DragonForce Ransomware Group Expands Its Influence with Cartel-like Operations and Targeting 363 Companies Since 2023

DragonForce is a Ransomware-as-a-Service cartel active since December 2023 that has publicly targeted hundreds of companies (363 identified victims) and expanded its operational and technical capabilities—leveraging dark-web recruitment, bespoke affiliate tools (e.g., RansomBay), harassment services, and enhanced ransomware builders that use BYOVD, ChaCha8-encrypted configurations, and new per-extension encryption rules.