[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1zc8_KOhHvUWRqjc3CS3mHsOvj1E-00DTKn7fe_IanQ":3,"$faBhBPgqhpEGapQ_SKxaOnu2adY58edppxkZFof4ap8k":109},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":106,"created_at":107,"updated_at":108,"published_at":33},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","AhnLab ASEC's dark web roundup for week 3 of July 2026 lists a DragonForce claim against a Saudi Arabian chemical manufacturer.","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[10,11,12,13,14],"DragonForce","Ransomware","Saudi Arabia","Chemical Manufacturing","ASEC","# DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer\n\n*AhnLab ASEC's dark web roundup for week 3 of July 2026 lists a DragonForce claim against a Saudi Arabian chemical manufacturer.*\n\n**Tags:** `DragonForce` `Ransomware` `Saudi Arabia` `Chemical Manufacturing` `ASEC`\n\n> DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.\n\n---\n\n## The claim\n\nAhnLab's ASEC team included \"DragonForce Ransomware Attack on a Saudi Arabian Chemical Manufacturer\" in its Ransom & Dark Web Issues roundup for week 3 of July 2026, published on 16 July. The entry reflects a listing on DragonForce's leak site. We have found no statement from the company, and no independent confirmation of what, if any, data was taken.\n\nIt is not the first time DragonForce has claimed a Saudi victim. Daily Security Review reports that in February 2025 the group claimed to have exfiltrated more than 6 TB of data from a Riyadh real estate and construction firm, timed the leak before Ramadan, and published the data after the victim refused to pay.\n\n## How active is DragonForce?\n\nTrackers count ransomware claims differently, so their figures should not be mixed:\n\n| Tracker | Q1 2026 | Q2 2026 | Notes |\n|---|---|---|---|\n| Dragos (industrial claims) | 45 | 76 | Fourth in Dragos's Q2 group list, behind Qilin, Akira and The Gentlemen |\n| Brandefense (all claims) | 101 | 144 | Rank 4 in Q2, displacing IncRansom from the top five; 248 victims year to date through May 2026 |\n\nDragos also notes that DragonForce affiliates continued exploiting SimpleHelp vulnerabilities to reach managed service providers and, in some cases, their downstream customers.\n\n## How DragonForce operates\n\nAccording to BushidoToken, DragonForce affiliates are adept at targeting edge devices and remote access points, including Ivanti Connect Secure, Fortinet FortiOS and SonicWall SSL-VPN, and many incidents stem from brute forcing of RDP and SSL-VPN accounts. Affiliates regularly use Bring Your Own Vulnerable Driver (BYOVD) techniques to get past endpoint security and are known to target Veeam backup servers.\n\nBrandefense describes DragonForce as built on the leaked LockBit 3.0 builder, which became public in September 2022. Its encryptor self-deletes and includes a custom wiper, and a Linux variant targets ESXi datastores. Affiliates use batch scripts and PsExec to push the payload and 7-Zip to compress and split stolen data. The group also offers a data audit service that analyses stolen datasets over 300 GB to find the most valuable material for extortion.\n\nDragos reports that in Q2 2026 DragonForce activity introduced Backdoor.Turn, a custom Go-based remote access trojan that hides command-and-control traffic in Microsoft Teams TURN relay infrastructure.\n\n## Background\n\nDragonForce emerged in late 2023. Daily Security Review describes it as having evolved from a pro-Palestinian hacktivist collective into a financially motivated operation, and it threatens victims with publication on its \"DragonLeaks\" leak site.\n\nIn the UK, the DragonForce ransomware was used in the April 2025 attacks on Marks & Spencer and the Co-op, which BushidoToken attributes to affiliates linked to Scattered Spider. Harrods was also attacked in May 2025, though Daily Security Review notes there is no official confirmation linking DragonForce to that incident.\n\nIn early 2025 DragonForce took over RansomHub's operation. Trend Micro reports that RansomHub's leak site went dark on 31 March 2025, DragonForce had commandeered its infrastructure by 8 April, and DragonForce then announced that RansomHub had \"joined the cartel\". RansomHub is now considered inactive.\n\n## Key points\n\n- DragonForce claims an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's roundup of 16 July 2026; the claim is unverified.\n- Dragos counts 76 DragonForce claims in Q2 2026 (45 in Q1); Brandefense counts 144 victims in Q2 (101 in Q1).\n- Affiliates target edge devices and RDP\u002FSSL-VPN accounts and use BYOVD to evade endpoint security.\n- Dragos links Q2 2026 DragonForce activity to Backdoor.Turn, which uses Microsoft Teams TURN relays for command and control.\n- DragonForce previously claimed a Riyadh real estate firm in February 2025; its best-known attacks were on UK retailers in April 2025.