DragonForce Ransomware
Emerging ransomware operation with Malaysian hacktivist origins that transitioned to financially-motivated attacks. Active since 2023. Analysis based on 14 negotiation transcripts.
Emerging ransomware operation with Malaysian hacktivist origins that transitioned to financially-motivated attacks. Active since 2023. Analysis based on 14 negotiation transcripts.
DragonForce has a distinctive origin story compared to most ransomware groups. The name was originally associated with a Malaysian hacktivist collective that conducted website defacements and DDoS attacks, primarily motivated by political and nationalist grievances rather than financial gain. The transition to financially-motivated ransomware operations represents a significant evolution — a pattern increasingly seen as hacktivist groups recognise the financial returns available from ransomware while maintaining ideological cover.
The financially-motivated DragonForce ransomware operation emerged in late 2023 and has been building its victim base and capabilities since. Our dataset of 14 negotiation transcripts, while smaller than our archives for established groups, provides meaningful insight into an operation still developing its playbook. The group operates a double extortion model with a Tor-based leak site and negotiation portal, following the template established by more mature operations.
DragonForce is notable for its growing sophistication and the speed at which it has developed its infrastructure. The group launched a ransomware-as-a-service portal in 2024, recruiting affiliates with a competitive commission structure that allows affiliates to retain up to 80% of ransom payments. This transition to a RaaS model suggests the core team is focused on scaling operations, which typically results in increased attack volume and geographic spread.
DragonForce's initial access methods reflect a relatively standard modern ransomware playbook, with some variation across the 14 transcripts in our archive:
Post-compromise behaviour observed in DragonForce incidents includes network reconnaissance, lateral movement using standard tools, Active Directory targeting, and data staging prior to encryption deployment.
DragonForce has deployed multiple encryptor variants, and technical analysis of their ransomware reveals both custom development and reuse of leaked source code from other groups:
As DragonForce continues to develop its capabilities, organisations should expect increasing technical sophistication over time.
Our 14 transcripts provide a developing picture of DragonForce's negotiation approach. As a newer operation, the group's patterns are less fixed than those of more established actors, and there is more variation across negotiations than we see in groups with hundreds of engagements behind them.
Initial demands in our dataset have ranged from $100,000 to several million dollars, generally calibrated to the apparent size of the victim organisation. The group demonstrates awareness of victim financial capacity and adjusts demands accordingly.
Observed characteristics across negotiations:
The shift to a RaaS model in 2024 is expected to introduce more variation in negotiation behaviour as affiliate quality varies.
DragonForce's victim profile to date includes organisations across multiple sectors, with a concentration in retail, manufacturing, and public sector targets. The group has claimed victims across multiple continents, though their activity is more dispersed than regionally-focused operations. Notable claimed victims have included organisations in the UK, Australia, and the United States.
The group has demonstrated willingness to target critical services, including food and grocery retail (Marks & Spencer and Co-op were attributed to DragonForce affiliates in the UK in early 2025), suggesting fewer self-imposed restrictions on target selection than some peer groups.
14 DragonForce ransomware negotiation transcripts are available in our public archive. As an active and developing group, this dataset will continue to grow.
| Status | ACTIVE |
| First Observed | Late 2023 |
| Transcripts | 14 |
| Demand Range | $100K – several million |
| Model | Double Extortion (RaaS from 2024) |
| Origins | Malaysian hacktivist collective |
| Entry Vectors | VPN exploits, phishing, IABs |
| Affiliate Commission | Up to 80% |
| Tone | Structured, developing |
| Negotiability | Moderate |
| Response Time | Variable |
| Timeline Pressure | Moderate (leak site threats) |
| Maturity | Growing — patterns still evolving |
If DragonForce has targeted your organisation, contact Binary Response immediately. Our team is tracking this group's evolving tactics and can advise on containment, negotiation, and recovery.
Get Emergency Help