A ransomware group named DragonForce has started behaving very differently from other cybercriminal gangs. Instead of operating quietly or competing with rivals, the group is trying to take control of the ransomware ecosystem. Security researchers say DragonForce wants to act like a central authority, similar to how crime bosses run organized cartels. This unusual move has raised serious concerns in the cybersecurity world.
DragonForce first appeared in 2023 as a normal ransomware-as-a-service group. In this model, the main gang provides malware and tools while affiliates carry out attacks for a share of the money. Over time, DragonForce shifted its focus from simple attacks to building long-term influence. Its goal now is not just ransom payments, but control over how ransomware groups operate.
The group is pushing a cartel-style system, where multiple ransomware gangs cooperate instead of competing. DragonForce offers shared infrastructure, technical support, and attack tools to smaller groups. Affiliates are even allowed to use their own branding while still being part of the larger network. This approach is designed to attract more cybercriminals and expand DragonForce’s reach.
Security experts warn that this cartel idea could make ransomware attacks more dangerous. When groups share knowledge, tools, and access methods, attacks become faster and harder to detect. Defenders may face repeated attacks using similar techniques across different targets. This coordination could also lead to more frequent and larger ransom demands.
DragonForce has also shown aggressive behavior toward rival ransomware groups. Researchers have observed cases where it targeted or harassed competitors who refused to cooperate. In some situations, the group reportedly disrupted rival infrastructure to pressure them into joining. This behavior supports claims that DragonForce wants to act like a “Godfather” figure in cybercrime.
Another worrying factor is DragonForce’s partnerships with other criminal groups. Some affiliates specialize in social engineering and gaining initial access to corporate networks. By working together, these groups can breach systems more easily and deploy ransomware faster. This division of roles increases the success rate of attacks.
To attract more affiliates, DragonForce reportedly offers a very high profit share. Affiliates can keep most of the ransom money, while DragonForce takes a smaller cut. This strategy helps the group grow quickly and strengthens its cartel structure. More affiliates also mean more attacks across different industries and regions.
Cybersecurity experts believe this trend could change the future of ransomware. A coordinated cartel is harder to disrupt than isolated gangs. Organizations are being urged to improve security, monitor networks closely, and maintain strong backups. The rise of DragonForce shows that ransomware is becoming more organized, strategic, and dangerous than ever before.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
