← All threat actors
DragonForce
DragonForce is a hacktivist group based in Malaysia that has been involved in cyberattacks targeting government institutions and commercial organizations in India. They have also targeted websites affiliated with Israel and have shown support for pro-Palestinian causes. The group has been observed using defacement attacks, distributed denial-of-service attacks, and data leaks as part of their campaigns. DragonForce Malaysia has demonstrated an ability to adapt and evolve their tactics over time.
Motivation
Unknown
Suspected origin
Malaysia
Reports / IOCs (VT)
385 reports · 12 IOCs
Reported activity
2022 – 2026
Targeted industries
—Targeted regions
—Associated malware (1)
DEVMAN
CVEs seen in reporting
ATT&CK techniques in reports
- T1486 Data Encrypted for Impact7
- T1078 Valid Accounts6
- T1190 Exploit Public-Facing Application6
- T1490 Inhibit System Recovery4
- T1059.001 PowerShell3
- T1543.003 Windows Service3
- T1569.002 Service Execution3
- T1003.001 LSASS Memory2
- T1016 System Network Configuration Discovery2
- T1018 Remote System Discovery2
- T1021.001 Remote Desktop Protocol2
- T1053.005 Scheduled Task2
- T1071.001 Web Protocols2
- T1078.002 Domain Accounts2
- T1082 System Information Discovery2
- T1083 File and Directory Discovery2
- T1547.001 Registry Run Keys / Startup Folder2
- T1562.001 Disable or Modify Tools2
- T1003 OS Credential Dumping2
- T1021.002 SMB/Windows Admin Shares2