Skip to main content
Ransomware Group

DragonForce

DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2025, gaining notoriety for high-profile attacks on UK retailers Marks & Spencer, Co-op, and Harrods.

Known victims667

Threat level

CRITICAL

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • Mimikatz

DiscoveryEnum

  • Advanced IP Scanner
  • PingCastle
  • SoftPerfect NetScan

Indicators of Compromise (IOCs)

IP addresses

1
  • 45.135.232.195

Get the complete IOC feed

The full IOC database by API, ready for your SIEM or SOAR.

Create free account

No credit card required · Free API key

Known infrastructure

The following Tor hidden services have been associated with this group:

  • xtcwd3xmxpggtizn7kmwwqeizexflkkyqsytg2kauccau6ddsfa4gfyd.onion
  • 2yczff6zyiey3gkgl5anwejktdp73abxbzbnvwobmrwkwgf3hudpyvyd.onion
  • guestuctexqqaoxuahuydfa6ovxuhtng66pgyr5gqcrsi7qgchpkad.onion
  • bpoowhokr3vi32l3t4mjdtdxfrfpigwachopk5ojwmgxihnojhsawuyd.onion
  • 4wcrfql53ljekid3sn66z6swjot725muveddq77utxltaelw64eikfid.onion

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on DragonForce’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida