DragonForce is a ransomware-as-a-service operation that extorts victim organizations by encrypting data and threatening to leak stolen files.
UK Legal Aid Agency says about 250,000 records stolen in its April 2025 breach predate 2007, the oldest from 1978. The bulk of the data still falls between January 2007 and 16 May 2025, three years earlier than the 2010 start the agency confirmed in May.
Reality
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
GuidePoint says the persona offering to delete stolen data for $20,000 to $60,000 is very likely a ransomware affiliate, which makes the rescue fee a second payment to the same attacker.
Perspective Coverage
3 publishersReality
Black Kite's 2026 report locates the target set in the mid-market supplier layer that larger manufacturers buy from, and the Bank of England has already tied one carmaker's shutdown to a slowdown in UK growth figures.
Reality
Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.
Reality
Google places the spree with a single operator in South Africa, which makes one arrest plausible, while Palo Alto Networks counts three core members. Either way, the packages moved because almost nobody checks what they ingest.
Reality