The creators of DragonForce, a ransomware-as-a-service group that first came to light in 2023, seem to be taking a cue from organized crime, forming a cartel, and trying to add some muscle and territorial organization akin to that of the mafia to the ransomware ecosystem This article explores creators dragonforce ransomware.

According to a thorough analysis conducted by LevelBlue, the group has recently changed its business model so that users of its service, or affiliates, can establish their own brands while still functioning under the auspices of the thriving DragonForce cartel.

A Growing Cartel In addition to having access to DragonForce's extensive resources and services—which include petabytes of storage, round-the-clock server monitoring, expert file analysis and decryption services, and even assistance with dry runs and test attacks—member groups are free to operate independently. A DragonForce "Company Data Audit" service is an extra perk of being a cartel member. It assists affiliates in determining the worth of any data they may have lost or encrypted during a ransomware attack, allowing them to determine the appropriate amount of pressure to apply to victims.

Related: One Click at a Time, Dark Patterns Threaten Security According to a report released this week by LevelBlue researchers Mark Tsipershtein and Evgeny Ananin, "the audit includes a detailed risk report, prepared communication materials, such as call scripts and executive-level letters, and strategic guidance designed to influence negotiations." DragonForce recently introduced an automated system that makes it simpler for new members to sign up. This system enables potential affiliates to sign up for the RaaS without having to pay any upfront fees or undergo the vetting that other RaaS operators frequently demand.

DragonForce poses the greatest threat to businesses in manufacturing, technology, business services, and construction in the US, UK, Italy, Germany, and Australia, according to its victimology to date.