTP-flooding DDoS attacks. Those operations reportedly focused on Indian government and related entities in 2022 and on Israeli targets beginning in 2021. Overall, DragonForce represents a hybrid threat brand spanning hacktivist origins and a later high-tempo ransomware enterprise, with demonstrated capabilities in initial access, persistence, defense evasion, credential theft, lateral movement, exfiltration, and encryption-based extortion.