Loading threat actor…
DragonForce Malaysia is a pro-Palestinian hacktivist group associated with politically motivated cyber campaigns against Israel and, previously, India. The group is linked to Malaysia and is known for organizing branded operations including OpsBedil, OpsBedil Reloaded, OpsPetir, and OpsPatuk. Its campaigns are framed around geopolitical and ideological causes rather than financial gain, and have focused on disrupting online services, amplifying political messaging, and mobilizing supporters. DragonForce Malaysia has repeatedly participated in anti-Israel activity, including campaigns overlapping with OpIsrael. Reported targeting has included Israeli universities, financial institutions, government entities, religious organizations, healthcare organizations, service providers, and transportation organizations, as well as entities perceived as supporting Israel directly or indirectly. The group has also been observed directing activity at Indian targets in a separate politically motivated campaign. Its tradecraft is characteristic of hacktivist operations: denial-of-service attacks, website defacements, scanning, exploitation attempts, and claimed data-dump activity. DragonForce Malaysia has used online forums, Telegram, Discord, and related social platforms to announce operations, coordinate participants, and distribute tactics and tooling. Reporting has also associated the group with a DDoS utility known as CyberTroopers, described as an obfuscated Python-based tool supporting TCP, UDP, and HTTP flooding and using proxy infrastructure to obscure attack origin and complicate mitigation. The group has also been observed collaborating with other hacktivist collectives including T3 dimension Team, Reliks Crew, and AnonGhost. Although some reporting has speculated about a relationship between DragonForce Malaysia and the separate DragonForce ransomware operation, that linkage remains unconfirmed and should not be treated as established. DragonForce Malaysia is best characterized as a Malaysia-linked hacktivist actor focused on disruptive and propagandistic cyber operations in support of pro-Palestinian causes.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group primarily engaged in threat messaging/mobilization directed at Israeli infrastructure (per the report).
Hacktivist operations targeting Israel under the OpsPetir campaign, with attacks against universities, financial institutions, and expected targeting of religious organizations, healthcare, service providers, transportation, and government agencies. Activity includes scanning and exploiting, data dumps, denial-of-service attacks, and website defacements.
Hacktivist group from Malaysia that publicly discussed plans to develop a ransomware operation (unconfirmed linkage to DragonForce).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.