Ransomware Group intelligence

Dragonransomware

Inactive

Track Dragonransomware with 39 published victims and 1 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 39 Known published victims in this dataset

First discovered 2024-12-15 Earliest victim discovery date

Last discovered 2024-12-17 Latest victim discovery date

Inactive since 623 days Days since the latest known victim

Top country India 10 victims

Known locations 1 Leak or negotiation infrastructure tracked

Dragonransomware is tracked by Breach House as a ransomware group with 39 published victims.

India is currently the most targeted country in this dataset.

1 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 1	Web location	Up checked 24m ago	`t.me`

Not identified 6
Communication / Marketing 5
Manufacturing / Engineering 5
Education 5
Services 5
Construction / Real Estate 3
Retail / E-commerce 2
Hospitality / Food & Beverage / Tourism 2
Agriculture / Food 2
Telecommunications 1
Energy 1
Transportation / Travel / Logistics 1
Finance / Legal / Insurance 1

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Dragonransomware, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: dragonransomware executes malicious payloads using PowerShell scripts to stage encryption and system modifications.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: dragonransomware modifies registry run keys to ensure persistence across reboots on compromised systems.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: dragonransomware disables antivirus tools and security software to evade detection during attack execution.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1027.016 Junk Code Insertion Stealth

What they do: dragonransomware embeds junk code into its binaries to evade static analysis and detection tools.

What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
T1070.004 File Deletion Stealth

What they do: dragonransomware deletes Volume Shadow Copies and backup files via system commands to prevent recovery.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1018 Remote System Discovery Discovery

What they do: dragonransomware discovers remote systems via network scanning to expand foothold across the victim environment.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1135 Network Share Discovery Discovery

What they do: dragonransomware scans network shares to identify victim machines for lateral movement and data targeting.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: dragonransomware exfiltrates stolen data using encrypted channels before deploying ransomware to satisfy demands.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: dragonransomware encrypts victim files and folders using its ransomware payload to maximize impact.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: dragonransomware halts system recovery processes and service restarts to lock victims out of remediation options.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Victims (39)

Search, filter and paginate the victim timeline for Dragonransomware. Showing 1–39 of 39.

