Ransomware Group intelligence
Dragonransomware
InactiveTrack Dragonransomware with 39 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Dragonransomware is tracked by Breach House as a ransomware group with 39 published victims.
India is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
39
- Leaked 0 0.0%
- Pending 39 100.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Web location | Up checked 5h ago | t.me |
Top Activity Sectors (13)
- Not identified 6
- Communication / Marketing 5
- Manufacturing / Engineering 5
- Education 5
- Services 5
- Construction / Real Estate 3
- Retail / E-commerce 2
- Hospitality / Food & Beverage / Tourism 2
- Agriculture / Food 2
- Telecommunications 1
- Energy 1
- Transportation / Travel / Logistics 1
- Finance / Legal / Insurance 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Dragonransomware, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: dragonransomware executes malicious payloads using PowerShell scripts to stage encryption and system modifications.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: dragonransomware modifies registry run keys to ensure persistence across reboots on compromised systems.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: dragonransomware disables antivirus tools and security software to evade detection during attack execution.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.016 Junk Code Insertion Stealth
What they do: dragonransomware embeds junk code into its binaries to evade static analysis and detection tools.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: dragonransomware deletes Volume Shadow Copies and backup files via system commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: dragonransomware discovers remote systems via network scanning to expand foothold across the victim environment.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: dragonransomware scans network shares to identify victim machines for lateral movement and data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: dragonransomware exfiltrates stolen data using encrypted channels before deploying ransomware to satisfy demands.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: dragonransomware encrypts victim files and folders using its ransomware payload to maximize impact.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: dragonransomware halts system recovery processes and service restarts to lock victims out of remediation options.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (39)
Search, filter and paginate the victim timeline for Dragonransomware. Showing 1–39 of 39.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | phantomsecurity.ca id16125 View details | Canada | Communication / Marketing | pending | ||
|
👆** Oops, all the files have been encrypted 🔥 __Target Information__ : ****Phantom Security Group is a security company that provides integrated solutions. It was established over 35 years ago and operates in the Greater Toronto Area. The company specializes in installing surveillance cameras, alarm systems, and access control systems. It collaborates with trusted companies such as "Axis Communications" and "Kantech."**** [+] ****phantomsecurity.ca**** 💌 DragonRaaS 💟 ~** |
||||||
| Ransomware | amlakparto.ir id16109 View details | Iran, Islamic Republic of | Construction / Real Estate | pending | ||
|
**🫠 Oops, __Amlak Parto__ been hacked 🔥 [+] __Amlak Parto__ is an Iranian real estate agency that offers services for buying, selling, and renting various types of properties. [+] ****amlakparto.ir**** Dragons 💟.** |
||||||
| Ransomware | www.brachapundak.co.il id16082 View details | Israel | Other | pending | ||
|
https://www.brachapundak.co.il/ Fuck ~~Israel~~ 👍 |
||||||
| Ransomware | salesmandiary.com id16081 View details | India | Retail / E-commerce | pending | ||
|
https://salesmandiary.com/ Fuck USA |
||||||
| Ransomware | synoveboure.wz.cz id16080 View details | Czechia | Other | pending | ||
|
[+] https://synoveboure.wz.cz |
||||||
| Ransomware | snedai.com id16079 View details | Côte d'Ivoire | Retail / E-commerce | pending | ||
|
[+] https://snedai.com/ --> [Check Host](https://check-host.cc/?m=HTTP&target=https://snedai.com) |
||||||
| Ransomware | www.bsisp.ly id16078 View details | Libya | Telecommunications | pending | ||
|
[+] https://www.bsisp.ly/ --> [Check Host](https://check-host.cc/?m=HTTP&target=https://www.bsisp.ly) |
||||||
| Ransomware | www.manahotels.in id16077 View details | India | Hospitality / Food & Beverage / Tourism | pending | ||
|
[+] https://www.manahotels.in |
||||||
| Ransomware | shambhaviayurveda.in id16076 View details | India | Other | pending | ||
|
[+] https://shambhaviayurveda.in/dragon.php |
||||||
| Ransomware | www.zawwali.com id16075 View details | India | Energy | pending | ||
|
🔤🔤🔤🔤🔤🔤🔤 We are the Dragons, not here to dominate, but to reclaim our rights and the respect of those around us, our friends and allies. But beware! If you continue to mess around, our cyber attacks will be extraordinary, and will bring you to your knees before our digital power. Prepare for madness like never before! 😎 [+] https://www.zawwali.com/ |
||||||
| Ransomware | sadr.ws id16074 View details | Saudi Arabia | Other | pending | ||
|
