Incidents

DragonForce

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware932 leak-site claims, all timeLatest observed leak-site post 2026-10-30

ORKL search ↗

Portable threat brief

DragonForce

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor: DragonForce
Kind: ransomware
Actor record created: 2026-07-07
Latest observed: 2026-10-30
Leak-site claims: 932
Catalogued techniques: 0

Scope

Tracked sectors: Construction & Engineering, Manufacturing, Business & Professional Services, Retail, Healthcare
Claim records: 2023-12-13 to 2026-10-30
News stories naming this group: 2025-05-13 to 2026-11-03

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsConstruction & EngineeringManufacturingBusiness & Professional ServicesRetailHealthcare

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2023-12-13Latest observed 2026-10-30
News stories naming this group: First observed 2025-05-13Latest observed 2026-11-03

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

Sourced threat-actor profile: MISP Galaxy (Malware Information Sharing Platform)

Suspected country: MY

Source: MISP Galaxy, CC0 1.0 Universal or BSD-2-Clause, by an exact match on the name or one of its listed alternate names.

Cited references: https://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/, https://blog.radware.com/security/2023/05/india-one-of-the-most-targeted-countries-for-hacktivist-groups/, https://securitybrief.asia/story/dragonforce-malaysia-attacks-israeli-institutions-radware, https://www.radware.com/security/threat-advisories-and-attack-reports/opisrael-a-decade-in-review/, https://blog.radware.com/security/ddos/2022/08/this-was-h1-2022-part-3-beyond-the-war/, https://www.fortinet.com/blog/threat-research/guidance-on-hacktivist-operation-opspatuk-by-dragonforce

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

932 on this site

lyserp.comBusiness & Professional Services2026-10-30source ↗
Zhito TechnologyTransportation & Logistics2026-10-27source ↗
Inside Passage Electric Cooperative, IncEnergy & Utilities2026-10-26source ↗
oakgrovetechAerospace & Defense2026-10-18source ↗
Lane EquipmentHospitality2026-10-14source ↗
Canadian Mennonite University (CMU)Education2026-10-12source ↗
TQC S.A.Pharmaceuticals & Life Sciences2026-10-11source ↗
TEXMA International Co., LtdManufacturing2026-10-10source ↗
RÉSOConstruction & Engineering2026-10-08source ↗
Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.Energy & Utilities2026-10-08source ↗

View all on Breaches →

Leak-site claim activity

Claims per month, 2023-12 to 2026-10. Peak 132 in 2026-04.

2023-122026-10

Show monthly counts as a table

Month	Claims
2023-12	21
2024-01	1
2024-02	5
2024-03	6
2024-04	12
2024-05	13
2024-06	7
2024-07	14
2024-08	7
2024-09	6
2024-10	0
2024-11	12
2024-12	7
2025-01	14
2025-02	4
2025-03	8
2025-04	31
2025-05	2
2025-06	25
2025-07	22
2025-08	30
2025-09	9
2025-10	18
2025-11	25
2025-12	34
2026-01	18
2026-02	74
2026-03	118
2026-04	132
2026-05	112
2026-06	56
2026-07	46
2026-08	17
2026-09	14
2026-10	12

0 additional claims without a disclosure date

News stories naming this group

10 on this site

2026-11-03ransomwareRansomware and Cyber Extortion in Q3 2026
2026-10-27ransomwareOmegatech Is Disrupted , and the Pressure on Bulletproof Hosting Keeps Building
2026-09-28vulnerabilities28th September – Threat Intelligence Report
2026-09-24ransomwareBeyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
2026-07-16ransomwareRansomware and Cyber Extortion in Q2 2026
2026-05-27threat intelAgentic Attacks Have Already Hit Finance. The Defense Architecture Hasn't Caught Up.
2025-10-21ransomwareThreat Spotlight: How Automation, Customization, and Tooling Signal Next Ransomware Front Runners
2025-06-25ransomwareUnpatched SimpleHelp Vulnerabilities Continue to be Exploited by DragonForce
2025-06-05threat intelScattered Spider Targets Tech Companies for Help-Desk Exploitation
2025-05-13threat intelThreat Spotlight: Capitol x Kremlin: Will US Politics Reshape Russian Cyber Threats?

Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (Terms of use: credit and link required).