The claim
AhnLab's ASEC team included "DragonForce Ransomware Attack on a Saudi Arabian Chemical Manufacturer" in its Ransom & Dark Web Issues roundup for week 3 of July 2026, published on 16 July. The entry reflects a listing on DragonForce's leak site. We have found no statement from the company, and no independent confirmation of what, if any, data was taken.
It is not the first time DragonForce has claimed a Saudi victim. Daily Security Review reports that in February 2025 the group claimed to have exfiltrated more than 6 TB of data from a Riyadh real estate and construction firm, timed the leak before Ramadan, and published the data after the victim refused to pay.
How active is DragonForce?
Trackers count ransomware claims differently, so their figures should not be mixed:
| Tracker | Q1 2026 | Q2 2026 | Notes |
|---|---|---|---|
| Dragos (industrial claims) | 45 | 76 | Fourth in Dragos's Q2 group list, behind Qilin, Akira and The Gentlemen |
| Brandefense (all claims) | 101 | 144 | Rank 4 in Q2, displacing IncRansom from the top five; 248 victims year to date through May 2026 |
Dragos also notes that DragonForce affiliates continued exploiting SimpleHelp vulnerabilities to reach managed service providers and, in some cases, their downstream customers.
How DragonForce operates
According to BushidoToken, DragonForce affiliates are adept at targeting edge devices and remote access points, including Ivanti Connect Secure, Fortinet FortiOS and SonicWall SSL-VPN, and many incidents stem from brute forcing of RDP and SSL-VPN accounts. Affiliates regularly use Bring Your Own Vulnerable Driver (BYOVD) techniques to get past endpoint security and are known to target Veeam backup servers.
Brandefense describes DragonForce as built on the leaked LockBit 3.0 builder, which became public in September 2022. Its encryptor self-deletes and includes a custom wiper, and a Linux variant targets ESXi datastores. Affiliates use batch scripts and PsExec to push the payload and 7-Zip to compress and split stolen data. The group also offers a data audit service that analyses stolen datasets over 300 GB to find the most valuable material for extortion.
Dragos reports that in Q2 2026 DragonForce activity introduced Backdoor.Turn, a custom Go-based remote access trojan that hides command-and-control traffic in Microsoft Teams TURN relay infrastructure.
Background
DragonForce emerged in late 2023. Daily Security Review describes it as having evolved from a pro-Palestinian hacktivist collective into a financially motivated operation, and it threatens victims with publication on its "DragonLeaks" leak site.
In the UK, the DragonForce ransomware was used in the April 2025 attacks on Marks & Spencer and the Co-op, which BushidoToken attributes to affiliates linked to Scattered Spider. Harrods was also attacked in May 2025, though Daily Security Review notes there is no official confirmation linking DragonForce to that incident.
In early 2025 DragonForce took over RansomHub's operation. Trend Micro reports that RansomHub's leak site went dark on 31 March 2025, DragonForce had commandeered its infrastructure by 8 April, and DragonForce then announced that RansomHub had "joined the cartel". RansomHub is now considered inactive.
Key points
- DragonForce claims an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's roundup of 16 July 2026; the claim is unverified.
- Dragos counts 76 DragonForce claims in Q2 2026 (45 in Q1); Brandefense counts 144 victims in Q2 (101 in Q1).
- Affiliates target edge devices and RDP/SSL-VPN accounts and use BYOVD to evade endpoint security.
- Dragos links Q2 2026 DragonForce activity to Backdoor.Turn, which uses Microsoft Teams TURN relays for command and control.
- DragonForce previously claimed a Riyadh real estate firm in February 2025; its best-known attacks were on UK retailers in April 2025.
Further reading & sources
- Ransom & Dark Web Issues Week 3, July 2026 (AhnLab ASEC)
- Industrial Ransomware Analysis for Q2 2026 (Dragos)
- Top 5 Ransomware Groups in Q2 2026 (Brandefense)
- UK Cybercrime Journal: Sustained DragonForce Campaign (BushidoToken)
- DragonForce Ransomware: Hacktivist Turned Cybercriminal Enterprise (Daily Security Review)
- Ransomware Spotlight: RansomHub (Trend Micro)