Dark Web Surge: Akira and DragonForce Ransomware Groups Strike Coilplus and Integra SAP

In the latest wave of digital extortion, two infamous ransomware groups — Akira and DragonForce — have expanded their list of victims, targeting major organizations Coilplus and Integra SAP. The activity was first detected by the ThreatMon Threat Intelligence Team, which tracks real-time movements across the dark web. Both attacks were logged on November 5, 2025, with Akira’s strike occurring at 12:48:39 UTC+3, and DragonForce’s attack registered earlier that morning at 11:40:37 UTC+3.

The Akira ransomware group, known for its calculated and methodical intrusions, has maintained a reputation for attacking corporate networks, encrypting their data, and demanding ransom in cryptocurrency. Their victim, Coilplus, is a recognized player in the metal processing and distribution industry — a sector increasingly targeted for its complex supply chains and valuable industrial data.

Meanwhile, DragonForce, another high-profile ransomware collective, added Integra SAP to its growing list of compromised companies. DragonForce has been linked to politically motivated attacks and large-scale data leaks across Asia and the Middle East. Their targets are typically organizations with integrated systems, especially those relying on enterprise resource planning software — suggesting that Integra SAP may have been hit through a sophisticated breach of internal network infrastructure.

According to cybersecurity observers, both incidents highlight the continuing evolution of ransomware-as-a-service (RaaS) networks. These underground syndicates not only execute attacks but also sell hacking kits to affiliates, multiplying their reach and profits. As corporations accelerate digital transformation, attackers exploit weak authentication layers, outdated software, and unsecured cloud environments — vulnerabilities that remain alarmingly common.

ThreatMon’s findings emphasize the growing overlap between financially motivated ransomware gangs and state-backed cyber operations. While Akira appears purely profit-driven, DragonForce’s patterns often intersect with ideological motives, blurring the line between activism and organized cybercrime.

Security analysts suggest that November 2025 may mark a new escalation phase, as multiple ransomware groups target industrial and software sectors simultaneously. The near-synchronized timing of both breaches could imply coordinated campaigns or the use of shared infrastructure on dark web forums.

This surge in attacks signals a deeper trend: ransomware groups are refining their business models. They operate like corporations — maintaining “customer support,” offering data decryption upon payment, and even negotiating publicly with victims to manipulate public perception. The dark web now serves as both a marketplace and a propaganda stage for these digital extortionists.

For companies like Coilplus and Integra SAP, the financial and reputational damage could be immense. Beyond data encryption, modern ransomware often includes double extortion tactics — stealing sensitive data before locking systems, then threatening public leaks if ransom demands go unmet. Even if victims refuse to pay, the mere announcement of their breach often leads to stock fluctuations, loss of customer trust, and legal complications tied to data protection regulations.

Experts recommend an immediate tightening of security postures, including endpoint detection, employee awareness training, and regular system audits. Organizations in critical sectors — manufacturing, software, logistics — remain at the highest risk.

What Undercode Say:

The dual ransomware incidents involving Akira and DragonForce mark a troubling milestone in 2025’s cybersecurity landscape. While both groups operate differently, their timing and target profile reveal a shared strategic intent — to hit industrial and enterprise-level systems that form the backbone of global supply and data management.

Akira’s choice of Coilplus isn’t random. Industrial manufacturers have become goldmines for ransomware gangs. Their operations depend on continuous uptime, which makes them more likely to pay. Akira’s operations demonstrate a mature ecosystem — complete with negotiation portals, PR-style leak sites, and consistent rebranding to evade law enforcement tracking.

DragonForce’s hit on Integra SAP, on the other hand, has geopolitical undertones. The group is known for aligning itself with anti-establishment causes, using breaches to push ideological narratives while profiting in parallel. Their methods often involve exploiting vulnerabilities in third-party software or compromised credentials obtained through phishing and dark web auctions.

When we examine these events side by side, the pattern is unmistakable: ransomware has evolved into a hybrid weapon — part financial scheme, part digital warfare tool. The simultaneous appearance of these attacks could suggest shared intelligence or a coordinated pressure campaign meant to destabilize corporate ecosystems before year-end financial closures.

Moreover, this reveals a grim reality for businesses relying on cloud services and interconnected data systems. Traditional security frameworks are no longer enough. The perimeter-based defense model collapses when attackers move laterally inside compromised environments. Future protection will rely on zero-trust architecture, behavioral analytics, and AI-driven anomaly detection — tools designed not to prevent entry, but to identify suspicious behavior early enough to isolate and neutralize it.

Undercode believes we’re witnessing the professionalization of ransomware. These aren’t isolated criminals — they are organized entities with supply chains, investors, and development cycles. Their operations resemble startups: agile, data-driven, and ruthlessly focused on profit. The dark web is no longer a chaotic underground — it’s a structured economy.

In this context, governments and corporations must shift from reactive to proactive threat hunting. Intelligence sharing, cross-border collaboration, and rapid incident disclosure could minimize the leverage ransomware groups have over victims. Silence, secrecy, and ransom payments only reinforce the cycle.

Ultimately, what Akira and DragonForce represent is not just cybercrime — but the evolution of digital coercion as a global business model. Until the corporate world treats cybersecurity as a strategic priority rather than a compliance checkbox, these attacks will keep finding new victims — faster and smarter than before.

Fact Checker Results:

✅ Verified dark web listing of both Coilplus and Integra SAP under Akira and DragonForce groups.

✅ ThreatMon Threat Intelligence confirmed timestamps and actor names.

❌ No public statement yet from either victim company regarding ransom demands or impact.

Prediction:

🚨 Expect a surge of copycat ransomware attacks throughout late 2025, particularly targeting industrial supply chains and enterprise software vendors.
💻 Akira may leverage its success to recruit new affiliates, expanding beyond manufacturing.
🌐 DragonForce could escalate politically motivated operations, blending hacktivism with ransomware for ideological influence.