Analysis Summary

DragonForce Ransomware is a relatively new but highly disruptive ransomware strain that emerged in mid-2023 and gained prominence throughout 2024. Believed to have originated from a cybercriminal collective operating out of Eastern Europe or Southeast Asia, DragonForce is known for its aggressive double-extortion tactics—encrypting victim data and threatening to leak sensitive information unless a ransom is paid.

While not officially attributed to a well-known Advanced Persistent Threat (APT) group, threat researchers have observed TTPs (tactics, techniques, and procedures) that resemble those used by APT38 (linked to North Korea) and FIN12, suggesting either collaboration or imitation. Some sources have also referred to the ransomware under aliases such as DFLocker or ForceCrypt, depending on slight code variations and ransom note signatures.

DragonForce has primarily targeted critical infrastructure, healthcare, and logistics sectors, with a clear pattern of targeting high-value organizations across North America, Europe, and parts of Asia. A spike in activity was noted in late 2024, with several hospital systems and freight operators forced into downtime.

In 2025, the group launched a coordinated campaign against multiple cloud service providers and MSPs (Managed Service Providers), exploiting known vulnerabilities in outdated RMM tools. The group also incorporated new evasion techniques, including custom obfuscators and living-off-the-land binaries (LOLBins), making detection significantly harder.

Its recent activity shows a shift toward persistent access and modular payloads, indicating a maturation of its toolset and operational strategy. Security agencies have raised the threat level associated with DragonForce as it continues to evolve.