📌 We, the dragons, assure our forces that we will not penetrate anything. We have important information about the Sahrawi mercenaries (Polizario) and things that have never been revealed regarding the Moroccan Sahara. We are not with this party or that, but we are with the right and the real, unfalsified history. [+] https://sadr.ws My greetings, the dragons 🤟 |
||||||
| Ransomware | www.machighway.com id16073 View details | United States | Other | pending | ||
|
Dragons have passed through here 🤩✅ [+] https://www.machighway.com/ My greetings, the dragons 🤟 |
||||||
| Ransomware | mtucker.com id16072 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
🤫 **MTrucker** A food Service for supply Fulfillment was hacked [+] https://mtucker.com We got into private Files of the company we will share some of it here in the night DragonsRaas 👮♀ ~ |
||||||
| Ransomware | wahaj-almassa.com id16071 View details | Saudi Arabia | Manufacturing / Engineering | pending | ||
|
Wahaj Al Massa (WAHAJ) is a Saudi-based precision engineering company specializing in high-tech manufacturing for aerospace, defense, oil, and gas sectors. Founded in 2013, Wahaj is a key player in Saudi Arabia’s industrial supply chain and partners with international firms to support Vision 2030 goals [+] http://wahaj-almassa.com |
||||||
| Ransomware | londonsmt.org id16070 View details | United Kingdom | Education | pending | ||
|
The London School of Ministries and Theology (LSMT) is a UK-based vocational Bible college established in 1994. [+] http://londonsmt.org/ |
||||||
| Ransomware | w3webschools.com id16069 View details | India | Education | pending | ||
|
😀** Oops, all the files have been encrypted ****🔥**** [+] The ****w3webschools.com**** website provides tutorials for learning programming and web design, like HTML, CSS, and JavaScript. [+] ****w3webschools.com**** DragonRaaS ****🐉**** ~** |
||||||
| Ransomware | inda.edu.uy id16068 View details | Uruguay | Education | pending | ||
|
👈** Oops, all the files have been encrypted ****🔥**** [+] INDA is an institute offering online courses to develop skills in areas like management, law, and education [+] ****inda.edu.uy**** ****💌**** DragonRaaS ****💟**** ~** |
||||||
| Ransomware | shintex.by id16067 View details | Belarus | Agriculture / Food | pending | ||
|
👈 **Oops, all the files have been deleted ****🔥**** [+] Shintekhsnab specializes in selling tires, batteries, and accessories for vehicles, including trucks, cars, and agricultural equipment. [+] ****shintex.by**** Dragons ****🌟****.** |
||||||
| Ransomware | www.whiteleafent.net id16066 View details | India | Communication / Marketing | pending | ||
|
🫠** Oops, Whiteleaf Entertainment been hacked ****🔥**** [+] Whiteleaf Entertainment is a media company founded in 2008 and located in Mumbai, India. The company specializes in offering a variety of services in the media field. [+] ****www.whiteleafent.net**** Dragons ****🌟****.** |
||||||
| Ransomware | starlinkvietnam.vn id16065 View details | Viet Nam | Services | pending | ||
|
🥹** Oops, Starlink Vietnam been hacked ****🔥**** [+] Starlink Vietnam offers high-speed satellite internet services, especially for ships and yachts at sea. They provide Starlink’s maritime internet solutions, along with technical support and maritime charts. The company has been in business since 2008. [+] ****starlinkvietnam.vn**** Dragons ****🫁****.** |
||||||
| Ransomware | www.beikelogistics.com id16064 View details | China | Transportation / Travel / Logistics | pending | ||
|
🤤** Oops, Beike Logistics been hacked ****🔥**** [+] Beike Logistics is an international logistics company that offers shipping, import and export services, and transportation solutions worldwide. [+] ****www.beikelogistics.com**** Dragons ****👈****.** |
||||||
| Ransomware | logikaservicios.cl id16063 View details | Chile | Manufacturing / Engineering | pending | ||
|
🫠** Oops, Logika Servicios been hacked ****🔥**** [+] Logika Servicios is a Chilean company specializing in industrial and energy services. [+] ****logikaservicios.cl**** Dragons ****🤤****.** |
||||||
| Ransomware | stleasing.tj id16062 View details | Tajikistan | Manufacturing / Engineering | pending | ||
|
🫠** Oops, Standard-Leasing been hacked ****🔥**** [+] The website ****stleasing.tj**** belongs to "Standard-Leasing" in Tajikistan, specializing in financing and leasing services to facilitate the purchase of industrial and commercial equipment. [+] ****stleasing.tj**** Dragons ****🖐️****.** |
||||||
| Ransomware | hinodes.in id16061 View details | India | Manufacturing / Engineering | pending | ||
|
😉** Oops, all the files have been encrypted ****🔥**** [+] Hinode Technologies is a company based in India that provides engineering services. [+] ****hinodes.in**** ****💌**** DragonRaaS ****💟**** ~** |
||||||
| Ransomware | oakenglish.com id16060 View details | China | Education | pending | ||
|
**👈 Oops, Oak English been hacked 🔥 [+] Oak English is an online platform for learning English. [+] ****oakenglish.com**** Dragons 💟.** |
||||||
| Ransomware | cafunesol.in id16059 View details | India | Construction / Real Estate | pending | ||
|
👈** Oops, all the files have been encrypted 🔥 [+] The ****cafunesol.in**** website specializes in digital marketing and web development services, including SEO optimization [+] ****cafunesol.in**** 💌 DragonRaaS 💟 ~** |
