Ransomware - DragonForce

Just in time for The Year of the Dragon (Loong), DragonForce appeared on the scene in early December 2023. As of this writing (mid-January), little is known about this ransomware and the group responsible for creating and disseminating it. We know that they have a dark web data leak site that is also known as DragonLeaks. We also know that they claim to encrypt victim systems based on their own admission, and they exfiltrate data, too. Therefore, they are categorized as a crypto-ransomware and data broker group. They also take part in direct and double extortions, and if the victims fail to pay, then they release the data for free (Free Data Leaks). Aside from that, the most pertinent information from this ransomware is of the victims they have posted and what has been reported in the media. You can view that information in the Known Victims and References & Publications sections below.

There is an educated assumption of who the threat actors are. In 2023, a hacktivist group out of Malaysia named DragonForce Malaysia claimed they were in the process of creating a ransomware operation. This hacktivist group already had a few connections related to hacking and breaches. So, it isn't far-fetched that this is the same group responsible for this ransomware operation. They have the same name, after all! Let's not forget that one of the primary goals of ransomware groups is to avoid attribution, and they are prolific liars. As such, this is an educated guess, and we have labeled the Threat Actors and Country of Origin with this assumption below. If and when we find out more about this operation, we will update the information herein.