DragonForce is taking cues from organized crime, emphasizing cooperation and coordination among ransomware gangs.
February 4, 2026 By Jai Vijayan
The operators of DragonForce, a ransomware-as-a-service outfit that first surfaced in 2023, appear to be drawing heavily from the organized crime playbook, creating a cartel and attempting to bring mafia-style territorial organization — and a bit of muscle — to the ransomware ecosystem.
A detailed analysis by LevelBlue showed the group has recently shifted its business model to one where customers — or affiliates — of its service can create their own brands while still operating under a blossoming DragonForce cartel umbrella.
An Expanding Cartel
Member groups are free to operate independently while also having access to DragonForce's considerable resources and services, which include petabytes of storage, 24/7 server monitoring, professional file analysis and decryption services, and even help conducting dry runs and test attacks.