DragonForce and RansomHub: The “Godfather” of Ransomware Gangs Calls for Cooperation and Coordination

Ransomware Gangs Shift to Cartel-Like Operations, Led by DragonForce

The global ransomware landscape is undergoing a major transformation as cybercriminal groups adopt a cartel-like model, prioritizing collaboration over competition to strengthen attacks and ensure long-term survival. At the forefront of this shift is DragonForce, a ransomware group that emerged in 2023 and is now evolving into a highly organized criminal enterprise.

Research by LevelBlue, a Texas-based cybersecurity firm, reveals that DragonForce is actively recruiting affiliates by offering extensive infrastructure and operational support. Rather than operating as a traditional ransomware gang, the group positions itself as a service provider, lowering the technical barrier for newcomers while expanding its reach. Affiliates retain independence in developing and deploying ransomware but must share a portion of profits with DragonForce in exchange for access to petabytes of data storage, server monitoring, decryption tools, and attack testing environments.

Beyond basic ransomware-as-a-service (RaaS) offerings, DragonForce provides data audit services, allowing affiliates to assess the financial value of stolen data before launching double-extortion attacks threatening both encryption and public leaks. This model enhances the efficiency and profitability of cybercrime operations.

Recent intelligence, including a July 2025 report by Check Point Research, places DragonForce among the top ransomware groups, trailing only Akira and Qilin. The group has also engaged in aggressive tactics against rivals, including website defacements and member poaching, earning a reputation as both dominant and predatory. Some observers have dubbed DragonForce the "Godfather" of ransomware gangs, a title reinforced after rival group RansomHub accused it of collaborating with Russia’s FSB to suppress competition a claim that highlights the blurred lines between cybercrime and geopolitics.

As ransomware operations grow more centralized and sophisticated, international law enforcement agencies including those in the U.S., U.K., Italy, Germany, and Australia are facing increased pressure to dismantle these emerging cybercrime cartels before they solidify into an even more entrenched threat.

Source: https://www.cybersecurity-insiders.com/the-godfather-of-ransomware-gangs-calls-for-cooperation-and-coordination/

Flashpoint cybersecurity rating report: https://www.rankiteo.com/company/flashpoint-intel

Drakontas LLC cybersecurity rating report: https://www.rankiteo.com/company/drakontas-llc

"id": "FLADRA1770281021",
"linkid": "flashpoint-intel, drakontas-llc",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'data_breach': {'data_encryption': True,
                 'data_exfiltration': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Stolen data for extortion',
                                              'Sensitive corporate data']},
 'date_publicly_disclosed': '2025-07',
 'description': 'The global ransomware landscape is undergoing a major '
                'transformation as cybercriminal groups adopt a cartel-like '
                'model, prioritizing collaboration over competition to '
                'strengthen attacks and ensure long-term survival. '
                'DragonForce, a ransomware group that emerged in 2023, is '
                'evolving into a highly organized criminal enterprise, '
                'offering extensive infrastructure and operational support to '
                'affiliates while engaging in aggressive tactics against '
                'rivals.',
 'impact': {'data_compromised': True},
 'motivation': ['Financial gain', 'Geopolitical influence'],
 'ransomware': {'data_encryption': True,
                'data_exfiltration': True,
                'ransomware_strain': 'DragonForce'},
 'references': [{'source': 'LevelBlue'},
                {'date_accessed': '2025-07', 'source': 'Check Point Research'}],
 'threat_actor': 'DragonForce',
 'title': 'Ransomware Gangs Shift to Cartel-Like Operations, Led by '
          'DragonForce',
 'type': 'Ransomware'}