DragonForce Ransomware Explained: Origins, Attack Methods, Real Cases and Defence

 

What Is DragonForce and Why Does It Matter?

DragonForce ransomware is extortion software, and also the name of a criminal operation, that locks a company's files and threatens to leak stolen data unless a payment is made. Think of it like a burglar who not only changes your locks but also photographs your private papers and demands money to keep them off the internet. The operation first appeared in 2023 and became a global headline in 2025 after a string of attacks on well-known British retailers. Students of cybersecurity study it today because it shows how a technical tool, a business model and human trickery can combine into one very effective threat.

To understand the topic properly, it helps to separate three ideas that people often mix together. The first idea is the malicious software itself, which is the encryptor that scrambles files. The second is the crew that leases that software, and the third is the network of affiliates who actually break into victim networks. Keeping these roles apart makes every news story easier to read and helps defenders decide where to place their protections.

Quick Answer: What Does DragonForce Do?

DragonForce is a ransomware-as-a-service operation that supplies file-encrypting malware and a leak website to criminal partners. Those partners break into a company, steal data, encrypt servers, and then demand payment for a decryption key and for silence. This approach is called double extortion because the victim faces both a locked network and the threat of public data exposure.

Origins: From Hacktivism to Extortion

Infosecurity Magazine reports that the name surfaced in August 2023 alongside a pro-Palestine hacktivist collective called DragonForce Malaysia, although the group later shifted toward ransomware and firm proof linking the two remains thin. Group-IB published one of the earliest detailed profiles in September 2024, describing a profit-driven service rather than a political movement. By then the ideological message had faded, and the leak site looked like any other financially motivated crime portal. Infosecurity Magazine

How the Cartel Model Works

In early 2025 the operators announced that they were no longer a simple rental service and would now run as a cartel. Under this arrangement, the dragonforce ransomware cartel offers affiliates 80 percent of profits, customisable encryptors and shared infrastructure, which lowers the barrier for newcomers. Partners may also white-label the payload, which means they can attack under their own brand while still using the shared tools. This is similar to a franchise, where the parent company provides the recipes and supply chain and each local shop keeps its own signboard. Acronis

Ransomware-as-a-Service Versus a Cartel

Ransomware-as-a-service is a subscription-style arrangement in which developers lease malware and keep a percentage of each payment. A cartel goes further by letting partners run their own branding, which explains variants such as Devman and Mamona, later renamed Global, that reuse the same builder. For defenders, this means one family name no longer describes one team, so attribution becomes harder and indicators of compromise become more varied. SQ Magazine

Code Lineage: LockBit and Conti

Researchers report that early payloads relied on repurposed LockBit 3.0 builders before the operators moved to modified Conti version 3 code. Acronis also observed that the newest variant repairs encryption weaknesses that had earlier been linked to Akira ransomware. Reusing leaked source code is a common shortcut because it delivers a mature, tested encryptor without years of development work. PauBox

Real-World Cases: What Happened to Real Organisations

Nothing teaches better than real events, so consider the spring 2025 wave against British retail. Marks & Spencer, the Co-op and Harrods were all targeted within a short period, and services were disrupted to different degrees. Google Threat Intelligence Group said in May 2025 that it could not independently confirm which crews were responsible, yet the pattern matched the known habits of Scattered Spider, which attacks prominent brands sector by sector. Later vendor research tied the M&S incident to a partnership between that social-engineering collective and the DragonForce platform. Infosecurity Magazine

Marks & Spencer: A Help Desk Becomes the Front Door

Reporting by BleepingComputer indicated that the intruders used the DragonForce encryptor on M&S's VMware ESXi hosts, which run many virtual machines at once. One analysis suggests that access began as early as February 2025, when someone impersonated an employee to a third-party service desk and triggered a password reset. The lesson is simple: a single convincing phone call can be as dangerous as any software flaw. Infosecurity MagazineDeXpose

Earlier Victims: Lotteries, Governments and Brands

Before the retail headlines, incidents linked to the name included the Ohio Lottery in 2023, where more than 600 GB of user data was reportedly stolen. Other listed targets included Coca-Cola in Singapore, Yakult Australia and the government of Palau. These examples show that the crew never focused on one industry, and that public bodies, food companies and transport operators can all end up on a leak site. SpecopsSoftInfosecurity Magazine

Technical Anatomy of an Attack

Experts usually describe an intrusion as a chain, and breaking any link can stop the whole attack. The dragonforce ransomware group and its affiliates typically move through entry, privilege escalation, defence evasion, data theft and encryption. Each stage leaves traces in system logs, which is why monitoring matters as much as prevention. The following three subsections explain the stages that appear most often in incident reports.

Initial Access Through Social Engineering

Affiliates are described as favouring human-targeted methods such as phishing, phone calls to help desks, fake single sign-on pages and multi-factor authentication push bombing. Scattered Spider has also been associated with SIM swapping, which moves a victim's phone number onto a criminal-controlled card. Because these tricks target people, technology alone cannot stop them, and staff training with strict identity checks becomes essential. Picus Security

Defence Evasion With Vulnerable Drivers

Researchers found that the latest variant abuses vulnerable drivers such as truesight.sys and rentdrv2.sys to disable security programs. This technique is called bring your own vulnerable driver, or BYOVD, because the attacker loads a legitimately signed but flawed driver and then misuses it. Blocking known vulnerable drivers and alerting on unexpected driver installations closes this gap. Bleeping Computer

Encryption, Data Theft and Extortion

Once security tools are down, the encryptor scrambles files, and on virtual infrastructure it can lock many servers within minutes. Before that step, attackers copy sensitive records so they can threaten publication on a leak website. This is why restoring from backup solves only half of the problem, because the stolen data stays in criminal hands.

