DragonForce

Profile narrative

DragonForce is a threat actor known by the alias DragonForce and has been identified as operating from Malaysia. The group describes itself as an anti‑Israeli, pro‑Palestinian hacker collective and has claimed responsibility for a range of cyber incidents targeting entities in multiple countries. Its activities have been observed against civil engineering firms, insurance brokers, municipal administrations, retail organizations, banking institutions and student recruitment platforms, indicating a broad sectoral focus that includes critical services, finance and education. Strategic objectives evident from the reported operations include financial gain through ransomware and data extortion, disruption via distributed denial‑of‑service attacks and the acquisition of sensitive data for potential leverage or sale.

The group’s tactics, techniques and procedures observed in open sources involve the deployment of ransomware that encrypts systems while exfiltrating large volumes of data, as seen in the attacks on Sayre Associates and Vercoe Insurance Brokers where over sixty gigabytes were claimed stolen. DragonForce also employs distributed denial‑of‑service campaigns, flooding target networks with traffic peaking at approximately two hundred megabits per second to disrupt online banking services in Israel. In the incident affecting the city of Baden, the actors reportedly exploited an older security vulnerability to gain access to a backup copy of a central administrative database before publishing the stolen citizen data on a dark web forum. Additionally, the group uses Telegram channels to announce intrusions and leak purported data sets, such as the personal details of hundreds of thousands of Israeli students taken from the AcadeME platform.

Representative campaigns attributed to DragonForce include a ransomware operation against the U.S.–based civil engineering firm Sayre Associates that resulted in the theft of client data, project files, internal emails and financial records; a sustained DDoS effort targeting Israeli bank websites in mid‑2021 that aimed to overwhelm public‑facing infrastructure and caused service slowdowns; and the breach of the Israeli student recruitment service AcadeME, where the group claimed to have compromised personal information of approximately 280 000 students and disseminated the data via Telegram. These incidents illustrate the actor’s reliance on ransomware for monetary extortion, DDoS for disruption and data theft for leverage, all carried out from a Malaysian base while pursuing an anti‑Israeli, pro‑Palestinian agenda.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 2 sources.