DragonForceThreat actor
DragonForce is a hacktivist group based in Malaysia that has been involved in cyberattacks targeting government institutions and commercial organizations in India. They have also targeted websites affiliated with Israel and have shown support for pro-Palestinian causes.From MISP Galaxy
Last reported 10 days ago, by ransomware.live38 reports
ATT&CK techniques
6 of 96 · each with the sentence it comes from- T1543.003Windows Service
“T1543.003 Create or Modify System Process: Windows Service”
- T1684Social Engineering
“…s, monitor GenAI integrations for prompt-injection vulnerabilities, and treat AI-generated content in customer communications as a social-engineering surface that requires its own detection layer.”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1685Disable or Modify Tools
“T1562.001 – Impair Defenses: Disable or Modify Tools”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“For instance, Halcyon reported increased instances of the LLM-developed EvilAI masquerading as fake AI-productivity apps while secretly providing ransomware actors initial access.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
38 reports · the newest 20, newest first · the exact sentence from each-
thegentlemen lists North Bridge Venture Partners“May 2026: ransomware group DragonForce claimed to have stolen 22.9GB of internal files (unconfirmed by the firm).”
-
September 2026 Threat Trend Report on Ransomware“…EAM aur0ra Barracuda BlackLocks Bosnia BravoX Brazil Canada Cl0p Dark-Project DarkForums DarkWeb data-extortion Defense Dire-Wolf DLS DragonForce DYSPHOR1A Eclipse Ecuador Education Emperador Energy Ethiopia Everest 독일 말레이시아 미국 미얀마 베네수엘라 베트남 보스니아 브라질 대만 나미비아 딥웹 노르웨이 다크웹 Finance F…”
-
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention“In early October, DragonForce, LockBit, and Qilin formed a ransomware alliance to boost attack effectiveness, marking a major shift in the cyber threat landscape.”
-
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware“The same driver was previously exploited by DragonForce ransomware actors.”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“…least one zero-day—CVE-2025-31161 in CrushFTP—but has been recently going under the radar, compared to more famous groups like Qilin, DragonForce, or Akira.”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“Presencia de células selectivas: Operaciones vinculadas a BlackMatter, Conti, Phobos, Akira, DragonForce y muestras residuales de LockBit o WannaCry se manifestaron mediante incidentes puntuales.”
-
Inside DragonForce: How a Ransomware Cartel’s Payload Actually Runs“Inside DragonForce: How a Ransomware Cartel’s Payload Actually Runs”
-
RMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)“…eck distribution have also been identified; FleetDeck was previously used by the “Scattered Spider” threat actors who distributed the DragonForce ransomware.”
-
28th September – Threat Intelligence Report“Researchers have detailed Storm-2570, a ransomware affiliate operating across Qilin, DragonForce, Anubis, and BERT ecosystems.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“This includes Qilin, DragonForce, Anubis, and BERT.”
-
August 2026 Threat Trend Report on Ransomware“In August 2026, major groups such as The Gentlemen, Qilin, CL0P (Clop), Gunra, CRPx0, DragonForce, Orova, FulcrumSec, Emperador, and Helix continued their activities.”
-
July 2026 Ransomware Trend Report“DragonForce and WorldLeaks each had 44 incidents, IncRansom had 41, Nova had 35, SafePay had 33, and Akira had 30.”
-
Ransom & Dark Web Issues Week 2, August 2026“DarkWeb DataBreach DDW DeepWeb DragonForce 랜섬웨어 데이터탈취 로봇 로봇기계 모터 미국 개인정보탈취 대한민국 교육 딥웹 디지털헬스케어 다크웹 자격증 의료 제조 온라인교육 헬스케어소프트웨어 Qilin Ransom Ransomware ShinyHunters SouthKorea UnitedStates USA”
-
Ransomware Surges in July After Q2 Lull“The next most active group was DragonForce, making up 41 attacks, followed by INC (36), CRPx0 (33) and SafePay (30).”
-
Ransomware Groups Increasingly Deploy EDR Kill Techniques“The leading ransomware groups were Qilin (293 attack claims), The Gentlemen (214 attack claims, DragonForce (143 attack claims), Akira (119 attack claims) and Lockbit 5.0 (102 attack claims).”
-
Six Supply Chain Attack Groups to Watch Out for in 2026“Active since 2023, DragonForce goes straight for the multiplier in the ransomware economy: Managed Service Providers.”
-
10 Cybersecurity Podcasts to Add to Your Queue Now“Each episode focuses on the Top 10 most prolific cyber gangs currently shaping the global threat landscape, including Lazarus, DragonForce, and GoldFactory.”
-
Ransomware debris: an analysis of the RansomHub operation“…that since the RansomHub operation went dark on April 1st, a few days after the advertisement of a Ransomware Cartel on RAMP forum by DragonForce, one of the Qilin’s administrators known as Haise has been very active on the forum.”
-
Inside the Dragon: DragonForce Ransomware Group“Inside the Dragon: DragonForce Ransomware Group”
-
Demystifying Mysterious Team Bangladesh“… report by Network Intelligence, Mysterious Team Bangladesh could use the”./404FOUND.MY” utility, which originally was developed by a DragonForce Malaysia hacktivist group, according to another report by CloudSec:”
Indicators in its reports
named in the reports above- third-party[.]comin 1 report
- fbijobs[.]govin 1 report
- 104.194.9[.]227in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.