Full Report
DragonForce expanded its ransomware operation in 2025 by working with English-speaking hackers known for advanced social engineering and initial access. Acronis explains how the "Scattered Spider" collaboration enables coordinated, multistage intrusions across major environments. [...]
Analysis Summary
# Threat Actor: DragonForce (Ransomware Cartel)
## Attribution & Identity
DragonForce operates as a Ransomware-as-a-Service (RaaS) operation that rebranded in 2025 into a "ransomware cartel." It recruits affiliates by lowering the barrier to entry, offering 80% profit share, customizable encryptors, and infrastructure. DragonForce has been linked to the use of compromised LockBit 3.0 builder code initially, later transitioning to modified Conti v3 source code.
**Known Aliases and Associated Groups:**
* **Associated Group:** Scattered Spider (Collaboration partner providing initial access/social engineering).
* Emerged from activities previously linked to Akira ransomware vulnerabilities.
## Activity Summary
DragonForce emerged in 2023 but intensified operations significantly after rebranding as a "ransomware cartel" in 2025. They focus on coordinated, multistage intrusions leading to ransomware deployment. A prominent, high-profile breach involved the retail company Marks & Spencer, conducted in partnership with Scattered Spider. The group continuously evolves its ransomware variant, addressing previously documented encryption vulnerabilities (e.g., those documented on Habr).
## Tactics, Techniques & Procedures
The TTPs described primarily concern the collaboration between DragonForce and its access provider, Scattered Spider:
* **Initial Access/Reconnaissance:** Conducting reconnaissance on organizational staff via social media and OSINT to develop convincing personas.
* **Social Engineering:** Using advanced social engineering to obtain or reset credentials.
* **Authentication Bypass:** Circumventing MFA using tactics like MFA fatigue or SIM swapping.
* **Persistence:** Signing in as the compromised user and registering their own device post-access.
* **Persistence/Backdoors:** Deploying Remote Monitoring and Management (RMM) tools (e.g., ScreenConnect, AnyDesk, TeamViewer, Splashtop) or tunneling services.
* **Internal Reconnaissance:** Targeting assets such as SharePoint, credential repositories, backup servers, and VPN configuration documentation post-access.
* **Lateral Movement:** Leveraging tools like AWS Systems Manager Inventory to identify systems for expansion within the network.
* **Ransomware Execution:** Exploiting susceptible drivers (e.g., `truesight.sys`, `rentdrv2.sys`) to deactivate security programs, shut down protected processes, and fix encryption vulnerabilities before deployment.
* **Evolution:** Implementing updated encryption schemes that address known flaws.
## Targeting
* **Sectors:** Organizations worldwide; specifically mentioned targeting retail (Marks & Spencer).
* **Geography:** Worldwide targets ("organizations worldwide").
* **Victims:** Marks & Spencer (publicly confirmed breach via collaboration).
## Tools & Infrastructure
* **Malware Families Used:** DragonForce ransomware (initially used LockBit 3.0 builder, later modified Conti v3 source code).
* **Post-Access Tools:** ScreenConnect, AnyDesk, TeamViewer, Splashtop (RMM tools).
* **Infrastructure:** AWS Systems Manager Inventory used for reconnaissance/lateral movement.
* **Vulnerabilities Exploited:** Driver vulnerabilities in `truesight.sys` and `rentdrv2.sys`.
## Implications
The formation of the "ransomware cartel" signals a strategic shift by DragonForce to rapidly scale its operations by outsourcing initial access to sophisticated actors like Scattered Spider. This collaboration provides DragonForce reliable, high-quality access to major environments, enabling coordinated, multistage intrusions leveraging advanced social engineering techniques to bypass strong layered defenses (including MFA).
## Mitigations
* **MFA/Authentication Defense:** Implement robust policies to detect and block MFA fatigue and credential stuffing attempts. Harden processes for credential resets.
* **Driver Security:** Restrict the use or loading of unsigned or suspicious kernel drivers (like `truesight.sys` and `rentdrv2.sys`) to prevent security software tampering.
* **Endpoint Detection & Response (EDR) & AV:** Ensure security solutions are up-to-date and protected against tampering/disabling, addressing known vulnerabilities fixed in newer DragonForce variants.
* **Access Control:** Implement strict access controls and segmentation to limit lateral movement potential, even after initial compromise. Monitor for the unauthorized deployment of common RMM tools (ScreenConnect, AnyDesk, etc.).
* **OSINT & Phishing Awareness:** Conduct targeted security awareness training focusing on sophisticated social engineering tactics used by groups like Scattered Spider.