DragonForce affiliates intensify UK ransomware campaign using edge-device exploits
DragonForce affiliates sustained a broad ransomware and extortion campaign against UK organizations in May 2026, publicly naming seven UK victims on the group’s Tor leak site and posting 22 victims globally in a single day, including four UK firms. Reported victims spanned professional services, finance, logistics, construction, technology, and luxury retail, underscoring the group’s opportunistic targeting rather than a focus on one vertical. Helix International drew particular concern because of its role as a managed service provider with medium, large, and Fortune 500 clients, raising the risk of downstream compromise across customer environments.
Public reporting and curated intrusion data tie DragonForce activity to exploitation of exposed remote access and internet-facing systems, including Ivanti Connect Secure, FortiOS, FortiProxy, SonicOS SSL-VPN, Apache Log4j, Microsoft SmartScreen, and SimpleHelp RMM vulnerabilities. Tooling observed in DragonForce-linked intrusions includes utilities for discovery, remote management, credential theft, defense evasion, LOLBAS abuse, and exfiltration, while affiliates have also been linked to BYOVD techniques to disable or bypass EDR and antivirus protections. Prior reporting further connected DragonForce affiliates attributed to Scattered Spider to attacks on major UK retailers including M&S, Co-op, and Harrods.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
DragonForce posts 22 victims globally in one day
On 2026-05-27, DragonForce posted 22 victims globally on its leak site, including four UK firms. The reporting highlighted this as evidence of accelerating campaign activity.
Community report documents DragonForce intrusion at small UK victim
A community incident report describes a DragonForce ransomware intrusion against a small UK organization in April 2025. The attackers reportedly used SimpleHelp and AnyDesk, deployed Cobalt Strike, abused PowerShell, stole Veeam credentials, used the KslD.sys BYOVD driver to disable Microsoft Defender protections, and exfiltrated data with Restic before ransomware execution.
Scattered Spider-linked affiliates use DragonForce in UK retail attacks
Prior reporting cited in the references says affiliates attributed to Scattered Spider used DragonForce in attacks on major UK retailers including M&S, Co-op, and Harrods. The activity is anchored to June 2025 in the source content.
DragonForce claims seven UK victims during May 2026
Throughout May 2026, DragonForce affiliates publicly claimed seven UK-based victims on their Tor leak site. The affected UK organizations spanned sectors including professional services, finance, logistics, construction, technology, and luxury retail.
DragonForce becomes active as a ransomware-as-a-service operation
Reporting describes DragonForce as an opportunistic ransomware-as-a-service threat actor that has been active since late 2023. Affiliates commonly exploit exposed remote access infrastructure and compromised credentials.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
6 references tracked. Mallory keeps watching after this page renders.
UK Cybercrime Journal: Sustained DragonForce Campaign - Malware News - Malware Analysis, News and Indicators
malware.news
Open sourceRansomware.live: dragonforce
ransomware.live
Open sourceRansomware-Tool-Matrix/CommunityReports/CR-021-DRAGONFORCE-APR-2025.md at main · BushidoUK/Ransomware-Tool-Matrix · GitHub
github.com
Open sourceRansomware-Tool-Matrix/GroupProfiles/DragonForce.md at main · BushidoUK/Ransomware-Tool-Matrix · GitHub
github.com
Open sourceRansomware-Vulnerability-Matrix/GroupProfiles/DragonForce.md at main · BushidoUK/Ransomware-Vulnerability-Matrix · GitHub
github.com
Open sourceUK Cybercrime Journal: Sustained DragonForce Campaign
blog.bushidotoken.net
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DragonForce Ransomware Operations and High-Profile Breaches
DragonForce, a ransomware group that has evolved into a self-described "ransomware cartel," has intensified its global operations, targeting organizations with advanced tactics and forming alliances with other cybercriminal collectives. Security researchers have detailed how DragonForce leverages vulnerable drivers such as `truesight.sys` and `rentdrv2.sys` to disable security software and has improved its encryption methods to address previously exploited vulnerabilities. The group, which began by using the LockBit 3.0 builder and later adopted a modified Conti v3 source code, now operates a ransomware-as-a-service (RaaS) model, offering affiliates a significant share of profits and customizable tools to attract new participants. Notably, DragonForce has collaborated with groups like Scattered Spider and has been linked to the compromise of major organizations, including a high-profile breach of Marks & Spencer. Recently, DragonForce claimed responsibility for a significant breach at Mobilelink USA, a major dealer for Cricket Wireless, exfiltrating 5.04 TB of data and threatening to leak sensitive information, including personally identifiable and financial data of millions of customers across 21 states. The group has also reportedly allied with other ransomware gangs such as Qilin and LockBit, and has taken over operations or leak sites from other ransomware groups like RansomHub, BlackLock, and Mamona. In 2025 alone, DragonForce has impacted at least 185 organizations, with most attacks occurring in the last six months, underscoring the growing threat posed by this increasingly organized and aggressive ransomware operation.
Mar 21, 2026
DragonForce Ransomware Expands RaaS Operations With Dual-Extortion and a “Cartel” Affiliate Model
**DragonForce**, a ransomware-as-a-service (RaaS) operation that emerged in 2023, has been linked to a growing set of intrusions targeting “critical business” environments across multiple industries, with a focus on **manufacturing, business services, technology, and construction**. Reporting attributes the group with **dual-extortion** tactics—stealing data prior to encryption and then threatening publication on a **data leak site (DLS)** to increase pressure on victims. Researchers also describe DragonForce as operationally adaptable, including changes in how it hosts and organizes leaked victim data. LevelBlue analysis cited in reporting indicates DragonForce has evolved its business approach beyond a typical affiliate program into a **“cartel” model**, allowing member groups to operate under their own brands while leveraging shared DragonForce infrastructure and services. Described offerings to affiliates include large-scale storage, continuous server monitoring, support services around file analysis/decryption, and assistance with test attacks; LevelBlue also highlighted an “**Company Data Audit**” service intended to help affiliates value stolen data and shape negotiation pressure (including prepared communications such as scripts and executive-facing letters). The group’s tooling is described as **multi-platform**, with the ability to target **Windows, Linux, ESXi, BSD, and NAS** systems and to use different encryption modes (e.g., full, header, partial), increasing potential impact across enterprise and virtualized environments.
Mar 21, 2026
Ransomware Ecosystem Fragmentation and the Emergence of DragonForce
Threat intelligence reporting describes **DragonForce** as a rapidly evolving ransomware operation that brands itself as a “cartel” and runs an affiliate service called *Ransombay*, offering customizable payload options and reportedly advertising an **80% revenue split** to attract pentesters and initial access brokers. Researchers assess DragonForce’s tooling as heavily derived from **LockBit 3.0** and **Conti**, and report signs of consolidation behavior, including infrastructure/code overlap with groups such as **BlackLock**, **RansomHub**, and **LockBit**; one cited incident involved DragonForce abusing a rival’s misconfiguration and a **Local File Inclusion (LFI)** weakness to obtain information including credentials, followed by defacement of the rival’s leak site. Separate industry reporting indicates ransomware victimization continued to rise sharply in 2025, with GuidePoint Security tracking a **58% year-over-year increase** and **7,515 claimed victims** across leak sites, alongside a more **fragmented** landscape (124 named groups, up 46% from 2024). The same reporting highlights concentration of victimization in the **United States (55%)** and heavy targeting of **manufacturing**, with healthcare also significantly impacted (500+ victims) and **Qilin** described as the most prolific RaaS group in 2025 with disproportionate healthcare targeting—context that aligns with the broader trend of many smaller, high-volume groups rather than a few dominant actors.
Mar 21, 2026