DragonForce

Government sources say less about DragonForce than about older groups, and this page keeps to what they state. The main source is a joint advisory on Scattered Spider (AA23-320A), written by the FBI, CISA, the Royal Canadian Mounted Police, Australia’s Cyber Security Centre and Federal Police, the Canadian Centre for Cyber Security and the UK’s NCSC. It was first published on November 16, 2023 and revised 29 July 2025 with tactics from FBI investigations as recently as June 2025.

What the advisory says

The July 2025 update says, “per trusted third parties”, that Scattered Spider actors typically steal data for extortion and use several ransomware variants, most recently deploying DragonForce. The advisory’s malware list describes DragonForce as ransomware that infiltrates networks, encrypts data and demands a ransom. In the section on newer incidents it says the actors may have deployed it onto targeted organizations’ networks, encrypting ESXi servers, which run virtual machines. Encrypting those hosts can take down many systems at once.

How the actors who used it get in

The advisory describes Scattered Spider as a cybercriminal group that targets large companies and their contracted IT help desks. It began with broad phishing and text-message lures and now uses more targeted, multilayered spearphishing and voice phishing, known as vishing. In some cases the actors purchase employee or contractor credentials on illicit marketplaces. In others they compromise third-party services that have access to several organizations. These steps describe Scattered Spider, not DragonForce on its own.

UK retail in 2025

The NCSC’s 2025 annual review says the high-profile attacks by the DragonForce ransomware group left customers of a UK retailer unable to make payments and saw the data of all 6.5 million of its members stolen. It says the sight of empty shelves was a stark reminder of the operational and financial impact of ransomware. The NCSC also writes that ransomware by financially motivated criminals remains the most immediate, disruptive threat to critical national infrastructure sectors. The review names the group in connection with these attacks. For the wider public record, see the incident profile on the 2025 UK retail attacks. The CISA advisory does not name any UK retailer. The sources opened here do not describe arrests or a takedown of DragonForce.

Tools that disable security software

An August 16, 2025 advisory from the Cyber Security Agency of Singapore lists DragonForce among eight ransomware groups using a tool that disables endpoint detection and response (EDR) products. The agency says this lets operators bypass traditional endpoint defenses. It advises enforcing kernel mode code signing, using EDR products that resist termination, applying updates promptly and monitoring for suspicious attempts to stop security processes.

What CISA recommends

The Scattered Spider advisory recommends maintaining offline backups stored separately and tested regularly, enabling phishing-resistant MFA (FIDO or PKI-based), and applying application controls. It maps the actor’s activity to MITRE techniques including Phishing (T1566), Multi-Factor Authentication Request Generation (T1621), Remote Access Tools (T1219), Data Encrypted for Impact (T1486) and Exfiltration to Cloud Storage (T1567.002). These techniques describe Scattered Spider as a whole, not DragonForce on its own.

The July 2025 advisory update says Scattered Spider actors typically steal data for extortion and also use several ransomware variants. It lists DragonForce as ransomware that infiltrates networks, encrypts data and demands a ransom. It adds that the actors may have deployed it to encrypt VMware ESXi servers.