DragonForce turned a ransomware brand into a platform that other criminals rent, so the same encryptor and leak site can sit behind very different intrusions. The operation first appeared in 2023, pushed an affiliate programme in 2024 and rebranded itself as a "cartel" in 2025, letting partners run their own brands on its infrastructure. It came to wide attention in the UK after the April 2025 attacks on Marks and Spencer and the Co-op, which were widely linked to the Scattered Spider collective working with DragonForce. This profile covers who DragonForce is, how the cartel model changes defence, the techniques used in its intrusions mapped to MITRE ATT&CK, its heavy reliance on identity abuse, and the controls that break its playbook. It is for SOC analysts, incident responders and identity teams, and complements the Scattered Spider Threat Actor Profile.
Key takeaways
- DragonForce is a service, not a single crew. Affiliates reportedly keep 80% of ransom proceeds and can use their own brand on DragonForce infrastructure, so attribution by ransom note alone is unreliable.
- The front door is usually a person, not a vulnerability. The 2025 UK retail intrusions began with impersonation of employees or third-party users to the help desk, followed by password and MFA resets.
- Exposed remote support tools are the other door. Bitsight reports, with medium confidence, abuse of SimpleHelp vulnerabilities in MSP environments, and all three CVEs are in CISA's Known Exploited Vulnerabilities catalogue with known ransomware use.
- Hypervisors and backups are primary targets. The encryptor covers Windows, Linux and VMware ESXi, and operators hunt for vCenter, backup systems and credential stores before encrypting.
- Help desk verification and phishing-resistant MFA matter more than any IOC list. They stop the identity takeover that precedes every later stage, whichever affiliate is behind the keyboard.
Who they are (names and aliases)
DragonForce is a financially motivated ransomware and data extortion operation. Bitsight dates first observed activity to August 2023, and Acronis places the brand's first appearance in 2023 with more than 200 victims listed on its leak site since late 2023. A hacktivist group called DragonForce Malaysia existed earlier; both Acronis and Bitsight describe any link between the two as limited or unconfirmed, so treat the shared name as a coincidence until proven otherwise.
The technical lineage is borrowed. Acronis analysis shows early DragonForce payloads built from the leaked LockBit 3.0 builder, later replaced by a customised build derived from Conti v3 source code. Neither link means LockBit or Conti operators run DragonForce: leaked builders are used by many unrelated groups. See the Ransomware Family Lineage and Rebrands Guide.
| Date | Milestone | Source |
|---|---|---|
| August 2023 | First observed activity | Bitsight |
| 2023 to 2024 | Payloads based on leaked LockBit 3.0 builder, then a customised Conti v3 derivative | Acronis |
| June 2024 | Public affiliate programme offering 80% of proceeds to affiliates | Bitsight |
| March 2025 (early 2025) | Rebrand as a "cartel": affiliates may run their own brands on DragonForce infrastructure | Bitsight, Acronis |
| 2025 | Defacement or takeover claims against rival leak sites (BlackLock, RansomHub) amid competition for affiliates | Acronis, Bitsight |
| April 2025 | UK retail intrusions (Marks and Spencer, Co-op) widely linked to DragonForce with Scattered Spider | NHIMG breach pages |
Brands on the platform: Acronis reports affiliate brands such as Devman and Mamona operating on DragonForce infrastructure. For defenders this means a ransom note bearing another name can still be a DragonForce-hosted operation, and the reverse. Track the infrastructure and the intrusion behaviour, not just the brand. The Ransomware-as-a-Service Business Model Guide explains why this matters for attribution and sanctions screening.
Targeting and motivation
The motive is money, through encryption plus data theft and leak-site extortion (double extortion). Bitsight reports victims mainly in the United States and United Kingdom, followed by Australia, Canada and Italy. Acronis lists retail, airlines, insurance and managed service providers among affected sectors. Targeting is opportunistic at the affiliate level: an affiliate with help desk social engineering skills picks large, brand-sensitive retailers, while one holding access to an MSP's remote support server reaches that MSP's customers.
- Large consumer brands: high operational disruption, high media pressure, and complex outsourced IT (third-party help desks and service desks) that give impersonators many people to call.
- MSPs and their customers: one exposed remote monitoring and management (RMM) or remote support server can reach many downstream networks. See the Compromised MSP Playbook.
- Virtualised estates: ESXi support lets an affiliate encrypt hundreds of virtual machines from the hypervisor layer.
