DragonForce
A ransomware operation that calls itself a cartel, offering affiliates tools and infrastructure to run their own brands. M&S has said it was hit with DragonForce ransomware, and Arete reported rising activity in 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The UK retail attacks of April 2025 made this name known here. M&S's chairman told a parliamentary hearing that M&S was hit with DragonForce ransomware and that attackers entered by social engineering a third party. The NCA arrested four people in the investigation into M&S, Co-op and Harrods, and its statement does not name DragonForce. Arrests are not convictions.5 The NCSC said at the time that it could not yet say whether the attacks were linked.6
The model spreads risk. Since March 2025 DragonForce has presented itself as a cartel, encouraging affiliates to build their own brands on its tools.2 That can make attribution by name unreliable, as an attacker may use its tools with little link to its core team.
Supply chain routes are a real concern. Sophos saw an attacker use an MSP's SimpleHelp RMM instance to reach several customers and deploy DragonForce, and it says it has medium confidence that three SimpleHelp flaws were chained.3 Symantec says one 2026 case hid command and control traffic inside Microsoft Teams relay infrastructure, so it looked like normal connections to Teams servers.1
How It Attacks
Combined from Trend,2 Sophos3 and Symantec.1 The cartel model means methods vary widely, so this is a pattern and not a fixed script.
- 1
Get In
Exploits public-facing appliances, uses valid accounts, or reaches customers through an MSP's RMM tool. Some intrusions are linked to social engineering by others.5
- 2
Discover
Uses AdFind, Advanced IP Scanner and RMM data about devices and users.
- 3
Take Credentials
Uses Mimikatz, LaZagne and registry hive dumps.
- 4
Blind the Defences
Uses vulnerable drivers to stop EDR and antivirus. Symantec describes a custom driver too.
- 5
Move and Hide
Uses PsExec, RDP, WMI, Cobalt Strike and SystemBC. In one case it used a custom backdoor over Teams relays.
- 6
Steal the Data
Moves data with MEGA, FTP or SFTP, and HTTP servers.
- 7
Encrypt
Uses variants for Windows, Linux, ESXi and NAS. The ESXi variant powers off VMs.
Key Techniques
ATT&CK v20 has no DragonForce entry. These follow Trend's mapping2 and Sophos's MSP case.3 We have updated IDs to v20 where needed.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Ivanti Connect Secure and other flaws. |
| T1078 | Valid Accounts | Initial Access | Compromised accounts. |
| T1199 | Trusted Relationship | Initial Access | Reaches customers through an MSP's RMM. |
| T1003.001 | LSASS Memory | Credential Access | Mimikatz. |
| T1685 | Disable or Modify Tools | Defense Impairment | Vulnerable drivers stop security tools. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | RDP for movement. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | MEGA. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts with per-file keys. |
Tools Observed
Discovery and Credentials
Movement and Control
Defence Evasion
Data Theft
From Trend,2 Symantec1 and Arete.4 Many tools are legitimate, so check whether a tool is approved.
Vulnerabilities
Named by Trend2 and Sophos.3 Affiliates differ, so this list is a guide.
If an MSP manages your systems, ask which RMM tools it runs and how quickly it patches them.
Key Events
Operations first observed. It builds encryptors from a leaked LockBit 3.0 builder, then Conti v3.2,8
Affiliate programme launched, offering 80% of proceeds.2
Announces a move to a cartel model.2
UK retail attacks and claims. At that point Google had not independently confirmed the involvement of Scattered Spider or DragonForce.7
Sophos publishes its MSP case.3
Four arrests in the retail investigation. M&S's chairman names DragonForce ransomware to Parliament.5
Offers affiliates a data analysis service.2
Arete sees increased activity in 2026 compared with 2025.4
Symantec reports abuse of Microsoft Teams relays in an attack with activity from December 2025.1
Warning Signs
From Sophos,3 Symantec1 and Trend.2 None proves an attack alone.
- Unexpected installers pushed through an MSP's RMM tool
- New users, groups or firewall rules on servers
- A known-vulnerable driver loaded, followed by security tools stopping
- A legitimate program in an unusual location loading a new DLL
- ESXi hosts powering off VMs without a change record
Defences That Matter
Hold Your MSP to a Standard
- Ask your MSP to confirm how its RMM tools are patched and protected.
- Monitor pushes from RMM tools as well as local activity.3
Secure the Help Desk
- Review how staff verify identity before resetting passwords or MFA, especially for privileged accounts.6
- Monitor unusual logins, including from VPN services on residential IP ranges.6
Stop Tampering
- Block known vulnerable drivers with your endpoint controls.
- Protect EDR agents against tampering. Sophos's EDR blocked encryption on one client.3
Plan Beyond Prevention
- Plan for detection, containment, response and recovery, not just prevention.6
- Include ESXi and NAS systems in recovery tests.
Could Your MSP Be the Way In?
We can review your supplier access and your response plans against the methods in this profile, and then help you close the gaps.
Sources
- Symantec and Carbon Black Threat Hunter Team: Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden, 16 June 2026
- TrendAI Research: Ransomware Spotlight: DragonForce, 29 October 2025
- Sophos: DragonForce actors target SimpleHelp vulnerabilities to attack MSP customers, 2025
- Arete: Ransomware Trends and Data Insights, April 2026, 4 May 2026
- Help Net Security: Four arrested in connection with M&S, Co-op ransomware attacks, 10 July 2025
- NCSC: Incidents impacting retailers, recommendations from the NCSC, 4 May 2025
- Infosecurity Magazine: Inside DragonForce, the Group Tied to M&S, Co-op and Harrods Hacks, 6 May 2025
- Acronis TRU: The DragonForce Cartel: Scattered Spider at the gate, 4 November 2025
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.