Ransomware.live: Dragonforce

| Active | RaaS

DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.

Victims

667

First Victim

2022-10-20

(est. attack date)

Discovery Date

2023-12-13

Last Seen

2026-10-30

Inactive Since

days

Avg Delay

18.3

days

Infostealer

29.0%

victims with domain

Countries

hit

Uptime

61.9% avg (30d)

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months (based on attack estimated date if available)

Known Locations (20)

Title	Available	Last Visit	Server Info	FQDN
DragonForce \| Migration completed	Yes	2026-11-02T05:58:47	nginx	`z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion`
DragonForce \| Migration completed	Yes	2026-11-02T06:00:11	nginx	`3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion`
DragonForce \| Leaks	No	2026-09-28T22:02:00		`dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion`
	No	2026-11-02T05:58:49		`dragongoztkdfmnd7jkchznd3fvkpdmeh4vhbt6p3usrlsoy5dw2bhyd.onion`
DragonForce \| Blog	Yes	2026-11-02T05:59:34	nginx — Nuxt	`xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion`
	No	2026-11-02T06:00:13		`guestuctexqqaoxuahuydfa6ovxuhtng66pgyr5gqcrsi7qgchpkad.onion`
DragonForce \| Leaks	No	2026-11-02T06:00:49	nginx	`2q2spejlgz2x5haqe3ygclxj6jwlylgj5rg4jgwax6ub2fbpct27ibyd.onion`
	No	2026-11-02T06:00:59		`zsglo7t7osxyk3vcl7zxzup7hs4ir52sntteymmw63zvoxzcqytlw7qd.onion`
	No	2026-11-02T06:01:25		`6dgi54prfmpuuolutr4hl3akasxbx4o34g5y2bj4blrvzzkjemhxenad.onion`
	No	2026-11-02T06:01:48		`eogeko3sdn66gb7vjpwpmlmmmzfx7umtwaugpf5l6tb5jveolfydnuad.onion`
	No	2026-11-02T06:02:16		`ewrxgpvv7wsrqq7itfwg5jr7lkc6zzknndmru5su2ugrowxo3wwy5yad.onion`
	No	2026-11-02T06:02:33		`3ro23rujyigqrlrwk3e4keh3a3i6ntgrm3f42tbiqtf7vke47c6a6ayd.onion`
	No	2026-11-02T06:02:50		`jziu7k7uee467r2wt66ndrwymmw7tsmqgcqi7aemcaxraqmaf2hdm3yd.onion`
	No	2026-11-01T02:01:01		`2yczff6zyiey3gkgl5anwejktdp73abxbzbnvwobmrwkwgf3hudpyvyd.onion`
	No	2026-11-01T02:01:15		`bpoowhokr3vi32l3t4mjdtdxfrfpigwachopk5ojwmgxihnojhsawuyd.onion`
	No	2026-10-28T12:35:05		`dbvczza7nhwdb5kdvkzjtkrcvwnrt5viw7mihutueprvajy7rxhwq6id.onion`
	No	2026-10-28T12:35:05		`xtcwd3xmxpggtizn7kmwwqeizexflkkyqsytg2kauccau6ddsfa4gfyd.onion`
	No	2026-10-28T12:35:05		`4wcrfql53ljekid3sn66z6swjot725muveddq77utxltaelw64eikfid.onion`
	No	2026-10-28T12:35:05		`73h3lxn24kuayyfkn4t6ij7e67jklo24vqzqdhpts3ygmim7hu6u6aid.onion`
	No	2026-10-28T12:35:05		`nwtetzmrqhxieetg5lvth7szzvg35gfrqt23ly46vku56oo7pkueswyd.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced IP Scanner PingCastle SoftPerfect NetScan	placeholder placeholder placeholder	placeholder placeholder placeholder	Mimikatz placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder

Vulnerabilities Exploited (12)

