The Rise of DragonForce: Inside the New Ransomware Cartel Shaping Cybercrime

This term may be new to many, but DragonForce actually began as a traditional ransomware-as-a-service group around August 2023. They began using others’ leaked ransomware lockers and then developed their own scheme. Around February 2024, they began posting their announcements on various underground forums and began increasing the number of victims on their leak site.
 
And then, by March 2025, they decided to rebrand themselves slightly and launch this cartel model, which is essentially a kind of change to their distribution model that allows affiliates to create their own brand, but also leverage DragonForce’s capabilities.

Know in brief what is meant by ransomware?

Ransomware is a business model as a service, a type of criminal business model used by many cybercriminal groups today. They provide encryption binaries to encrypt systems in victim networks.
 
They often provide a variety of services around this, perhaps services for communicating with victims. They provide leak blogs where stolen data will be published when it’s leaked, and they provide all sorts of core services, and they work with partners who actually infiltrate, steal the data, and then work with the ransomware provider to publish that data and extort money from the victim.

What is different about the cartel approach that Dragon Force is advocating?

Ransomware is a business model as a service, a type of criminal business model used by many cybercriminal groups today. They provide encryption binaries to encrypt systems in victim networks.
 
They often provide a variety of services around this, perhaps services for communicating with victims. They provide leak blogs where stolen data will be published when it’s leaked, and they provide all sorts of core services, and they work with partners who actually infiltrate, steal the data, and then work with the ransomware provider to publish that data and extort money from the victim.

What is different about the cartel approach that Dragon Force is advocating?

LockBit, a longtime ransomware group that focused heavily on its brand, did offer encryption tools and other services, but it got to the point where they literally said, “Look, you can get any victims you want. Just bring us your data, and we can publicize it through our blog, and people will know who we are. They’ll know our reputation.” They use the power of that brand and reputation to intimidate people.
 
Dragon Force completely changed this model. I mean, perhaps because of some major law enforcement operations against groups like LockBit, where they acted as the central hub, and that left them vulnerable to disruption.
 
So Dragon Force now gives affiliates the option to use all of Dragon Force’s capabilities and services, but also to create their own brand and operate under their own brand. And affiliates have access to a complete management system that provides a comprehensive backend, including a leak site or leak blog. They can run on Windows, Linux, and ESXi, and will provide encryption tools for BSD and other common network targets.
 
They offer features like secure file storage services, a tour-based leak site based on The Onion Router. This is a kind of dark web. It allows people to access and interact with these websites anonymously, which is very popular with cybercriminals. Negotiation tools and many other capabilities that ransomware affiliates value. So they can get all these capabilities, but do so under their own brand, and we may see some groups stepping up and taking advantage of this offering.

Scattered Spider’s recent cyberattacks on UK retailers follow Dragon Force’s Cartel model

The recent cyberattacks on UK retailers by Scattered Spiders follow the Dragon Force cartel model. Scattered Spiders is the group responsible for the attack on MGM and several other casinos more than a year ago.
 
So, this is absolutely very serious. So, Dragon Force has created a brand for itself, which they’ve presented to the public, and they operate under that brand, using it to ensure everyone knows their reputation. On the other hand, Scattered Spider is a name created by a cybersecurity vendor and is a code name they use. We have our own naming scheme for threat groups, but we use it to refer to specific groups of cybercrime actors.
 
What’s likely the case, or you know, what we suspect is that some aspects of these intrusions leverage social engineering against help desk staff or IT staff and ask them to help reset passwords or bypass multifactor authentication or bypass common authentication procedures, and that’s a hallmark of attacks by scatter spiders or other similar groups and individuals who operate within that broader group.

What advice can organizations give to help them determine if this group has infiltrated their organization?

The real key isn’t who the group is. Rather, it’s what organizations can do to detect such activity early. Just think, how would we detect a social engineering attack? How would our employees react in such situations? Do we have reporting methods where people can flag malicious activity? So, we’ve been advising customers and others about scatter spider-style tradecraft for a long time.
 
We’re talking about ensuring that you empower your health desk staff and customer service employees, who handle the phones and perhaps focus on IT processes, to say “no.” If someone on the phone tells you they’re a senior executive or other high-ranking individual, don’t give in to pressure and don’t let them use their authority to pressure you into bypassing standard procedures. Therefore, it’s important to ensure that health help desk staff are empowered and have a reporting system in place.
 
Using multifactor authentication is a very important recommendation, but these people are adept at bypassing multifactor authentication. So, while it’s important, it’s not a guarantee of prevention. Furthermore, even if they do manage to do so, you should be well-positioned to detect unauthorized access, suspicious access, and ensure monitoring systems are in place to detect logins from unusual locations, for example, non-standard, non-corporate VPNs.
 
Although legitimate remote management tools are used, these groups don’t necessarily rely heavily on malware. They’ll use legitimate tools that don’t trigger security alerts but are unusual for that environment, and after interacting with someone to obtain the password, they’ll use them to gain and maintain access. Great.

So, as a final thought, how would you best advise organizations to protect themselves? First of all, security is absolutely possible. While these people are experts at their job, it’s nowhere near the robust cybersecurity we often talk about.
 
These days, especially when it comes to patching multi-factor authentication on perimeter systems, we talk about phishing-resistant multi-factor authentication. Phishing is another widely used method, but some involved in spider-style attacks have also used it. User awareness training is a key tactic.
 
So, if you work in retail, hopefully this becomes a kind of training manual or part of the training process for future front desk staff and IT staff. Anyone who answers the phone to an external caller should know that the person may not be who they claim to be or performing the functions they claim to be.
 
So, ongoing user awareness training and vigilance are a big part of this. And then, of course, the comprehensive deployment of technical controls, EDR, NDR, and XDR solutions, as well as the collection and integration of authentication and access logs, puts an organization in a strong position to detect things like account takeovers or unauthorized access before they become too serious.