Dragonforce

Also known as Hackledorb

Reports

First seen

Sep 8

Last seen

Jun 27

Motivation

financial, extortion, financial extortion

Targeting

Sectors

manufacturing ×12professional services ×10other ×6technology ×6hospitality ×5healthcare ×4retail ecommerce ×3financial services ×3

Victim regions

United States ×17Canada ×4United Kingdom ×4India ×3United Arab Emirates ×3Netherlands ×3Italy ×2Hong Kong SAR China ×2

Top ATT&CK techniques

T1562.001 Impair Defenses: Disable or Modify Tools ×5T1486 Data Encrypted for Impact ×5T1190 Exploit Public-Facing Application ×4T1566 Phishing ×4T1021 Remote Services ×3T1195 Supply Chain Compromise ×3T1068 Exploitation for Privilege Escalation ×3T1133 External Remote Services ×2T1055 Process Injection ×2T1003 OS Credential Dumping ×2T1059.001 Command and Scripting Interpreter: PowerShell ×2T1547 Boot or Logon Autostart Execution ×2

Indicators

domain ×160filename ×102ip_v4 ×61hash_md5 ×36hash_sha1 ×15hash_sha256 ×14cve ×10email ×4url ×2registry_key ×1bitcoin_address ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2023-52271 (exploited)CVE-2025-1055 (exploited)CVE-2025-61155 (exploited)CVE-2024-50383 (exploited)CVE-2026-39987 (exploited)CVE-2026-49494 CVE-2026-1340 (exploited)CVE-2026-35616 (exploited)CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)

Recent reports

High

ThreatsDay Bulletin: Weekly threat roundup covering infostealers, supply chain attacks, AI security risks, and endpoint defense evasion

The Hacker NewsJun 11 High

Dragonforce

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Dragonforce publishes Aptora as new ransomware victim

Dragonforce publishes BITS Pilani as ransomware victim

Dragonforce publishes mihana-v.com as ransomware victim

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Dragonforce publishes Tecfi SpA as new ransomware victim

DragonForce ransomware uses custom Backdoor.Turn malware to hide C2 traffic in Microsoft Teams relays

Dragonforce publishes new victim: Ink

Dragonforce publishes Cheoy Lee Shipyards as ransomware victim

Dragonforce publishes Al Ishrak Contracting as ransomware victim

Dragonforce claims Corniche Hotel Abu Dhabi victim on ransomware.live leak site

Dragonforce claims new victim: A. Liberty Engineering Co. Ltd

Dragonforce publishes Al Shafar GRC as ransomware victim

Dragonforce publishes Durrat Resort Management as ransomware victim

Dragonforce publishes Areco Steel as ransomware victim

Dragonforce claims Hong Kong Parkview serviced apartments breach

Dragonforce publishes Astec Valves & Fittings as ransomware victim

Dragonforce ransomware gang publishes Cekok as new victim

Dragonforce claims Brian Cox as ransomware victim

ThreatsDay Bulletin: Weekly threat roundup covering infostealers, supply chain attacks, AI security risks, and endpoint defense evasion

Dragonforce publishes Sayre Associates as ransomware victim

Dragonforce publishes REHA-ACTIV as ransomware victim

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

Dragonforce publishes Copamex as ransomware victim

Dragonforce claims SETS Solutions victim on ransomware.live

Dragonforce publishes Synex International Pvt Ltd as ransomware victim

Dragonforce publishes Taos Mountain Casino as ransomware victim

Dragonforce publishes Panorama BPO as ransomware victim

Dragonforce claims Shoreline Sightseeing victim on ransomware.live

Dragonforce publishes Henry Molded Products as ransomware victim

Dragonforce claims President Container Group as new ransomware victim