DragonForce

DragonForce is a financially motivated ransomware and extortion operation active since late 2023 that operates as a ransomware-as-a-service ecosystem. It is commonly referred to as DragonForce or Dragon Force, and is also described as a ransomware cartel or ransomware group. Reporting has suggested possible ties to Malaysia, but that attribution is not firmly established. DragonForce has been one of the more active ransomware brands in 2026, with victim claims spanning North America, Europe, the Middle East, Africa, and Asia-Pacific, and with repeated targeting of manufacturing, professional services, healthcare, financial services, technology, telecommunications, hospitality, and other sectors.

DragonForce is associated with double-extortion activity, combining data theft with threats to publish stolen information and, in many cases, file encryption. Public reporting also describes broader coercive behavior beyond conventional ransomware operations, including the use of distributed denial-of-service attacks and website defacements against rival criminal groups. In 2025, DragonForce was reported to have formed a ransomware alliance with LockBit and Qilin, indicating a willingness to cooperate tactically within the criminal ecosystem.

The group is notable both for its operational tempo and for signs of an affiliate-driven model. Other actors have reportedly worked as DragonForce affiliates before launching their own operations, and malware lineage analysis has linked at least one later ransomware program to DragonForce code or locker ancestry. DragonForce has also been observed in the broader healthcare threat landscape in EMEA and in ransomware activity affecting the UK and Ireland, where it ranked among the more active groups during early 2026.

Tradecraft associated with DragonForce includes data exfiltration, encryption for impact, public leak-site shaming, and psychologically manipulative negotiation tactics. Researchers have documented the group’s use of large language models to accelerate extortion workflows and generate more persuasive negotiation messages intended to pressure victims. DragonForce’s messaging has included fabricated or exaggerated claims designed to increase credibility and leverage during ransom discussions.

DragonForce has also appeared in reporting on affiliate tooling and ecosystem overlap. Externally sourced endpoint security disabling tools used in some ransomware intrusions have been observed in DragonForce affiliate activity, although those tools are not unique to the group. Overall, DragonForce should be understood as a prolific criminal ransomware brand with an active extortion program, broad victimology, affiliate participation, and a demonstrated willingness to adopt opportunistic tactics, cross-group collaboration, and AI-assisted social pressure to improve monetization.