Dragonforce

Active
DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.
651 Victims
Oct 20, 2022 First Discovered
Sep 15, 2026 Last Discovered
0 Days Inactive
0% Infostealer
3/5 Sites Online
Known Locations (5)
dragongoztkdfmnd7jkchznd3fvkpdmeh4vhbt6p3usrlsoy5dw2bhyd.onion
DragonForce | Migration completed
3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
DragonForce | Blog
xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion
DragonForce | Leaks
dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion
DragonForce | Migration completed
z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Tools Used
CredentialTheft
Mimikatz
DiscoveryEnum
Advanced IP Scanner, PingCastle, SoftPerfect NetScan
Intelligence
Victims (651)

Detailed victim list temporarily unavailable

This group has 651 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.