# DragonForce: White-Label Ransomware Cartel — Scattered Spider Partnership & MSP Supply Chain Attacks

> DragonForce is an evolving ransomware operation that emerged in 2023 and rebranded in 2025 as a 'ransomware cartel' offering a white-label Ransomware-as-a-Service model where affiliates can deploy rebranded versions of the DragonForce encryptor under their own brand identity. The group takes 20% of paid ransoms (lower than the industry standard ~30%), offering affiliates infrastructure, negotiation tools, data storage, and encryptors for ESXi, NAS, BSD, and Windows — without the overhead of maintaining their own infrastructure. DragonForce's most significant development is its partnership with Scattered Spider, the English-speaking threat collective known for elite social engineering, SIM swapping, and MFA fatigue attacks. This partnership enabled devastating attacks on UK retailers Marks & Spencer (DragonForce ransomware deployed after Scattered Spider initial access) and Co-op (6.5M member records stolen, $107M operating loss). DragonForce also conducted an MSP supply chain attack via SimpleHelp RMM vulnerabilities (CVE-2024-57727/57728/57726), encrypting downstream customer systems. The group initially used the leaked LockBit 3.0 builder and later transitioned to modified Conti v3 source code, exploiting vulnerable drivers (truesight.sys, rentdrv2.sys) to disable security tools.

- **Published:** 2026-02-12T06:35:00Z
- **Last reviewed:** 2026-02-12T06:35:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0072
- **ID:** TL-2026-0072
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DragonForce (Malaysia)
- **Detections:** 12 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-57727, CVE-2024-57728, CVE-2024-57726

## Description

DragonForce represents the EVOLUTION of the Ransomware-as-a-Service business model — from traditional affiliate programs to a 'cartel' marketplace where multiple ransomware brands operate under shared infrastructure. This is Ransomware-as-a-Platform.

FROM RAAS TO RANSOMWARE CARTEL:
In March 2025, DragonForce announced its 'new direction': a white-label RaaS model where affiliates create 'their own brand under the auspices of an already proven partner.' The model works as a marketplace:
- Affiliates choose to deploy attacks under the DragonForce brand OR their own custom brand
- DragonForce provides infrastructure: encryptors, negotiation tools, data leak sites, storage
- Affiliates don't manage infrastructure, develop malware, or handle negotiations
- DragonForce takes 20% (vs industry standard ~30%), making it cost-competitive
- The group aims to manage 'unlimited brands' across ESXi, NAS, BSD, and Windows
- RansomBay is the first publicly known subscriber to the white-label model

SCATTERED SPIDER PARTNERSHIP:
DragonForce's most consequential development is its partnership with Scattered Spider (UNC3944/Octo Tempest), an English-speaking threat collective known for:
- Advanced social engineering: persona creation using OSINT, impersonation calls
- SIM swapping and MFA fatigue/bombing to bypass authentication
- Sophisticated initial access: credential theft, device registration for persistence
- RMM tool deployment: ScreenConnect, AnyDesk, TeamViewer, Splashtop
- AWS Systems Manager Inventory for lateral movement discovery
- Data exfiltration to MEGA or Amazon S3 via ETL tools

This partnership creates a 'better together' model: Scattered Spider's elite social engineering provides initial access, and DragonForce's RaaS infrastructure handles encryption and extortion.

HIGH-PROFILE ATTACKS:
- **Marks & Spencer (M&S):** Scattered Spider provided initial access via social engineering ('sophisticated impersonation attack'), followed by DragonForce ransomware deployment. Confirmed by M&S in July 2025.
- **Co-op (UK retailer):** 6.5 million member records stolen. $107 million operating loss (£80M). Attack shut down systems and caused food shortages.
- **MSP Supply Chain Attack:** Sophos investigated DragonForce breaching an MSP via SimpleHelp RMM vulnerabilities (CVE-2024-57727, CVE-2024-57728, CVE-2024-57726), then using SimpleHelp to enumerate customer environments, steal data, and deploy encryptors on downstream systems. One customer protected by Sophos; others encrypted.
- **Ohio Lottery:** 538,000 individuals impacted.

TECHNICAL EVOLUTION:
- Initially used leaked LockBit 3.0 builder for encryptor development
- Transitioned to modified Conti v3 source code (addressing documented vulnerabilities)
- Exploits vulnerable drivers (truesight.sys, rentdrv2.sys) for BYOVD attacks — disabling security products, shutting down protected processes
- Fixed encryption vulnerabilities that were linked to Akira ransomware and documented in a Habr publication
- Cross-platform: Windows, Linux, ESXi, NAS, BSD

OPERATIONAL PHILOSOPHY:
DragonForce claims to follow a 'moral compass' — refusing to attack cancer or cardiac healthcare facilities ('We don't attack cancer patients or anything heart related... I didn't come here to kill people'). However, they target other healthcare organizations and have strict affiliate rules enforced through infrastructure control ('everything we run is on our servers').

STRATEGIC SIGNIFICANCE:
DragonForce represents the 'cartelization' of cybercrime — specialized threat actors combining skills rather than competing. Scattered Spider provides elite social engineering; DragonForce provides infrastructure and malware. This collaborative model is more effective than either group operating alone. Secureworks notes the model 'may appeal to a wider range of affiliates and attract less technical threat actors,' lowering the barrier to entry for ransomware operations.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1133 External Remote Services
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1621 Multi-Factor Authentication Request Generation
- T1003 OS Credential Dumping
- T1018 Remote System Discovery
- T1526 Cloud Service Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1596 Search Open Technical Databases
- T1585 Establish Accounts
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1580 Cloud Infrastructure Discovery
- T1570 Lateral Tool Transfer
- T1039 Data from Network Shared Drive
- T1071 Application Layer Protocol
- T1485 Data Destruction
- T1587 Develop Capabilities
- T1199 Trusted Relationship
- T1569 System Services
- T1543 Create or Modify System Process

## Sources

- [BleepingComputer: DragonForce expands ransomware model with white-label branding scheme](https://www.bleepingcomputer.com/news/security/dragonforce-expands-ransomware-model-with-white-label-branding-scheme/)
- [BleepingComputer/Acronis: Deep dive into DragonForce and Scattered Spider connection](https://www.bleepingcomputer.com/news/security/deep-dive-into-dragonforce-ransomware-and-its-scattered-spider-connection/)
- [BleepingComputer: DragonForce abuses SimpleHelp in MSP supply chain attack](https://www.bleepingcomputer.com/news/security/dragonforce-ransomware-abuses-simplehelp-in-msp-supply-chain-attack/)
- [Sophos: DragonForce targets SimpleHelp vulnerabilities for MSP customer attacks](https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/)
- [Secureworks: Ransomware Groups Evolve Affiliate Models](https://www.secureworks.com/blog/ransomware-groups-evolve-affiliate-models)
- [BleepingComputer: M&S confirms social engineering led to DragonForce ransomware attack](https://www.bleepingcomputer.com/news/security/mands-confirms-social-engineering-led-to-massive-ransomware-attack/)
- [BleepingComputer: Co-op $107M loss from Scattered Spider/DragonForce attack](https://www.bleepingcomputer.com/news/security/co-op-says-it-lost-107-million-after-scattered-spider-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0072