DragonForce’s Battle for Ransomware Dominance

According to a recent Sophos study, DragonForce is locked in a tense rivalry with other ransomware gangs. Their aim? To assert dominance in the shadowy world of cybercrime. In March 2025, DragonForce shook things up by disrupting RansomHub’s operations, which led to a decline in ransomware incidents in April. Some speculate this was a bold attempt at a “hostile takeover.”

In a strategic move, DragonForce rebranded itself as a cartel, enhancing its stance in the ransomware-as-a-service (RaaS) sector. This shift allows affiliates to use DragonForce’s infrastructure while marketing under their brands, marking a bid for wider influence. Earlier this year, the group launched “RansomBay,” a platform where affiliates can rebrand ransomware and retain 80% of their takings, with DragonForce managing core infrastructure and demanding a 20% cut.

Rampant Rivalries and Aggressive Tactics

Since March, Sophos researchers have observed several leak site defacements belonging to Mamona and BlackLock, now marked by DragonForce branding. These actions speak volumes, conveying a direct challenge to competitors.

An initial message on RansomHub’s site hinted at a partnership with DragonForce, but the tone shifted when RansomHub declined to collaborate. After exchanges and turmoil, RansomHub’s site went offline, signaling a collapse. Meanwhile, signs of internal betrayal appeared as a RansomHub affiliate accused DragonForce of colluding with law enforcement.

The Fallout of Cyber Conflicts

DragonForce’s clashes with other groups reflect the turmoil in today’s ransomware landscape. This mirrors the past behavior of notorious groups like LockBit. With law enforcement bearing down on ransomware operators, distrust among cybercriminals is growing, creating a fragmented “post-trust ecosystem.”

Despite internal strife, organizations shouldn’t be complacent. Sophos warns that conflicts could spur increased and unpredictable attacks, urging businesses to bolster their response strategies, enhance threat intelligence, and improve risk management.

**Stay informed and secure. Visit Qsentinel for comprehensive cyber insights and updates.**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.