dragonforce

Ransomware
Sourceransomware.live
0

About the group

DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Impact and victims

The group dragonforce has 10 known ransomware victims. See the most affected sectors and countries and recent victims.

10known victims
10in Brazil
8sectors hit
Activity (12 months)
11
03
04
06
08
10
Most attacked sectors
Professional Services2
Education1
Energy & Utilities1
Financial Services1
Manufacturing1
Other1
Agriculture and Food Production1
Technology1
Most affected countries
🇧🇷 Brasil10
Recent victims
Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.Energy & Utilities · BR · 2026-10-07
FratoOther · BR · 2026-08-24
Vermont XCenterNot Found · BR · 2026-08-17
agroprimeAgriculture and Food Production · BR · 2026-06-28
novafp.comProfessional Services · BR · 2026-04-14
fgv.brEducation · BR · 2026-03-02
C&M SoftwareTechnology · BR · 2025-11-22
Banco GuanabaraFinancial Services · BR · 2025-07-30
ScolariManufacturing · BR · 2024-11-02
Igloo CelluloseProfessional Services · BR · 2024-08-22

References

dragonforce uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →