DragonForce

DragonForce is a ransomware threat actor active in 2026 that publicly claims intrusions across a broad range of sectors and geographies, including manufacturing, financial services, telecommunications, technology, legal services, engineering, hospitality, and other business services. Reported victimology indicates opportunistic targeting rather than a narrowly focused vertical or regional specialization, with organizations observed in North America, Europe, Africa, the Middle East, Asia, and Latin America. DragonForce is associated with double-extortion style ransomware operations in which data theft and encryption are both used to pressure victims. Publicly claimed incidents indicate the group routinely presents compromises as both ransomware attacks and data breaches. In at least one documented intrusion culminating in DragonForce deployment, the ransomware stage followed an earlier access operation that began with exploitation of Citrix NetScaler infrastructure via CVE-2025-5777, consistent with a broader ecosystem in which initial access brokers obtain footholds and later hand them to ransomware operators or affiliates. Observed post-compromise tradecraft linked to an intrusion ending in DragonForce ransomware included credential access and lateral movement using Mimikatz, PsExec, and Impacket-based tooling, along with persistence through legitimate remote-management software. This suggests DragonForce operations can rely on common hands-on-keyboard enterprise intrusion methods rather than novel malware alone. Reporting also places DragonForce among active ransomware brands appearing in weekly leak-site claim tracking during mid-2026. Available information supports classifying DragonForce as an eCrime ransomware actor. No high-confidence public evidence in the provided material establishes it as a nation-state threat actor. Known alias usage in the available data is limited to the capitalization variant dragonforce/DragonForce.