DragonForce

DragonForce is a ransomware group maintaining sustained victim-posting activity through 2025 and 2026, operating alongside LockBit5 as one of the two highest-volume active ransomware operators in the period. The group runs a ransomware-as-a-service model with its own leak site. In March 2026, it was among the most active groups within the 808 total ransomware victim postings across 65 active groups that Mandiant's M-Trends 2026 report recorded, a figure 19 per cent up month-on-month and 33 per cent above the 2025 monthly average.

DragonForce has been active since approximately 2023 and is not reliably attributable to a specific nation-state. It has targeted organisations in critical infrastructure, manufacturing, retail and services sectors across the US, UK, Europe and the Asia-Pacific region. The group gained broader attention in 2024 when it emerged as a significant alternative RaaS platform following the disruption of LockBit and ALPHV, recruiting affiliates who had previously worked with those platforms.

In May 2026, DragonForce was confirmed as using flaws in SimpleHelp RMM — CVE-2024-57726 and CVE-2024-57728 — as initial access for ransomware deployment. This confirms a pattern of DragonForce affiliates exploiting remote monitoring and management (RMM) software as the entry point, consistent with the broader trend of threat actors targeting IT management tooling rather than end-user endpoints. The group's sustained volume, alongside the new RMM initial-access confirmation, is consistent with the wider pattern of affiliate-model RaaS volumes remaining high despite law enforcement operations against individual platforms.