Analyst1 Details DragonForce’s Shift to a Scalable Ransomware Cartel
Summary
Analyst1 profiles DragonForce’s evolution from RaaS into a cartel-style platform combining affiliates, access brokers and shared services, with cross-platform ransomware, double extortion and an 80/20 payment model. It describes links with Qilin, LockBit and Scatteredsp
Key points
- The profile describes DragonForce as a RaaS operation observed since August 2023, combining centralized services with decentralized affiliates and independent branding.
- Its Suppliers panel supports access-broker listings, including access type, pricing, company details and proof of access; the article says providers may be paid a fixed fee or a share of ransom proceeds.
- The advertised ransomware supports Windows, ESXi, Linux, BSD and NAS environments, with configurable encryption and double-extortion capabilities.
- The article traces changing affiliate requirements: a roughly $10,000 deposit or guarantor in June 2025 was followed by removal of vetting barriers and a $500 registration fee in October 2025.
- DragonForce announced a coalition with Qilin and LockBit in September 2025. The article also links Scattered Spider-attributed intrusions to subsequent DragonForce ransomware deployment, while describing the relationship as an assessment.
- The profile describes an advertised 80/20 ransom split between affiliates and operators, with separate fees or revenue shares for access providers and other services.
- Victim entries and group statements document claims and advertised operations; the article does not establish that every listed victim was compromised.
Article Details
- Attack Vectors
- DragonForce's workflow describes initial access through exploitation of exposed services, compromised credentials, or access acquired through its Suppliers initial-access-broker marketplace.
- The Suppliers marketplace supports listings for VPN, Citrix, RDP, and botnet access, with access providers submitting proof such as credentials or screenshots.
- Intrusions attributed to Scattered Spider involved social engineering, helpdesk impersonation, vishing, and credential compromise; DragonForce ransomware deployment reportedly followed in incidents affecting Marks & Spencer, Co-op, and Harrods.
- DragonForce describes credential abuse, possibly involving NTLM- and Kerberos-based mechanisms, for privilege escalation and lateral movement in Active Directory environments.
- Affiliates can deploy configurable ransomware across Windows, ESXi, Linux, BSD, and NAS environments, including localized or network-wide encryption.
- The described extortion workflow exfiltrates data before encryption and threatens publication on DragonForce's leak site; external storage mechanisms are offered for data uploads.
- The article says DragonForce affiliates may terminate security processes and delete backups and shadow copies before or during ransomware operations.
MITRE ATT&CK
T1078 · Valid AccountsCredential compromise is reported in Scattered Spider-attributed intrusions, and DragonForce's workflow describes subsequent credential abuse.T1486 · Data Encrypted for ImpactDragonForce affiliates deploy ransomware for localized or network-wide encryption.T1490 · Inhibit System RecoveryDragonForce's described defense-evasion behavior includes deleting backups and shadow copies.T1562.001 · Disable or Modify ToolsDragonForce's described defense-evasion behavior includes terminating security processes.T1566.004 · Spearphishing VoiceIntrusions attributed to Scattered Spider are described as using vishing for initial access.T1567.002 · Exfiltration to Cloud StorageThe article describes exfiltrated data being uploaded or transferred using external storage mechanisms, including MEGA, PIXELDRAIN, and STORJ.T1656 · ImpersonationThe article describes helpdesk impersonation in intrusions attributed to Scattered Spider.
Threat Actors
DragonForceThe article describes DragonForce as a ransomware-as-a-service operation observed since August 2023, running double-extortion campaigns and providing affiliates with ransomware and extortion infrastructure.LockBitLockBit was named in DragonForce's publicly announced September 2025 coalition; the article describes cross-group cooperation but does not establish LockBit's involvement in a specific attack.QilinQilin was named in DragonForce's publicly announced September 2025 coalition; the article describes cross-group cooperation but does not establish Qilin's involvement in a specific attack.Scattered SpiderIntrusions targeting Marks & Spencer, Co-op, and Harrods are attributed to Scattered Spider; the article says DragonForce ransomware deployment followed and assesses that Scattered Spider was likely operating under DragonForce's cartel model.
Malware
Products
BSDDragonForce targets Windows, ESXi, Linux, BSD, and NAS environments with configurable ransomware tools.ESXiDragonForce targets Windows, ESXi, Linux, BSD, and NAS environments with configurable ransomware tools.LinuxDragonForce targets Windows, ESXi, Linux, BSD, and NAS environments with configurable ransomware tools.Microsoft WindowsDragonForce targets Windows, ESXi, Linux, BSD, and NAS environments with configurable ransomware tools.
Countries
ArgentinaFull Country List (Suppliers Panel) includes Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, China, Colombia, Czech Republic, Denmark, Egypt, Finland, France, Germany, Greece, Hong Kong, Hungary, India,AustraliaFull Country List (Suppliers Panel) includes Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, China, Colombia, Czech Republic, Denmark, Egypt, Finland, France, Germany, Greece, Hong Kong, Hungary, India,CanadaFull Country List (Suppliers Panel) includes Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, China, Colombia, Czech Republic, Denmark, Egypt, Finland, France, Germany, Greece, Hong Kong, Hungary, India,FranceAustria, Belgium, Brazil, Canada, Chile, China, Colombia, Czech Republic, Denmark, Egypt, Finland, France, Germany, Greece, Hong Kong, Hungary, India, Indonesia, Ireland, Israel, Italy, Japan, Luxembourg,GermanyBelgium, Brazil, Canada, Chile, China, Colombia, Czech Republic, Denmark, Egypt, Finland, France, Germany, Greece, Hong Kong, Hungary, India, Indonesia, Ireland, Israel, Italy, Japan, Luxembourg, Malaysia,ItalyDenmark, Egypt, Finland, France, Germany, Greece, Hong Kong, Hungary, India, Indonesia, Ireland, Israel, Italy, Japan, Luxembourg, Malaysia, Mexico, Netherlands, New Zealand, Nigeria, Norway, Philippines, Poland,RussiaWhile DragonForce publicly states that it does not target Russia or CIS/former Soviet countries, both Russia and Ukraine are available as selectable target countries within the Suppliers panel.SwitzerlandPoland, Portugal, Romania, Russia, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Turkey, UAE, Ukraine, United Kingdom, United States.TurkeyRussia, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Turkey, UAE, Ukraine, United Kingdom, United States.United KingdomSouth Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Turkey, UAE, Ukraine, United Kingdom, United States.United StatesSouth Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, Turkey, UAE, Ukraine, United Kingdom, United States.
Industries
Architecture & Planningof victims observed in Construction, followed by IT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, Real Estate, Machinery Manufacturing, Legal Services, Software Development, andConstructionDragonForce targets a broad range of industries, with the highest concentration of victims observed in Construction, followed by IT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, RealIT Services and IT Consultingof industries, with the highest concentration of victims observed in Construction, followed by IT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, Real Estate, Machinery Manufacturing,Law Practicein Construction, followed by IT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, Real Estate, Machinery Manufacturing, Legal Services, Software Development, and Transportation,Machinery ManufacturingIT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, Real Estate, Machinery Manufacturing, Legal Services, Software Development, and Transportation, Logistics, Supply Chain & Storage.Manufacturinghighest concentration of victims observed in Construction, followed by IT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, Real Estate, Machinery Manufacturing, Legal Services, Softwarereal estatefollowed by IT Services & IT Consulting, Manufacturing, Architecture & Planning, Law Practice, Real Estate, Machinery Manufacturing, Legal Services, Software Development, and Transportation, Logistics, SupplySoftware developmentArchitecture & Planning, Law Practice, Real Estate, Machinery Manufacturing, Legal Services, Software Development, and Transportation, Logistics, Supply Chain & Storage.Transportation, Logistics, Supply Chain & StorageReal Estate, Machinery Manufacturing, Legal Services, Software Development, and Transportation, Logistics, Supply Chain & Storage.