Threat Group Profile
dragonforce
● Active — last 30 days
Victim claims
149
First seen
Mar 2026
Last activity
10 Jul 2026
Tracked since
—
Group overview
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Preferred targets
Business Services · 36
Manufacturing · 18
Technology · 12
Healthcare · 12
Construction · 11
Hospitality and Tourism · 10
Most targeted countries
US · 60
GB · 13
DE · 10
CA · 8
IN · 4
HK · 3
Tactics & techniques (MITRE ATT&CK)
Execution
User Execution
Defense Evasion
Indicator Removal: File Deletion
Impair Defenses: Disable or Modify Tools
Discovery
File and Directory Discovery
Impact
Data Encrypted for Impact
