Quick Summary
Ransomware gangs are shifting towards a cartel-like model, with DragonForce leading this evolution. This group, which began operating in 2023, is actively recruiting newcomers and providing extensive support to affiliates. DragonForce’s tactics include promoting double-extortion attacks and collaborating with other criminal entities, raising concerns about the future of cybersecurity and law enforcement’s ability to combat these organized cybercrime networks.
The Securityish Brief
DragonForce, a ransomware group that emerged in 2023, is transforming the cybercrime landscape by adopting a cartel-like model. This shift allows them to cooperate with other gangs rather than compete, enhancing their operational strength and sustainability. Research from LevelBlue indicates that DragonForce is not only recruiting new members but also offering them extensive infrastructure and support, effectively lowering the barriers to entry for aspiring cybercriminals.
As part of its strategy, DragonForce allows affiliates to operate independently, developing their own ransomware variants while sharing a portion of their profits with the group. This model resembles ransomware-as-a-service operations but is more centralized and aggressive. Affiliates benefit from access to significant resources, including data storage and server monitoring, which enhances their attack capabilities.
Additionally, DragonForce has been promoting services on dark web forums that help affiliates assess the financial value of stolen data before launching double-extortion attacks. This tactic not only increases the potential profitability of their operations but also underscores the group’s influence within the ransomware ecosystem.
Recent intelligence suggests that DragonForce is now ranked just behind major groups like Akira and Qilin, indicating its growing prominence. The group has also engaged in aggressive tactics against rivals, such as website defacement and poaching members, solidifying its reputation as a dominant force in the cybercrime world.
The label of the “Godfather” of ransomware gangs has emerged for DragonForce, especially following accusations from rival group RansomHub of its collaboration with Russia’s Federal Security Service (FSB). This allegation highlights the complex interplay between cybercrime and geopolitics, raising alarms about the future of ransomware operations.
As ransomware evolves into a more coordinated criminal enterprise, the need for international law enforcement cooperation becomes critical. Agencies from the United States, the United Kingdom, Italy, Germany, and Australia must collaborate to dismantle these emerging cybercrime cartels, or risk facing a more entrenched and dangerous digital underworld.
Key Takeaways
- Monitor your systems for unusual activity that may indicate ransomware threats.
- Educate employees about the risks of ransomware and the importance of reporting suspicious emails.
- Implement robust backup solutions to ensure data can be restored in case of a ransomware attack.
- Consider investing in advanced cybersecurity solutions that can detect and mitigate ransomware attacks.
- Stay informed about the latest ransomware trends and tactics to better prepare your organization.
Key Terms & Concepts
- DragonForce: In this article, DragonForce refers to a ransomware group that has adopted a cartel-like model in cybercrime.
- ransomware-as-a-service: Ransomware-as-a-service is a model where ransomware developers provide tools and support to affiliates for a share of the profits.
- double-extortion attacks: Double-extortion attacks involve threatening victims with data encryption and public leaks of stolen data.
Read the original article here: https://www.cybersecurity-insiders.com/the-godfather-of-ransomware-gangs-calls-for-cooperation-and-coordination/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
