dragonforce

Profile

DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.

Tactics and techniques (MITRE ATT&CK)

Execution

T1204.002 · User Execution

Defense Evasion

T1070.004 · Indicator Removal: File DeletionT1562.001 · Impair Defenses: Disable or Modify Tools

Discovery

T1083 · File and Directory Discovery

Impact

T1486 · Data Encrypted for Impact