The cartel model also makes DragonForce a competitor for affiliates. Its 2025 actions against rival leak sites, reported by Acronis and Bitsight, fit a pattern seen across the ecosystem: when a large programme falters, affiliates move and the victim profile of the receiving brand shifts with them. See the RansomHub Threat Actor Profile.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 has no group entry for DragonForce at the time of writing, so the mapping below is built from the Acronis and Bitsight analyses plus the Scattered Spider entry (G1015) for the intrusions attributed to that collective. Technique IDs were checked against ATT&CK v20. Different affiliates will use different subsets.
| Tactic | Technique (ATT&CK v20) | Observed behaviour |
|---|---|---|
| Initial access | T1566.004 Spearphishing Voice | Calls to the help desk or staff impersonating employees or third-party users |
| Initial access | T1078 Valid Accounts; T1133 External Remote Services | Logging in with reset or stolen credentials through VPN and remote access |
| Initial access | T1190 Exploit Public-Facing Application | SimpleHelp CVE-2024-57726, CVE-2024-57727, CVE-2024-57728 (Bitsight, medium confidence) |
| Initial access | T1199 Trusted Relationship | Reaching customers through an MSP's tooling |
| Credential access | T1621 Multi-Factor Authentication Request Generation | MFA fatigue against targeted users |
| Persistence | T1098.005 Device Registration | Enrolling attacker devices as new MFA factors or managed devices |
| Command and control | T1219.002 Remote Desktop Software | ScreenConnect, AnyDesk, TeamViewer, Splashtop |
| Discovery | T1087.002 Domain Account; T1018 Remote System Discovery; T1673 Virtual Machine Discovery | Mapping AD, servers, vCenter and ESXi hosts |
| Collection | T1213.002 Sharepoint | Searching SharePoint for credentials and network documentation |
| Credential access | T1003.003 NTDS | Taking the Active Directory database (reported in the Co-op intrusion) |
| Privilege escalation / defence impairment | T1068 Exploitation for Privilege Escalation; T1685 Disable or Modify Tools | Optional vulnerable-driver mode (truesight.sys, rentdrv2.sys) to terminate security processes |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Data staged to MEGA or Amazon S3 |
| Impact | T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery | ChaCha20 with RSA key protection; backups targeted before encryption |
Acronis notes that the driver-based process termination needs the vulnerable drivers to be present on the host, and that the encryptor can also target SMB network shares. The Bring Your Own Vulnerable Driver and EDR Killers Guide covers the driver blocklist and memory integrity controls that defeat this mode.
How they abuse identities and credentials
Almost every stage of a DragonForce intrusion runs through an identity. The encryptor is the last and least distinctive step.
- Help desk resets: the caller has done open-source research (LinkedIn, leaked data) and asks for a password and MFA reset for a real employee or contractor. In the Co-op attack, password reset impersonation preceded the theft of member data. See the Account Recovery and Help Desk Security Guide.
- Third-party identities: the Marks and Spencer cyberattack began with impersonation of a third-party user, showing that outsourced service desk accounts and contractor identities need the same verification as staff.
- MFA enrolment as persistence: once a reset is granted, the attacker registers their own authenticator or device. Without alerting on new MFA method registration, the foothold survives a password change.
- Domain credential theft: taking ntds.dit gives every AD password hash, including service accounts and the krbtgt account, which turns a contained incident into a full credential rotation.
- Cloud and automation identities: Acronis reports use of AWS Systems Manager inventory in cloud estates and exfiltration to S3, which means cloud access keys and roles are in scope. See the Service Account Security Guide.
- Remote support tool accounts: RMM and remote support platforms hold privileged, often shared, technician accounts. An exploited SimpleHelp server hands over every endpoint it manages. See the RMM Tool Security Guide.
Notable incidents
| Incident | Date | What happened | Lesson |
|---|---|---|---|
| Marks and Spencer | Entry 17 April 2025, detected 19 April, disclosed 22 April | Impersonation of a third-party user; online orders paused from 25 April; profit impact of around £300 million; DragonForce link widely reported | Third-party help desk processes are part of your attack surface |
| Co-op Group | Disclosed 30 April 2025 | Password reset impersonation; ntds.dit targeted; attackers evicted before ransomware deployment, but data of 6.5 million members was taken | Fast containment can prevent encryption, not exfiltration |
The NHIMG breach pages record that the UK National Crime Agency made arrests linked to the retail attacks on 10 July 2025. Arrests of individuals associated with one affiliate do not end a service platform: the infrastructure, encryptor and other affiliates continue.
