DragonForce isn’t just one other ransomware model – it’s a destabilizing pressure making an attempt to reshape the ransomware panorama. Counter Menace Unit (CTU) researchers are actively monitoring the evolution of the menace posed by the group.
Enter the dragon
DragonForce is concerned in high-impact assaults focusing on each conventional IT infrastructure and virtualized environments (e.g., VMware ESXi), with a powerful emphasis on credential theft, Lively Listing abuse, and information exfiltration. In March 2025, it launched efforts to assert dominance within the ransomware ecosystem by introducing a extra versatile affiliate mannequin and focusing on different ransomware teams.
A collection of assaults on UK retailers that started in late April introduced this group into sharper focus as third-party reviews linked these assaults to DragonForce and the GOLD HARVEST (also called Scattered Spider) menace group. GOLD HARVEST incessantly leverages social engineering, abuse of distant monitoring and administration (RMM) instruments, and multi-factor authentication (MFA) bypass strategies to achieve entry, steal bulk information, and typically deploy ransomware.
When DragonForce emerged in August 2023, it provided a conventional RaaS scheme. On March 19, 2025, the group introduced a rebrand as a ‘cartel’ to develop its attain, hoping to emulate the success of LockBit and different mature ransomware-as-a-service (RaaS) teams. In observe, it isn’t a cartel operation however an providing that provides associates the pliability to leverage DragonForce’s infrastructure and ransomware instruments whereas working underneath their very own manufacturers (see Determine 1).
Determine 1: Commercial for the DragonForce cartel
DragonForce didn’t simply revamp its enterprise mannequin; it started attacking rival operations. The ‘cartel’ submit coincided with defacements of leak websites operated by the BlackLock and Mamona ransomware teams. The defacements appeared to have been performed by DragonForce, as seen within the side-by-side display captures in Determine 2.
Determine 2: Defaced Mamona (left) and BlackLock (proper) leak websites
In April, a submit on the RansomHub leak web site appeared to advertise the DragonForce cartel, as seen in Determine 3. A DragonForce submit on the RAMP underground discussion board additionally appeared to point that the teams had been working collectively, however the postscript steered that RansomHub won’t help the collaboration (see Determine 4). RansomHub is likely one of the most prolific teams to emerge following the LockBit disruption and ALPHV (also called BlackCat) demise in 2024.
Determine 3: DragonForce cartel point out on RansomHub leak web site
Determine 4: DragonForce submit suggesting a collaboration with RansomHub
Shortly after these posts, the RansomHub leak web site went offline. The homepage displayed the message “RansomHub R.I.P 03/03/2025.” The “collaboration” between DragonForce and RansomHub seems to have been extra of a hostile takeover by DragonForce. The ‘koley’ persona, who is thought to be a outstanding RansomHub member, posted a defacement of the DragonForce homepage on RAMP (see Determine 5), together with the message “@dragonforce guess you have got traitors…” Extra posts by koley accused DragonForce of working with regulation enforcement, attacking rivals, and telling lies.
Determine 5: Defacement of the DragonForce leak web site shared by RansomHub member ‘koley’
As of this publication, the DragonForce leak web site is again on-line after an prolonged interval of down time. Throughout that interval, the homepage displayed a message stating that it might be up once more quickly, and an identical message seems on the RansomBay leak web site (see Determine 6).
Determine 6: DragonForce and RansomBay leak web site homepages as of Could 2, 2025
In Could 2025, UK retailer Marks and Spencer was the topic of a major cyberattack that was publicly attributed to GOLD HARVEST (referred to within the reporting as Scattered Spider), though this attribution has not been formally confirmed. This group is a loosely organized cybercriminal collective made up of particular person menace actors who collaborate by means of a shared community of underground boards and encrypted chat channels utilized by a group of like-minded people referred to as “The Com.” The menace actors on this group coordinate malicious companies to conduct assaults, alternate instruments, and share techniques inside this decentralized ecosystem. GOLD HARVEST reportedly deployed the DragonForce ransomware on this assault.
GOLD HARVEST has been recognized to function as a ransomware affiliate, deploying ALPHV ransomware in assaults on MGM Resorts in 2023 and reportedly utilizing RansomHub in assaults all through 2024. The menace actors make the most of a variety of techniques, strategies, and procedures (TTPs) of their assaults however are recognized for his or her efficient use of social engineering. They usually acquire entry to organizations by focusing on IT assist desks. Public attribution of the Marks and Spencer assault could also be predicated on the idea that the assault began with social engineering, maybe focusing on assist desk employees.
Social engineering is a common menace throughout the cyber panorama and isn’t distinctive to GOLD HARVEST, though the group has been adept at utilizing this strategy through e mail and phone calls. There’s growing interaction between social engineering and stolen credentials. GOLD HARVEST is recognized to make use of commodity infostealers equivalent to Vidar and Raccoon, which accumulate browser-saved passwords, cookies, and session tokens. These credentials can allow preliminary entry straight or help extra convincing social engineering makes an attempt by permitting attackers to reference inside methods or mimic professional worker conduct.
DragonForce has claimed two assaults impacting UK retailers. These assaults spotlight the necessity for vigilance by firms within the retail sector. The inner warfare amongst ransomware teams is disruptive to their very own operations however doesn’t cut back danger to organizations. In actual fact, it could result in extra erratic, opportunistic assaults as teams scramble to claim dominance and monetize stolen information in new methods. Organizations should due to this fact revisit their incident response, menace intelligence, and third-party danger administration methods to stay resilient in an more and more chaotic menace atmosphere.
Suggestions for defenders
Whereas technical controls stay important for detecting and mitigating GOLD HARVEST and DragonForce exercise, they have to be strengthened by sturdy inside processes and constant human vigilance. These assaults reinforce that technical compromises usually start with social compromise. Conversations are incessantly the preliminary level of compromise, not exploits. Organizations should cut back their publicity to social engineering by combining technical controls with procedural self-discipline. CTU researchers suggest that organizations take the next actions to mitigate the dangers of those assaults:
- Deploy browser isolation and password managers to forestall harvesting of saved credentials.
- Implement endpoint detection for infostealer exercise, together with credential and session cookie theft.
- Make the most of an identification monitoring answer that makes use of darkish internet sources and menace intel feeds to repeatedly monitor for compromised credentials.
- Implement strict identification verification protocols for IT help and assist desk interactions.
- Set up clear escalation paths to empower front-line employees to withstand uncommon or pressing requests till they are often verified.
- Conduct common tabletop workout routines that simulate social engineering and insider menace eventualities.
