DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel
DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer affiliates an 80% revenue share and comprehensive management tools. By March 2025, they evolved into a 'cartel' structure, providing white-label services. Their attacks primarily target organizations in the US and UK, spanning multiple sectors including manufacturing, professional services, retail, healthcare, and technology. The group actively recruits developers and reverse engineers while offering specialized data analysis services to help affiliates maximize extortion pressure. Notable incidents include a major MSP breach in May 2025 exploiting SimpleHelp vulnerabilities, cascading compromise across multiple client networks.
Pulse ID: 6ad0dc1e98341fe609c19f3e
Pulse Link: https://otx.alienvault.com/pulse/6ad0dc1e98341fe609c19f3e
Pulse Author: AlienVault
Created: 2026-10-15 13:58:54
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberCrime #developers #Healthcare #LockBit #OTX #AlienVault