Detection and defence
What to monitor
| Signal | Where to find it | Why it matters |
|---|---|---|
| Help desk password or MFA reset followed by sign-in from a new device or location within hours | Service desk tickets joined to IdP sign-in logs | Core pattern of the 2025 retail intrusions |
| New MFA method or device registered for a privileged or recently reset user | Entra ID or Okta audit logs | Persistence via T1098.005 |
| Bursts of MFA push denials | IdP authentication logs | MFA fatigue (T1621) |
| Unapproved remote access tools installing or beaconing | EDR process and network telemetry, DNS | T1219.002 command and control |
| ntdsutil, Volume Shadow Copy access or ntds.dit copies on domain controllers | EDR, Windows Security log, Sysmon | Domain credential theft (T1003.003) |
| vCenter logins by unusual accounts, SSH enabled on ESXi hosts | vCenter events, ESXi syslog | Precursor to hypervisor encryption |
| Large uploads to MEGA or unfamiliar S3 buckets | Proxy, firewall, CloudTrail | Exfiltration (T1567.002) |
| Kernel driver loads of known vulnerable drivers | Sysmon Event ID 6, Code Integrity log | EDR killing before encryption |
Defences that break the playbook
- Harden identity verification at the help desk first. Require a verified callback, manager approval or identity proofing before any reset of passwords or MFA, with stricter rules for privileged and third-party accounts. Train in-house and outsourced desks with the Vishing and Help Desk Social Engineering Awareness Guide.
- Move administrators to phishing-resistant MFA. FIDO2 or certificate-based authentication removes push fatigue and makes a reset alone insufficient. See the Phishing-Resistant MFA Guide.
- Patch and fence remote support tools. Put SimpleHelp and other RMM servers behind VPN or zero trust access, patch the KEV-listed CVEs, and allowlist approved remote tools while blocking the rest.
- Separate the hypervisor and backup tiers. Use dedicated, non-domain admin accounts for vCenter and backup consoles, disable ESXi SSH by default, and keep immutable copies. See the VMware ESXi Hardening Guide and the Backup Identity Isolation Guide.
- Enable the vulnerable driver blocklist and memory integrity so the optional driver mode fails.
- Rehearse containment. Pre-agree who can disable the IdP sync, revoke sessions and cut MSP connections. Plan krbtgt and service account rotation if ntds.dit is taken. See the Ransomware Response and Recovery Guide.
Metrics
- Verified resets: percentage of help desk password and MFA resets that passed the out-of-band verification step (target 100%).
- Phishing-resistant coverage: percentage of privileged and third-party accounts on FIDO2 or certificate-based MFA.
- Remote tool sprawl: number of unapproved remote access tools seen per month (target falling to zero).
- KEV exposure: days from KEV listing to patch for internet-facing remote support products.
- Alert to containment time: time from a suspicious post-reset sign-in alert to session revocation.
Framework mapping
| Defence | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Help desk identity verification and credential management | PR.AA-01 | IA-5 Authenticator Management |
| Phishing-resistant MFA | PR.AA-03 | IA-2 Identification and Authentication |
| Separate admin tiers for hypervisor and backup | PR.AA-01 | AC-6 Least Privilege |
| Immutable backups | PR.DS-11 | CP-9 System Backup |
| Monitoring of resets, MFA changes and remote tools | DE.CM-03 | SI-4 System Monitoring |
| Containment and eviction | RS.MI-01 | IR-4 Incident Handling |
Practitioner checklist
- Write and enforce a help desk verification standard for password and MFA resets, including outsourced desks and third-party users.
- Alert on any new MFA method or device registration within 24 hours of a reset, and on privileged account resets.
- Put all administrators and third-party privileged users on phishing-resistant MFA.
- Patch SimpleHelp CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728 where present, and remove internet exposure of RMM consoles.
- Allowlist approved remote access tools and block ScreenConnect, AnyDesk, TeamViewer and Splashtop where they are not sanctioned.
- Isolate vCenter, ESXi and backup administration from the domain and keep immutable backups offline from those credentials.
- Enable the Microsoft vulnerable driver blocklist and memory integrity on endpoints and servers.
- Prepare a krbtgt and service account rotation runbook in case the AD database is stolen.
- Track DragonForce and affiliate brand names in threat intelligence, but hunt on behaviour, not branding.
Standards and references
- MITRE ATT&CK: Scattered Spider (G1015)
- CISA: Scattered Spider advisory (AA23-320A)
- CISA: Known Exploited Vulnerabilities Catalog
- Acronis TRU: The DragonForce cartel, Scattered Spider at the gate
- Bitsight: Threat actor profile, DragonForce ransomware group
- MITRE ATT&CK: Spearphishing Voice (T1566.004)
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Scattered Spider Threat Actor Profile · Ransomware Groups Guide · Ransomware-as-a-Service Business Model Guide · Account Recovery and Help Desk Security Guide · ITDR Guide