DragonForce is a financially motivated ransomware operation that began in August 2023, initially leveraging leaked LockBit 3.0 code and later adopting Conti v3-based variants. It operates as a Ransomware-as-a-Service (RaaS) model, offering affiliates an 80% revenue share and management tools. By March 2025, it evolved into a cybercrime cartel providing white-label services. The group targets organizations primarily in the US and UK across sectors such as manufacturing, professional services, retail, healthcare, and technology. They recruit developers and reverse engineers and provide data analysis services to maximize extortion. A notable incident includes a major managed service provider (MSP) breach in May 2025 exploiting SimpleHelp vulnerabilities, leading to cascading compromises across client networks.