||||||
| Ransomware | www.srishtisoft.com id16058 View details | India | Services | pending | ||
|
**Website down, and all data it was encrypted 🔥 [+] SrishtiSoft is a private software company founded in 2012 by Pavan Gayakwad, specializing in customized business solutions including desktop, web, and mobile applications. [+] ****www.srishtisoft.com**** DragonRaaS 💌** |
||||||
| Ransomware | eosspartners.com id16057 View details | United States | Services | pending | ||
|
**🫠 Oops, EOSS Partners been hacked 🔥 [+] EOSS Partners is a company specialized in providing technological solutions for the oil and gas sector. It operates in several countries including Argentina, Colombia, Ecuador, the United States, and more. The company offers maintenance and technical support services to improve operational efficiency. [+] ****eosspartners.com**** Dragons 💟.** |
||||||
| Ransomware | ssfirm.com.sa id16056 View details | Saudi Arabia | Finance / Legal / Insurance | pending | ||
|
**🫠 Oops, ****ssfirm.com.sa**** been hacked 🔥 [+] Al Saleh, Al Sihli & Partners Law Firm is a Saudi law firm established in 2014. [+] ****ssfirm.com.sa**** Dragons 💟.** |
||||||
| Ransomware | k-boss.net id16055 View details | Korea, Republic of | Other | pending | ||
|
**🫠 Oops, K-BOSS been hacked 🔥 [+] K-BOSS is a spatial survey system that allows users to create and distribute location-based surveys online. The collected data is analyzed and visualized in 2D or 3D for efficient results. [+] ****k-boss.net**** Dragons 💟.** |
||||||
| Ransomware | tekryse.com id16054 View details | United States | Services | pending | ||
|
**👈 Oops, all the files have been encrypted 🔥 [+] TekWyse Consulting specializes in providing technical and consulting services as part of the KingWyse LLC group. The site offers a wide range of services, including technical support, device management, website development, cloud services, and security and technical solutions for businesses and individuals. It also features training and educational services to enhance digital and technical skills. [+] ****tekryse.com**** Dragons 💟.** |
||||||
| Ransomware | parkaire.net id16053 View details | India | Manufacturing / Engineering | pending | ||
|
🫠** Oops, parkaire been hacked ****🔥**** [+] ****Parkaire.net**** is for an Indian company that makes heat exchangers and industrial coolers. They also offer thermal and mechanical designs. Based in Delhi. [+] ****parkaire.net**** Dragons ****💟****.** |
||||||
| Ransomware | www.infoer.com.ar id16052 View details | Argentina | Services | pending | ||
|
🫠** Oops, ****www.infoer.com.ar**** been hacked 🔥 [+] The website ****www.infoer.com.ar** is a specialized online platform based in Argentina that provides technical services or business information tailored to various industries.** [+] ****www.infoer.com.ar**** Dragons 💟.** |
||||||
| Ransomware | eye-ed.com id16051 View details | United States | Education | pending | ||
|
**🫠 Oops, eye-ed been hacked 🔥 [+] Yes, the Eye-Ed website is owned by Real Eyes, LLC and provides educational services specializing in optometry, accredited by COPE. [+] ****eye-ed.com**** Dragons 💟.** |
||||||
| Ransomware | tg777.pub id16050 View details | Japan | Communication / Marketing | pending | ||
|
**👈 Oops, all the files have been encrypted 🔥 [+] The website ****tg777.pub**** focuses on providing services related to online casino games and entertainment, promoting the "8K8" application as a comprehensive gaming platform. [+] ****https://tg777.pub/dragon.php**** 💌 DragonRaaS 💟 ~** |
||||||
| Ransomware | timesexpress.net id16049 View details | United Arab Emirates | Communication / Marketing | pending | ||
|
**🫠 Oops, Times Express been hacked 🔥 [+] The Times Express website specializes in publishing articles and news about entertainment, technology, and online casino games, covering a variety of topics including public figures and modern trends. [+] ****timesexpress.net**** Dragons 💟.** |
||||||
| Ransomware | kpr-rm.com id16048 View details | United Kingdom | Communication / Marketing | pending | ||
|
**🫠 Oops, KPRRM been hacked 🔥 [+] The KPRRM website offers a wide range of specialized services and products in areas such as procurement and supply chain, oil and gas, as well as operational maintenance. It also provides logistics and warehousing services. [+] ****kpr-rm.com**** Dragons 💟.** |
||||||
| Ransomware | shoor.cc id16047 View details | Saudi Arabia | Agriculture / Food | pending | ||
|
**🫠 Oops, ****shoor.cc**** been hacked 🔥 [+] ****shoor.cc**** provides consultancy services in various fields such as health, finance, and agriculture. Clients can request expert advice, and experts can join to offer their services. [+] ****shoor.cc**** Dragons 💟.** |
||||||
| Ransomware | pid.co.zw id16046 View details | Zimbabwe | Construction / Real Estate | pending | ||
|
**🫠 Oops, ****pid.co.zw**** been hacked 🔥 [+] The website ****www.pid.co.zw**** belongs to Plan Infrastructure Development in Zimbabwe. The company specializes in infrastructure development, including roads, housing, and public facilities. They work on projects like transforming the "Sakuba" area into a smart city by 2030. [+] ****pid.co.zw**** Dragons 💟.** |
||||||