DragonForce

DragonForce is a financially motivated ransomware and extortion operation active since late 2023 that has developed into one of the more prolific ransomware-as-a-service brands observed in 2026. It is commonly tracked as DragonForce, Dragon Force, and DragonForce Ransomware Cartel. Reporting has suggested possible ties to Malaysia, but this remains less certain than its established role as a criminal ransomware enterprise. DragonForce conducts double-extortion operations, combining data theft with encryption and threats to publish stolen information. Its victimology is broad and opportunistic, with observed targeting across healthcare, manufacturing, financial services, professional services, telecommunications, and other sectors. Public reporting in 2026 consistently places the group among the most active ransomware operations globally, with especially strong visibility in North America, Europe, and the UK and Ireland, while also appearing in EMEA healthcare targeting datasets. The operation appears to function through an affiliate model rather than as a single intrusion crew. Multiple analyses place DragonForce among the leading RaaS ecosystems by victim volume in 2026, and code-lineage reporting indicates that other actors and lockers have reused or inherited DragonForce ransomware components. DevMan, for example, was assessed to have malware lineage closely tied to DragonForce after earlier affiliate activity involving DragonForce and other major ransomware brands. DragonForce’s tradecraft is consistent with modern human-operated ransomware. It is associated with data exfiltration, enterprise-wide encryption, and coercive negotiation practices. Reporting also indicates use of large language models to improve extortion communications and negotiation messaging, suggesting operational adoption of AI as a force multiplier rather than a fundamentally new attack method. Separate reporting links DragonForce affiliates to use of externally sourced defense-evasion tooling, including EDR-killing utilities seen in broader ransomware ecosystems. Beyond conventional ransomware activity, DragonForce has also been linked to aggressive competition within the cybercriminal underground. It announced a project known as DragonBay and has been accused by rival actors of attacking competitor infrastructure. It has additionally been observed engaging in disruptive activity such as DDoS attacks and defacements against competing ransomware groups, indicating a willingness to use coercive tactics not only against victims but also against rival criminal operations. Overall, DragonForce is best characterized as a high-tempo, financially motivated ransomware cartel operating a mature extortion model with affiliates, broad sector targeting, double extortion, and occasional adversarial activity against competing groups. It remains a significant criminal threat in the global ransomware landscape.