Ransomware Intelligence

dragonforce Ransomware Group

Ransomware group profile

409Victims
MalaysiaSource country
109Impact score
Also Known As
Water Tambanakua

Description

DragonForce is a politically-motivated hacktivist group known for executing cyber attacks in response to geopolitical events. The group employs tactics such as website defacement, data leaks, and DDoS attacks, often targeting entities they ideologically oppose. Their operations are heavily publicized through social media to gain support and amplify their messages.

Key insights

  • Utilizes website defacement as a tactic to promote political messages.
  • Involved in data leaks and DDoS attacks against targeted entities.
  • Rapidly exploits newly disclosed vulnerabilities for conducting attacks.
  • Employs sophisticated phishing techniques for initial access.
  • Known for leveraging social media platforms to publicize their actions.
  • Uses multi-extortion techniques involving both ransomware and data exposure.
  • Originally emerged as a pro-Palestine group but evolved into a broader hacktivist campaign.

Threat Level & Status Breakdown

For dragonforce · Based on incidents in selected period

3.8threat level
Aggressiveness10/ 10
Lethality0.1/ 10
Criticality1.1/ 10

Status Breakdown

Data Leaked1.5%6
Claimed94.1%385
First seenJul 2025
Last seenJul 2026
Avg ransom
Payment rate
Statusactive
Sophistication0
Last updatedJul 19, 2026

Recent activity

Monthly attack count for dragonforce in the selected period

409Total attacks
65peak in Apr
31.5avg / month
↑ 26 vs first month
JulAugSepOctNovDecJanFebMarAprMayJunJul020406080

No intelligence data for this group.

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for dragonforce

CVE-2025-6264
CVE-2025-61155
CVE-2025-59287
CVE-2025-47176
CVE-2025-47171
CVE-2025-1055
CVE-2024-57728
CVE-2024-57727
CVE-2024-57726
CVE-2024-55591
CVE-2024-40766
CVE-2024-37085
CVE-2024-21893
CVE-2024-21887
CVE-2024-21762
CVE-2024-21412
CVE-2024-1709
CVE-2024-1708
CVE-2023-52271
CVE-2023-4966
CVE-2023-46805
CVE-2023-27997
CVE-2023-20269
CVE-2021-44228
CVE-2021-35464
CVE-2015-2291
Discovery

T1083

File and Directory Discovery

Execution

T1005.002

User Execution

Impact

T1486

Data Encrypted for Impact

Victims(200)

CompanyDomainCountryIndustryStatusDiscovered
NewNetnewnetsa.comSA Saudi ArabiaTechnology
Claimed
2 days ago
Sinai Grand Casinosinaigrandcasino.comEG EgyptHospitality
Claimed
4 days ago
Petrini Valorespetrini.com.arAR ArgentinaFinancial Services
Claimed
4 days ago
Kee Wah Bakerykeewah.comHK Hong KongOther
Claimed
4 days ago
Heritage Mechanical LLCheritagemechanical-llc.comUS United StatesProfessional Services
Claimed
5 days ago
Stephens Precisionstephensprecision.comUS United StatesManufacturing
Claimed
5 days ago
Shillen Mackall & Seldonpromotingjustice.comUS United StatesProfessional Services
Claimed
5 days ago
Hughes Atwood & Mullaly pllchsh-law.comUS United StatesProfessional Services
Claimed
5 days ago
North Atlantic Engineering Consultantsnorthatlantic.bwBW BotswanaProfessional Services
Claimed
4 days ago
Metro Design Centemetrodesigncenter.comMX MexicoRetail & E-Commerce
Claimed
4 days ago
Southport Outdoor Livingsouthportoutdoor.comGB United KingdomRetail & E-Commerce
Claimed
4 days ago
Graphic International Centregraphicint.comProfessional Services
Claimed
6 days ago
SITAV SpAsitav.euIT ItalyManufacturing
Claimed
6 days ago
Edison Global Networks Limitededisongn.comGB United KingdomTechnology
Claimed
6 days ago
Road Ahead Technologies Consultantratc.com.cnCN ChinaProfessional Services
Claimed
6 days ago
Ifageifage.chCH SwitzerlandProfessional Services
Claimed
6 days ago
Omax Autosomaxauto.comIN IndiaManufacturing
Claimed
6 days ago
Midal Cablesmidalcable.comAE United Arab EmiratesManufacturing
Claimed
6 days ago
Atcomatcomm.cnCN ChinaTechnology
Claimed
6 days ago
Intron Technology Holdingsintron-tech.comTW TaiwanTechnology
Unknown
6 days ago

Page 1 of 10