Listen to this Post
Introduction: A Cyber Cartel on the Rise
In the digital shadows of 2025, cybercrime is undergoing a transformation. No longer are ransomware operators working in isolation — they are organizing into syndicates, rebranding, and fighting for dominance. One group, DragonForce, has emerged as a bold new player. By restructuring its operations into a cartel model, it’s not only providing ransomware-as-a-service (RaaS) but also engaging in open conflict with rivals like RansomHub. Sophos researchers have uncovered details of this escalating turf war, revealing how these power struggles are reshaping the underground economy of cyber extortion.
DragonForce’s Turf War Shakes Up the Ransomware Landscape
DragonForce, a rising force in cybercrime, has been locked in a power struggle with competing ransomware syndicates, notably RansomHub. According to Sophos research, this conflict intensified in March 2025, when DragonForce rebranded itself as a cartel and launched a white-label ransomware service named RansomBay. This strategic shift allowed affiliates to customize ransomware while using DragonForce’s backend infrastructure in exchange for a 20% cut of any ransom profits.
The group’s ambition to dominate became evident when rival RaaS operators, including BlackLock and Mamona, saw their leak sites defaced with DragonForce’s emblem. In late April, DragonForce’s infrastructure was linked to attacks on British retailers such as Marks & Spencer, Harrods, and The Co-operative Group — events attributed to another cybercriminal faction, Scattered Spider, using DragonForce’s support.
Initially, DragonForce appeared to seek cooperation with RansomHub, with public messages hinting at a merger or alliance. A post on the RansomHub leak site even welcomed the DragonForce Cartel. But what followed suggested a different story. Within days, RansomHub’s website was taken offline, with a cryptic “RansomHub R.I.P 03/03/2025” message appearing, implying that DragonForce may have attempted a hostile takeover.
In retaliation, a RansomHub member known as “koley” defaced DragonForce’s homepage, accusing the group of betrayal and collaboration with law enforcement. DragonForce’s own site experienced downtime, returning only after an extended period. Sophos believes that these events signal not a collaboration, but a cyber turf war.
Despite the disruption, this infighting hasn’t made the digital world safer. Sophos warns that such internal strife may lead to unpredictable and more aggressive attacks as rival groups vie for supremacy. The UK’s National Crime Agency echoes this, noting the emergence of a “post-trust ecosystem” in cybercrime where mistrust and fragmentation reign. Organizations, therefore, must double down on security, anticipating more chaotic and reckless ransomware campaigns.
What Undercode Say:
DragonForce’s transition from a solo threat actor to a syndicate-style cartel mirrors traditional organized crime’s evolution. By offering white-label ransomware tools via RansomBay and standardizing infrastructure access, the group has effectively commoditized cyber extortion. This franchising model lowers the entry barrier for cybercriminals and exponentially increases the risk for potential targets.
The group’s aggressive tactics — defacing competitors’ leak sites and pressuring RansomHub — suggest not just expansion, but an attempt to monopolize the ransomware economy. Hostile takeovers in the cyber underworld are rare but becoming more visible, with DragonForce setting a precedent for digital gangland-style dominance.
What’s particularly alarming is the misuse of infrastructure for attacks by external players like Scattered Spider. This blurs lines between direct and indirect attacks and complicates attribution, giving DragonForce plausible deniability while expanding its reach.
The defacement of DragonForce’s site by RansomHub affiliate ‘koley’ shows the thin line between allegiance and betrayal in the RaaS underworld. The accusations of DragonForce collaborating with law enforcement, though unverified, introduce another layer of paranoia among cybercriminals — reinforcing the “post-trust” theme identified by the NCA.
Such mistrust may force groups into more impulsive behavior. With stability fractured and alliances uncertain, the ransomware landscape is shifting from structured extortion models to volatile chaos. This is dangerous for businesses, as attackers become less predictable and potentially more reckless in pursuit of profits and reputation.
The resurgence of DragonForce’s online operations, despite the downtime and conflict, proves its resilience. However, the cracks within the cartel’s façade suggest that power struggles could soon escalate into a broader cyberwar.
For cybersecurity professionals, the takeaway is clear: the ransomware scene is more fragmented, volatile, and unpredictable than ever. Defending against this new era of cyber threats will require not just traditional defenses, but strategic anticipation of how these digital mafias operate.
Fact Checker Results ✅
Sophos verified DragonForce’s infrastructure role in RansomHub’s disruption.
No formal alliance between DragonForce and RansomHub was confirmed.
UK authorities confirm a growing mistrust among cybercrime groups.
🔍💣👨💻
Prediction: The Next Phase in Cybercrime Syndication
As DragonForce continues to expand its cartel-style operations, other RaaS groups may follow suit or form counter-cartels. Expect to see mergers, betrayals, and further turf wars as cybercrime syndicates scramble to capture market share. This could trigger a new wave of aggressive and untraceable ransomware attacks, especially as law enforcement actions further destabilize these networks. The future may not be a battle of code, but a battle of cartel influence — and digital warfare is just getting started.
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub:
https://www.stackexchange.com
Wikipedia
Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
