File · DragonForce · Unknown · assessed origin Malaysia · misp-galaxy · refreshed 2026-10-06
DragonForce
sigil · no ATT&CK coverage stated
Last 30 days
last seen 9 d ago- seen against
- Argentina · France · Taiwan · Thailand · United States
- sectors
- Other · Healthcare · Manufacturing · Retail & E-Commerce
What changed
ledger · newest first- 2026-10-18todaynew CVE3 new CVEs: CVE-2022-26134, CVE-2022-29464, CVE-2022-30190
- 2026-09-3018 d agovictimsvictim count 64 → 69 (+5)
- 2026-09-2325 d agovictimsvictim count 61 → 64 (+3)
- 2026-09-161 mo agovictimsvictim count 60 → 61 (+1)
- 2026-09-071 mo agonew CVE1 new CVE: CVE-2025-5777
Analyst brief
misp-galaxyDragonForce is a hacktivist group based in Malaysia that has been involved in cyberattacks targeting government institutions and commercial organizations in India. They have also targeted websites affiliated with Israel and have shown support for pro-Palestinian causes. The group has been observed using defacement attacks, distributed denial-of-service attacks, and data leaks as part of their campaigns. DragonForce Malaysia has demonstrated an ability to adapt and evolve their tactics over time.
Observed targets (as stated by the sources)
11 countries · 9 sectorsassessed origin · Malaysiaobserved targets · 11
countries · 11
- United States
- United Kingdom
- Argentina
- Brazil
- Thailand
- France
- Taiwan
- United Arab Emirates
- Canada
- Poland
- China
sectors · 9
- Other
- Manufacturing
- Healthcare
- Retail & E-Commerce
- Professional Services
- Financial Services
- Hospitality
- Technology
- Not Found
as stated by MISP galaxy / ransomware.live — not inferred
CVEs cited sources tie to DragonForce
1 on CISA KEV- CVE-2025-5777KEV2026-10-17
“Huntress assesses with high confidence that an Initial Access Broker (IAB) is weaponizing CVE-2025-5777 (CitrixBleed 2) to gain access to Citrix environments, ultimately with the goal of deploying ransomware. In our observations, the ransomware deployed was Dragonforce”
cited as used in a campaign · source: huntress.com ↗ · 2026-10-17
- CVE-2022-294642026-10-17
“WSO2 vulnerability (CVE-2022-29464)”
cited as used in a campaign · named nearby · source: fortinet.com ↗ · 2026-10-17
- CVE-2022-301902026-10-17
“MSDT Follina CVE-2022-30190 ( Outbreak Alert )”
cited as used in a campaign · named nearby · source: fortinet.com ↗ · 2026-10-17
- CVE-2022-261342026-10-17
“So far, DragonForce and its supporters have predominantly targeted victims using the following techniques: DDoS Website defacement Compromising VPN portals with stolen credentials Targeting web application vulnerabilities Exploiting the recent Atlassian Confluence vulnerability (CVE-2022-26134)”
cited as exploiting · source: fortinet.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
6 sources- 1.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-…
- 2.blog.radware.com/security/2023/05/india-one-of-the-most-targeted-countr…
- 3.securitybrief.asia/story/dragonforce-malaysia-attacks-israeli-institution…
- 4.radware.com/security/threat-advisories-and-attack-reports/opisrael…
- 5.blog.radware.com/security/ddos/2022/08/this-was-h1-2022-part-3-beyond-t…
- 6.fortinet.com/blog/threat-research/guidance-on-hacktivist-operation-…
Track DragonForce on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.