Early Warning Signs

Ransomware rarely appears without warning, and defenders who notice small signals can often stop the encryption stage. Security teams call these signals indicators of compromise, and they are the digital equivalent of muddy footprints on a clean floor. No single sign proves an attack, but several together should trigger an immediate investigation. Watch for the following patterns in your environment:

• Unexpected password reset or MFA enrolment requests for privileged accounts, especially after a help desk call

• Repeated multi-factor authentication prompts that the user did not start

• New drivers or services on servers, or security agents stopping without approval

• Unusual remote-access tools or large outbound transfers to unfamiliar cloud storage

• Sudden administrator activity on virtualisation hosts outside maintenance windows

• Ransom notes, renamed file extensions, or a leak-site mention of your company name

Defence: A Practical Plan

Good defence is layered, much like a castle with a moat, a wall, guards and a locked inner room. Adding Digital risk protection to that structure helps an organisation discover leaked credentials, spoofed login pages and dark web chatter before attackers exploit them. It sits beside, not instead of, endpoint security, patching and backups. The checklist below turns the layered idea into concrete tasks that a small team can start this week:

• Verify caller identity with call-back procedures before any password or MFA reset

• Use phishing-resistant MFA, such as hardware security keys, for administrators

• Keep offline, immutable backups and test restoration regularly

• Segment networks and isolate virtualisation management interfaces

• Block vulnerable drivers and enable tamper protection on endpoint tools

• Rehearse an incident response plan that covers legal, communications and regulator steps

Hardening the Help Desk

Because the M&S incident reportedly began at a service desk, this team deserves special attention. Give agents a written script, require verification questions that cannot be found on social media, and escalate every request to reset a privileged account. Outsourced service desks must follow the same rules, and contracts should state that clearly.

Backups and Segmentation

Backups only help if attackers cannot reach them, so keep at least one copy offline or immutable. Network segmentation limits how far an intruder can travel once inside, which protects virtual hosts and domain controllers. Testing a full restore every quarter reveals problems while the stakes are still low.

Monitoring the Outside World

Threat intelligence teams watch leak sites, forums and paste sites for company names and stolen credentials. A Digital risk protection service automates that watch and sends alerts when employee logins or brand impersonation appear online. Early warning gives you time to reset passwords and inform customers before criminals can use the material.

Should Victims Pay the Ransom?

This is one of the hardest questions in incident response, and honest experts agree there is no universal answer. Law enforcement agencies generally discourage payment because it funds future crime and does not guarantee that data will be deleted. Paying an affiliate of the dragonforce ransomware group also carries legal risk, since sanctions and reporting rules differ by country. Every board should therefore decide its position, with legal counsel, before a crisis rather than during one.

Reporting and Cooperation

Report incidents to national authorities, such as the FBI's Internet Crime Complaint Center in the United States or the National Cyber Security Centre in the United Kingdom. Sharing indicators helps other organisations, and each report builds a clearer picture of how the dragonforce ransomware cartel and similar alliances operate. Cooperation also protects your reputation, because regulators tend to treat transparent victims more fairly.

Conclusion: Key Lessons

DragonForce ransomware teaches a clear lesson: modern extortion is a business, and business models spread faster than any single piece of malware. The shift from a hacktivist label to a cartel with white-label partners means defenders must watch behaviours and not only names. Simple habits such as identity verification, offline backups, driver controls and outside-in monitoring block the routes described in this guide. Keep learning from trusted sources, review your own controls this month, and treat every unexpected password reset request as suspicious until proven otherwise.

FAQ (Frequently Asked Questions)

What is ransomware in simple words?

Ransomware is malicious software that locks files or systems and demands payment to unlock them. Many modern strains also steal data first, so criminals can threaten to publish it. This double pressure is why backups alone are no longer a complete answer.

Who is behind DragonForce?

DragonForce is a criminal operation that emerged in 2023, and its exact leadership has not been publicly confirmed. Early activity was linked to a hacktivist collective called DragonForce Malaysia, but evidence of a direct connection is limited. Today it functions as a profit-driven service used by many independent affiliates.

Is Scattered Spider the same as DragonForce?

No, they are separate groups that have cooperated. Scattered Spider is known for social engineering and gaining initial access, while DragonForce supplies the encryptor and leak infrastructure. Researchers link their partnership to the 2025 attack on Marks & Spencer.

How can a company prevent this kind of attack?

The most effective steps are strict identity checks at the help desk, phishing-resistant multi-factor authentication and tested offline backups. Blocking vulnerable drivers and segmenting networks limits the damage if an intruder gets in. Continuous monitoring and staff training complete the defence.

Should a business pay the ransom?

Authorities generally advise against paying because payment funds further crime and offers no guarantee of recovery. Legal, insurance and sanctions issues also apply, so decisions should involve counsel and specialists. Preparing a policy before an incident makes the choice calmer and better informed.

What should I do first if files are encrypted?

Disconnect affected devices from the network, but do not power them off unless advised, because memory can hold useful evidence. Alert your incident response team, preserve logs, and contact the relevant national