Dragonforce

☆ pin

Also known as DragonForce, Hackledorb

Reports

173

First seen

Sep 8, 2025

Last seen

Oct 17, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×27 Professional Services ×19 Other ×16 Technology ×12 Retail & E-commerce ×11 Healthcare ×10 Hospitality ×8 Financial Services ×7

Victim regions

×3

×43

United States×43

United Kingdom×7

United Arab Emirates×5

Canada×5

Brazil×4

India×4

Italy×3

Hong Kong SAR China×3

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×13T1566 Phishing ×10T1190 Exploit Public-Facing Application ×10T1078 Valid Accounts ×7T1562.001 Impair Defenses: Disable or Modify Tools ×6T1219 Remote Access Software ×6T1068 Exploitation for Privilege Escalation ×6T1059 Command and Scripting Interpreter ×5T1110 Brute Force ×5T1021 Remote Services ×5T1195 Supply Chain Compromise ×4T1133 External Remote Services ×4

Indicators

domain ×339filename ×123cve ×120ip_v4 ×114hash_md5 ×44hash_sha1 ×27hash_sha256 ×20registry_key ×5email ×4url ×2bitcoin_address ×1

Indicator values are available on Pro and via the API.

Recent reports

Critical

Dragonforce

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Dragonforce publishes Oak Grove Tech as ransomware victim

Dragonforce publishes Lane Equipment as ransomware victim

Dragonforce publishes Lane Equipment as ransomware victim

Dragonforce publishes Canadian Mennonite University as ransomware victim

Dragonforce publishes TQC S.A. on ransomware.live

Dragonforce publishes TEXMA International Co., Ltd as ransomware victim

Dragonforce publishes Petrosul Distribuidora as ransomware victim

Dragonforce publishes Réso as new ransomware victim

Dragonforce ransomware gang publishes WinFashion Technologies data leak

Dragonforce publishes Arizona Vascular Medical Equipment, Inc as ransomware victim

Dragonforce publishes BMGP Groupe as ransomware victim

Dragonforce claims new victim: Elite Industech Co., Ltd

Dragonforce publishes HEC Group breach; alleges false disclosure statement

Dragonforce publishes ARS Renacer health insurance company data leak

DragonForce publishes Medical Department Store as ransomware victim

Dragonforce publishes RubberMill, Inc. breach—OEM manufacturer with defense contracts

Dragonforce publishes Homewood Sales as new ransomware victim

Dragonforce publishes Norwood Law Firm as ransomware victim

Dragonforce publishes Frato as new ransomware victim

Dragonforce ransomware gang publishes CRIBA construction company data

Dragonforce published new victim: Brookview Financial

Dragonforce publishes Wozair as ransomware victim

Dragonforce claims victim: Hogan Omidi P.C., Denver-based family law firm

Dragonforce claims R & D Machine and Engineering ransomware victim

Ransom Busters: Ransomware Affiliate Impersonates Data Recovery Service, Extorting Victims

Dragonforce claims Vermont XCenter ransomware attack

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Dragonforce publishes GB Group S.A as ransomware victim

Dragonforce publishes Quest Personal Care Global as ransomware victim

Weekly Security Recap: AI Model Poisoning, Metabase 0-Day, Supply-Chain Worms, and Router Backdoors