DragonForce Ransomware: Redefining Hybrid Extortion in 2025 blog.checkpoint.com/security/…

The ransomware world isn’t just evolving—it’s fragmenting, decentralizing, and growing more dangerous. In this volatile landscape, DragonForce is emerging as one of the most intriguing and threatening actors of 2025. Born from possible hacktivist roots and now fully immersed in the economics of cyber crime, DragonForce represents a new era of hybrid threats: ideologically ambiguous, technologically agile, and fiercely opportunistic.

DragonForce first appeared in December 2023 with the launch of its “DragonLeaks” dark web portal. Some researchers trace its lineage to DragonForce Malaysia, a long-standing hacktivist collective. But its current trajectory is far from purely ideological. By 2025, DragonForce has matured into a ransomware group with a business model tailored to attract displaced or freelance affiliates.