This information is provided by Ransomware-Vulnerability-Matrix & Ransomware.live
Vendor	Product	CVE	Source
Apache	Log4j	CVE-2021-44228	trendmicro.com
SimpleHelp	SimpleHelp RMM	CVE-2024-57726	sophos.com
Fortinet	FortiOS & FortiProxy	CVE-2024-21762	ccb.belgium.be
Fortinet	FortiOS & FortiProxy	CVE-2024-55591	ccb.belgium.be
SonicWall	SonicOS SSL-VPN	CVE-2024-40766	ccb.belgium.be
Citrix	NetScaler ADC & Gateway	CVE-2025-5777	huntress.com
Ivanti	ICS	CVE-2024-21887	trendmicro.com
Pulse Secure / Ivanti	Ivanti Connect Secure	CVE-2024-21893	trendmicro.com
Pulse Secure / Ivanti	Ivanti Connect Secure	CVE-2023-46805	trendmicro.com
Windows	SmartScreen	CVE-2024-21412	trendmicro.com
SimpleHelp	SimpleHelp RMM	CVE-2024-57727	sophos.com
SimpleHelp	SimpleHelp RMM	CVE-2024-57728	sophos.com

TTPs Matrix (4)

This information is provided by Crocodyli & Ransomware.live
Execution	Defense Evasion	Discovery	Impact
User Execution	Indicator Removal: File Deletion	File and Directory Discovery	Data Encrypted for Impact
	Impair Defenses: Disable or Modify Tools

KQL Query (1)

Negotiation Chats (34)

YARA Rules (2)

Indicators of Compromise (IoCs) (59)

