DragonForce · Ransomware · RaqibCTI

Knowledge/Actors/DragonForceCorpus

+ Request intel workspace

ransomware

DragonForce

active · last signal 1mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.RaaS: Operator

Ransomware

DragonForceDragonForce Cartel

Attribution

RaaS / 'cartel' affiliate model (financially motivated, unattributed)

Origin

Unknown

First seen

2023

Last active

2026

Motivation

Financially motivated (ransomware)

Attribution confidence

medium

RaaS role

Operator

MENA targeting

Saudi Arabia

Sectors

Real estate, construction, chemical/logistics

Corpus activity · 6mo1 mention

AMJJAS

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia (Real estate, construction, chemical/logistics sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Related to

DarkVaultactorTechnique overlap
Hunters InternationalactorTechnique overlap
SarcomaactorTechnique overlap
EverestactorTechnique overlap
MeowactorTechnique overlap
TrigonaactorTechnique overlap
IncRansomactorTechnique overlap
Cicada3301actorTechnique overlap
Orovaactor

Overview Attribution² TTPs⁷ Indicators Reporting⁴ Coverage

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Technique overlap

→StormousactorTechnique overlap

→Money MessageactorTechnique overlap

←BQTLockactorTechnique overlap

←BlackNevasactorTechnique overlap

→GhostSec / GhostLockeractorTechnique overlap

→EldoradoactorTechnique overlap

→FunkSecactorTechnique overlap

→RhysidaactorTechnique overlap

→The GentlemenactorTechnique overlap

←CactusactorTechnique overlap

←BianLianactorTechnique overlap

→TenguactorTechnique overlap

→SpacebearsactorTechnique overlap

→KillSecactorTechnique overlap

→NovaactorTechnique overlap

→SinobiactorTechnique overlap

←DevmanactorTechnique overlap

←BrainCipheractorTechnique overlap

→RansomHouseactorTechnique overlap

→LynxactorTechnique overlap

→Void Manticore (Storm-0842)actorTechnique overlap

←Cl0pactorTechnique overlap

←Qilin (fka Agenda) · QilincampaignCorrelated cluster2026-09-17

Targets

WozairtargetLeak-site claim · ransomware.live2026-08-24
NewNettargetLeak-site claim · ransomware.live2026-07-18
Sinai Grand CasinotargetLeak-site claim · ransomware.live2026-07-16
Midal CablestargetLeak-site claim · ransomware.live2026-07-14
degeremcia.comtargetLeak-site claim · ransomware.live2026-07-13
Al - Saidi FactorytargetLeak-site claim · ransomware.live2026-07-12
Al Shafar GRCtargetLeak-site claim · ransomware.live2026-06-12
The DRMtargetLeak-site claim · ransomware.live2026-06-12

+23 more relationships — see the relationships browser.

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

ActorLockBit / LockBit 3.0
ActorDevman
Actor8Base
ActorTropic Trooper
ActorRhysida
ActorNova

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

MalwareRhysidaco-mentioned in 1 item
CVECVE-2026-50752co-mentioned in 1 item
CVECVE-2026-50751co-mentioned in 1 item
CountryChinaco-mentioned in 1 item
MalwareBlackByteco-mentioned in 1 item
TechniqueT1059.007co-mentioned in 1 item
TechniqueT1564.006co-mentioned in 1 item
CVECVE-2026-33825co-mentioned in 1 item
MalwareCorunaco-mentioned in 1 item
MalwareLummaco-mentioned in 1 item
MalwarePasivRobberco-mentioned in 1 item
MalwareQilinco-mentioned in 1 item
TechniqueT1496co-mentioned in 1 item
MalwareINCco-mentioned in 1 item
MalwareAkiraco-mentioned in 1 item
TechniqueT1068co-mentioned in 1 item
MalwareFlutterShellco-mentioned in 1 item
TechniqueT1486co-mentioned in 1 item
TechniqueT1572co-mentioned in 1 item
CountryNetherlandsco-mentioned in 1 item
MalwareGlassWormco-mentioned in 1 item
MalwareVidarco-mentioned in 1 item
MalwareOysterco-mentioned in 1 item
TechniqueT1553.002co-mentioned in 1 item
CountryGermanyco-mentioned in 1 item
TechniqueT1190co-mentioned in 1 item
TechniqueT1195.002co-mentioned in 1 item
CountryPakistanco-mentioned in 1 item
CountryUnited Statesco-mentioned in 1 item