{
  "name": "The Godfather of Ransomware? Inside Cartel Ambitions",
  "slug": "the-godfather-of-ransomware-inside-cartel-ambitions",
  "description": "DragonForce, a ransomware group that emerged in late 2023, has become a significant cyber threat. They employ a dual-extortion strategy, encrypting and exfiltrating data, and have targeted various sectors, particularly manufacturing and construction. The group offers a flexible ransomware-as-a-service platform with advanced features, supporting multiple platforms and encryption modes. DragonForce has announced a shift to a cartel model, allowing affiliates to create their own brands. They've also introduced automated registration for new affiliates and a 'Company Data Audit' service to enhance extortion campaigns. The group has engaged in conflicts with rival ransomware operations and claims to have formed a coalition with other major groups. While their connection to DragonForce Malaysia remains unsubstantiated, technical analysis reveals similarities with other ransomware families and sophisticated attack techniques.",
  "published": "2026-02-04T10:13:50+00:00",
  "created_at": "2026-02-04T10:13:50+00:00",
  "modified_at": "2026-02-04T20:20:54+00:00",
  "created_at_opencti": "2026-02-04T10:13:50+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-02-04",
    "cartel",
    "cross-platform",
    "cybercrime",
    "data-audit",
    "dragonforce",
    "dual-extortion",
    "encryption",
    "raas",
    "ransomware"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "46.29.238.160"
      },
      {
        "id": "",
        "name": "87.121.47.15"
      },
      {
        "id": "",
        "name": "91.108.244.85"
      },
      {
        "id": "",
        "name": "46.29.238.123"
      },
      {
        "id": "",
        "name": "95.164.53.64"
      },
      {
        "id": "",
        "name": "193.233.175.213"
      },
      {
        "id": "",
        "name": "c5554ab2ea04e9d938a47b09ea34ebedb46c223a500aa70f08f4b2dc6864bd90"
      }
    ],
    "malware": [
      {
        "id": "5acd6de8-b5ef-4699-83df-1951dd74e1e2",
        "name": "DragonForce",
        "slug": "dragonforce"
      }
    ],
    "intrusion_sets": [
      {
        "id": "a63d97b5-8199-4473-a37a-2ef8956ad332",
        "name": "DragonForce",
        "slug": "dragonforce"
      }
    ],
    "attack_patterns": [
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "53b3b18c-d0d0-4bf6-bc6b-2c0ab9180deb",
        "name": "T1070"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "306ee8dc-1d64-4916-96be-18060d690ad7",
        "name": "T1499"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "d5c953ff-b143-41b6-bf2d-87b829132ea5",
        "name": "T1135"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Australia"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "Manufacturing"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Construction"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/698329eec78e99f19718ca7c",
    "https://www.levelblue.com/blogs/spiderlabs-blog/the-godfather-of-ransomware-inside-dragonforces-cartel-ambitions"
  ]
}