Podcasts
DragonForce
Active Since
November 2023
Known Forum Aliases
N/A
Active Forum Accounts
N/A
DragonForce emerged in late 2023, and since then has repeatedly proved itself as a force to reckoned with.
Originally a hacktivist operation, DragonForce pivoted to a RaaS model and has since innovated on the concept, with its “ransomware cartel” program in which threat actors can use its malware under their own separate branding. This offer was put to use with destructive effect in the attacks on British retailers Marks & Spencer, Co-op and Harrods in Spring 2025, which were attributed to the Scattered Spider threat group using DragonForce ransomware. DragonForce has even used adversarial tactics against its competitors, seemingly being implicated in the disintegration of at least two other RaaS operations (RansomHub and BlackLock).
Related Content
Videos
How can you identify ransomware operators targeting you on the dark web?
The Dark Web Hub
Vice Society [offline]
Vice Society stopped posting victims to its dark web leak site in June 2023 and went offline in December. Some security analysts note similarities in the TTPs of Vice Society and those used by Rhysida.
The Dark Web Hub
LockBit
LockBit was the most active ransomware group by number of listed victims on its dark web leak site in 2022 and 2023. In February 2024 its leak site was seized in Operation Cronos.
The Dark Web Hub
Cl0p
Cl0p is notable for its approach of using vulnerabilities in supply chain software to target multiple organizations, announcing them in a batch at a later date.
The Dark Web Hub
Akira
Akira appears to be a novel ransomware, written in C++, with versions targeted both at Windows machines and Linux operating systems. It has quickly become one of the most prolific ransomware groups.
The Dark Web Hub
BlackCat [offline]
The RaaS group BlackCat (also known as ALPHV or Noberus) is believed to include developers and money launderers from the former DarkSide ransomware group, most infamous for the Colonial Pipeline attack.
