DragonForce
DragonForce is a Malaysia-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 19 sectors, including Government and Technology, in 70 countries, including the United States and the United Kingdom. It uses 109 MITRE ATT&CK techniques and exploits 24 known CVEs.
- DragonForce Team
- DFRC
- Origin
- Malaysia
- Techniques
- 109
- Exploited CVEs
- 24
- First seen
- Jan 1, 2023
- Last seen
- Sep 6, 2026
- Record updated
Who They Target.
About DragonForce.
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.