Back to Ransomware Database
Ransomware Group

dragonforce

DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.

579 Known Victims

Threat Level

CRITICAL

Known Infrastructure

The following Tor hidden services have been associated with this group:

  • dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion
  • z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
  • 3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion

⚠️ Warning: These are malicious sites. Do not visit without proper security measures.

0

Check If You're Affected

Search our database to see if your organization appears in dragonforce's victim list.

Try It NowFree
Try:|

Get instant threat analysis with risk scores, threat categories, and detailed reports.

Other Active Ransomware Groups

LockbitBlackcatCl0pPlayBianlianAkiraMedusaRhysida