\n\n## Further reading & sources\n\n- [Ransom & Dark Web Issues Week 3, July 2026](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F94494\u002F) (AhnLab ASEC)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026) (Dragos)\n- [Top 5 Ransomware Groups in Q2 2026](https:\u002F\u002Fbrandefense.io\u002Fblog\u002Ftop-5-ransomware-groups-q2-2026) (Brandefense)\n- [UK Cybercrime Journal: Sustained DragonForce Campaign](https:\u002F\u002Fblog.bushidotoken.net\u002F2026\u002F06\u002Fuk-cybercrime-journal-sustained.html) (BushidoToken)\n- [DragonForce Ransomware: Hacktivist Turned Cybercriminal Enterprise](https:\u002F\u002Fdailysecurityreview.com\u002Fresources\u002Fthreat-actors-resources\u002Fdragonforce-ransomware-hacktivist-turned-cybercriminal-enterprise) (Daily Security Review)\n- [Ransomware Spotlight: RansomHub](https:\u002F\u002Ftrendmicro.com\u002Fvinfo\u002Fus\u002Fsecurity\u002Fnews\u002Fransomware-spotlight\u002Fransomware-spotlight-ransomhub) (Trend Micro)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf",{"iocs":18,"actors":22,"malware":57,"targets":63,"timeline":69,"industries":82,"technologies":86},[19],{"type":20,"value":21},"other","DragonLeaks",[23,29,34,38,42,47,53],{"url":24,"name":25,"slug":25,"type":26,"origin":27,"motivation":28},"\u002Fthreat-groups\u002Fdragonforce","dragonforce","ransomware","Unknown; hacktivist origins (possible Malaysia) evolving to a financially motivated Russia-nexus RaaS","financial",{"url":30,"name":31,"slug":32,"type":26,"origin":33,"motivation":28},"\u002Fthreat-groups\u002Fransomhub","RansomHub","ransomhub",null,{"url":35,"name":36,"slug":36,"type":26,"origin":37,"motivation":28},"\u002Fthreat-groups\u002Fqilin","qilin","Russia \u002F Russian-speaking (excludes CIS countries from targeting)",{"url":39,"name":40,"slug":41,"type":26,"origin":33,"motivation":28},"\u002Fthreat-groups\u002Fthegentlemen","The Gentlemen","thegentlemen",{"url":43,"name":44,"slug":45,"type":26,"origin":46,"motivation":28},"\u002Fthreat-groups\u002Fakira","Akira","akira","Russia (suspected; overlaps with Conti)",{"url":48,"name":49,"slug":50,"type":51,"origin":52,"motivation":28},"\u002Fthreat-groups\u002Fscattered-spider","Scattered Spider","scattered-spider","cybercrime","United States and United Kingdom (native English-speaking members)",{"url":54,"name":55,"slug":56,"type":26,"origin":33,"motivation":33},"\u002Fthreat-groups\u002Factor","Владивосток","actor",[58,60,62],{"name":59},"Backdoor.Turn",{"name":61},"DragonForce Ransomware",{"name":10},[64],{"name":65,"sector":66,"status":67,"geography":68},"Marks & Spencer","retail","confirmed","UK",[70,74,78],{"date":71,"event":72,"description":73},"2025-03-20","Deface","BlackLock DLS defaced by DragonForce",{"date":75,"event":76,"description":77},"2025-04","Attack","DragonForce attack on Marks and Spencer causing significant retail disruption.",{"date":79,"event":80,"description":81},"2025-06","Notable use","DragonForce used by Scattered Spider to attack M&S, Co-op, Harrods",[83],{"url":84,"name":85,"slug":66},"\u002Findustries\u002Fretail","Retail",[87,90,93,96,99,100,103],{"vendor":88,"product":89},"Veeam","Backup & Replication",{"vendor":91,"product":92},"Fortinet","FortiGate",{"vendor":94,"product":95},"SimpleHelp","RMM",{"vendor":97,"product":98},"Huawei","driver",{"vendor":91,"product":91},{"vendor":101,"product":102},"Ivanti","Connect Secure",{"vendor":104,"product":105},"VMware","ESXi","ransomware_incident","2026-09-19T12:09:53.129912+00:00","2026-10-16T12:28:23.994995+00:00",{"articles":110},[111,122,133,145],{"slug":112,"title":113,"summary":114,"tags":115,"hero_image_url":120,"story_type":106,"created_at":121},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[116,117,118,11,119],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":123,"title":124,"summary":125,"tags":126,"hero_image_url":131,"story_type":106,"created_at":132},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day","In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.",[127,128,129,11,130],"Interlock","Cisco FMC","CVE-2026-20131","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00",{"slug":134,"title":135,"summary":136,"tags":137,"hero_image_url":143,"story_type":106,"created_at":144},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.",[138,139,11,140,141,142],"CISA","Gunra","FortiOS","FortiProxy","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","2026-08-27T17:06:47.703652+00:00",{"slug":146,"title":147,"summary":148,"tags":149,"hero_image_url":152,"story_type":153,"created_at":154},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[139,150,151,140,141,11],"AhnLab ASEC","Operation Double Barrel","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","threat_actor_activity","2026-09-18T07:15:06.272711+00:00"]