Hash MD5 55 IP Address 1 PGP 1 Tox 1 URL 1

Type	IOC
`Hash MD5`	`0014e18b7e72bbabd17a8e39c9448563`
`Hash MD5`	`027edad8db0e1abe6e88d073a9eb296a`
`Hash MD5`	`05f1a39c0902297debceb4c9c4c6674c`
`Hash MD5`	`12e22f588f6128cf1a042d1122556cd2`
`Hash MD5`	`1300bacdbc80ac7237d36a91463756a5`
`Hash MD5`	`1406e538fc441e89ce3d1747017f97a5`
`Hash MD5`	`15634dc79981e7fba25fb8530cedb981`
`Hash MD5`	`19d69e198f1b8888d07eb612f1c27fa8`
`Hash MD5`	`1a13d520ee079d60c0c12062df8603a5`
`Hash MD5`	`2169e0dc6fbd8f8ca7b99a4e2125333b`
`Hash MD5`	`2171911cad8f83f35b3699eaaf30331a`
`Hash MD5`	`296cca79bbb3ca764de8fcdc2070ecc2`
`Hash MD5`	`2dd7cd2bf15eec7d62689435fca9c49c`
`Hash MD5`	`333d79fc5f5d53d7f4fa285d588982ff`
`Hash MD5`	`3357b96f7baef169e28ed5a24ea79f59`
`Hash MD5`	`352ae8c2dff6e401fb14f86d702a06fa`
`Hash MD5`	`3a514e164db30acdb3063eb79a23aa4f`
`Hash MD5`	`3a6e2c775c9c1060c54a9a94e80d923a`
`Hash MD5`	`3c311cabe7de6a8c104f8f10541d392d`
`Hash MD5`	`3d5a81e73bdb12a1844f0a4d66dbd008`
`Hash MD5`	`40126b1b3c6f86194fc554cdba3cb5d3`
`Hash MD5`	`47808d596dab6ef8a05e529e1bf721ab`
`Hash MD5`	`49874b7a63b6a46e3ec426a713d86b2a`
`Hash MD5`	`57ba1e2960c1e866ce961acff1f8ae29`
`Hash MD5`	`6241f16b5c466a46f925c0415ef38214`
`Hash MD5`	`6ba02c01ba6843ae24ea44c8269ed2db`
`Hash MD5`	`6c755a742f2b2e5c1820f57d0338365f`
`Hash MD5`	`70569247c1a50277840141ce7ed19d3d`
`Hash MD5`	`74a97d25595ad73129fa946dc3156cec`
`Hash MD5`	`770c1dc157226638f8ad1ac9669f4883`
`Hash MD5`	`7ceeb2208a50b1ef61fdec935d66e992`
`Hash MD5`	`8947dfad1fb06abd4a2bcffc7b54a2bd`
`Hash MD5`	`8bcd83352bbd52ca7bda998a52dd0e5c`
`Hash MD5`	`91acae0fff5ecbf0b65c3ddebb5a824a`
`Hash MD5`	`9206b1fbd1fc38f48e152d1e0173c2d8`
`Hash MD5`	`96110d9369bdc35ddc1ed8844a0b076f`
`Hash MD5`	`99be93aa4c34b39fedcd37663c34511f`
`Hash MD5`	`9a218d69ecafe65eae264d2fdb52f1aa`
`Hash MD5`	`9a4889237b6aa74e819d60fadb869f51`
`Hash MD5`	`9db8f7378e2df01c842cfcb617e64475`
`Hash MD5`	`a0524bf02968db6eae5081b9ab92af31`
`Hash MD5`	`ada4e228e982a7e309bb6a3308e4872d`
`Hash MD5`	`b8c046a7c3a28653662140bb2eaad32d`
`Hash MD5`	`b97812a2e6be54e725defbab88357fa2`
`Hash MD5`	`c478fa00c91d85a8bc73f219b1845508`
`Hash MD5`	`c835fbfaf4aff8e8c252bb0ef406ddeb`
`Hash MD5`	`c8a3953985d8d261bb3d48d2f3836d2b`
`Hash MD5`	`cd54780ee2213a05468fa0d24eedd576`
`Hash MD5`	`d44071f255785c73909d64f824331ebf`
`Hash MD5`	`d54bae930b038950c2947f5397c13f84`
`Hash MD5`	`df802d7cfc8bd63e33d940ee99daed8d`
`Hash MD5`	`e4a4fc96188310b7b07e7c0525b5c0aa`
`Hash MD5`	`e67e7b8e0fb6baff4f25bb05dd5a5e21`
`Hash MD5`	`e84270afa3030b48dc9e0c53a35c65aa`
`Hash MD5`	`f0410358a0d9dbd0dff3113d9c744ca7`
`IP Address`	`45.135.232.195`
`PGP`	-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEZvA84RYJKwYBBAHaRw8BAQdAsfXDmdq7TYoRcZC61QHEwmZTmy1juaFoQpjV /j4VFG20C2RyYWdvbmZvcmNliJkEExYKAEEWIQT/ch8+XeK390StdyKTaDgqXf+F mAUCZvA84QIbAwUJBaPGzwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRCT aDgqXf+FmOCIAQDT18f6LK2lefdcCorWijKPU19ohMBXdDsgE/7dQCedOgEAouaH odmKN4qS1QobGsDD4VAmXqUORYzFgO2DyR0qdwi4OARm8DzhEgorBgEEAZdVAQUB AQdAnlA/YNPyi6VUX7qkr8vMO1OTLL3QLaegBsaTiTBURhQDAQgHiH4EGBYKACYW IQT/ch8+XeK390StdyKTaDgqXf+FmAUCZvA84QIbDAUJBaPGzwAKCRCTaDgqXf+F mIHCAQDYjpQuVrBRnMaUGEwM6/nBucGGFeCuDMu4GYi9C18igAD+O6dh+kTKgLct 4voWq+CObCJ0TJVPg74sb4BwtKOQqgg= =Fau/ -----END PGP PUBLIC KEY BLOCK-----
`Tox`	`1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20`
`URL`	`http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion/login`

Victims (667)

lyserp.com