Type	Target	Discovered	Country	Business Category
Ransomware	phantomsecurity.ca id16125 View details	2024-12-17	Canada	Communication / Marketing
👆 Oops, all the files have been encrypted 🔥 __Target Information__ : Phantom Security Group is a security company that provides integrated solutions. It was established over 35 years ago and operates in the Greater Toronto Area. The company specializes in installing surveillance cameras, alarm systems, and access control systems. It collaborates with trusted companies such as "Axis Communications" and "Kantech." [+] phantomsecurity.ca 💌 DragonRaaS 💟 ~ ID 16125
Ransomware	amlakparto.ir id16109 View details	2024-12-16	Iran, Islamic Republic of	Construction / Real Estate
🫠 Oops, __Amlak Parto__ been hacked 🔥 [+] __Amlak Parto__ is an Iranian real estate agency that offers services for buying, selling, and renting various types of properties. [+] amlakparto.ir Dragons 💟. ID 16109
Ransomware	www.brachapundak.co.il id16082 View details	2024-12-15	Israel	Other
https://www.brachapundak.co.il/ Fuck ~~Israel~~ 👍 ID 16082
Ransomware	salesmandiary.com id16081 View details	2024-12-15	India	Retail / E-commerce
https://salesmandiary.com/ Fuck USA ID 16081
Ransomware	synoveboure.wz.cz id16080 View details	2024-12-15	Czechia	Other
[+] https://synoveboure.wz.cz ID 16080
Ransomware	snedai.com id16079 View details	2024-12-15	Côte d'Ivoire	Retail / E-commerce
[+] https://snedai.com/ --> [Check Host](https://check-host.cc/?m=HTTP&target=https://snedai.com) ID 16079
Ransomware	www.bsisp.ly id16078 View details	2024-12-15	Libya	Telecommunications
[+] https://www.bsisp.ly/ --> [Check Host](https://check-host.cc/?m=HTTP&target=https://www.bsisp.ly) ID 16078
Ransomware	www.manahotels.in id16077 View details	2024-12-15	India	Hospitality / Food & Beverage / Tourism
[+] https://www.manahotels.in ID 16077
Ransomware	shambhaviayurveda.in id16076 View details	2024-12-15	India	Other
[+] https://shambhaviayurveda.in/dragon.php ID 16076
Ransomware	www.zawwali.com id16075 View details	2024-12-15	India	Energy
🔤🔤🔤🔤🔤🔤🔤 We are the Dragons, not here to dominate, but to reclaim our rights and the respect of those around us, our friends and allies. But beware! If you continue to mess around, our cyber attacks will be extraordinary, and will bring you to your knees before our digital power. Prepare for madness like never before! 😎 [+] https://www.zawwali.com/ ID 16075
Ransomware	sadr.ws id16074 View details	2024-12-15	Saudi Arabia	Other
📌 We, the dragons, assure our forces that we will not penetrate anything. We have important information about the Sahrawi mercenaries (Polizario) and things that have never been revealed regarding the Moroccan Sahara. We are not with this party or that, but we are with the right and the real, unfalsified history. [+] https://sadr.ws My greetings, the dragons 🤟 ID 16074
Ransomware	www.machighway.com id16073 View details	2024-12-15	United States	Other
Dragons have passed through here 🤩✅ [+] https://www.machighway.com/ My greetings, the dragons 🤟 ID 16073
Ransomware	mtucker.com id16072 View details	2024-12-15	United States	Hospitality / Food & Beverage / Tourism
🤫 MTrucker A food Service for supply Fulfillment was hacked [+] https://mtucker.com We got into private Files of the company we will share some of it here in the night DragonsRaas 👮‍♀ ~ ID 16072
Ransomware	wahaj-almassa.com id16071 View details	2024-12-15	Saudi Arabia	Manufacturing / Engineering
Wahaj Al Massa (WAHAJ) is a Saudi-based precision engineering company specializing in high-tech manufacturing for aerospace, defense, oil, and gas sectors. Founded in 2013, Wahaj is a key player in Saudi Arabia’s industrial supply chain and partners with international firms to support Vision 2030 goals [+] http://wahaj-almassa.com ID 16071
Ransomware	londonsmt.org id16070 View details	2024-12-15	United Kingdom	Education
The London School of Ministries and Theology (LSMT) is a UK-based vocational Bible college established in 1994. [+] http://londonsmt.org/ ID 16070
Ransomware	w3webschools.com id16069 View details	2024-12-15	India	Education
😀 Oops, all the files have been encrypted 🔥 [+] The w3webschools.com website provides tutorials for learning programming and web design, like HTML, CSS, and JavaScript. [+] w3webschools.com DragonRaaS 🐉 ~ ID 16069
Ransomware	inda.edu.uy id16068 View details	2024-12-15	Uruguay	Education
👈 Oops, all the files have been encrypted 🔥 [+] INDA is an institute offering online courses to develop skills in areas like management, law, and education [+] inda.edu.uy 💌 DragonRaaS 💟 ~ ID 16068
Ransomware	shintex.by id16067 View details	2024-12-15	Belarus	Agriculture / Food
👈 Oops, all the files have been deleted 🔥 [+] Shintekhsnab specializes in selling tires, batteries, and accessories for vehicles, including trucks, cars, and agricultural equipment. [+] shintex.by Dragons 🌟. ID 16067
Ransomware	www.whiteleafent.net id16066 View details	2024-12-15	India	Communication / Marketing
🫠 Oops, Whiteleaf Entertainment been hacked 🔥 [+] Whiteleaf Entertainment is a media company founded in 2008 and located in Mumbai, India. The company specializes in offering a variety of services in the media field. [+] www.whiteleafent.net Dragons 🌟. ID 16066
Ransomware	starlinkvietnam.vn id16065 View details	2024-12-15	Viet Nam	Services
🥹 Oops, Starlink Vietnam been hacked 🔥 [+] Starlink Vietnam offers high-speed satellite internet services, especially for ships and yachts at sea. They provide Starlink’s maritime internet solutions, along with technical support and maritime charts. The company has been in business since 2008. [+] starlinkvietnam.vn Dragons 🫁. ID 16065
Ransomware	www.beikelogistics.com id16064 View details	2024-12-15	China	Transportation / Travel / Logistics
🤤 Oops, Beike Logistics been hacked 🔥 [+] Beike Logistics is an international logistics company that offers shipping, import and export services, and transportation solutions worldwide. [+] www.beikelogistics.com Dragons 👈. ID 16064
Ransomware	logikaservicios.cl id16063 View details	2024-12-15	Chile	Manufacturing / Engineering
🫠 Oops, Logika Servicios been hacked 🔥 [+] Logika Servicios is a Chilean company specializing in industrial and energy services. [+] logikaservicios.cl Dragons 🤤. ID 16063
Ransomware	stleasing.tj id16062 View details	2024-12-15	Tajikistan	Manufacturing / Engineering
🫠 Oops, Standard-Leasing been hacked 🔥 [+] The website stleasing.tj belongs to "Standard-Leasing" in Tajikistan, specializing in financing and leasing services to facilitate the purchase of industrial and commercial equipment. [+] stleasing.tj Dragons 🖐️. ID 16062
Ransomware	hinodes.in id16061 View details	2024-12-15	India	Manufacturing / Engineering
😉 Oops, all the files have been encrypted 🔥 [+] Hinode Technologies is a company based in India that provides engineering services. [+] hinodes.in 💌 DragonRaaS 💟 ~ ID 16061
Ransomware	oakenglish.com id16060 View details	2024-12-15	China	Education
👈 Oops, Oak English been hacked 🔥 [+] Oak English is an online platform for learning English. [+] oakenglish.com Dragons 💟. ID 16060
Ransomware	cafunesol.in id16059 View details	2024-12-15	India	Construction / Real Estate
👈 Oops, all the files have been encrypted 🔥 [+] The cafunesol.in website specializes in digital marketing and web development services, including SEO optimization [+] cafunesol.in 💌 DragonRaaS 💟 ~ ID 16059
Ransomware	www.srishtisoft.com id16058 View details	2024-12-15	India	Services
Website down, and all data it was encrypted 🔥 [+] SrishtiSoft is a private software company founded in 2012 by Pavan Gayakwad, specializing in customized business solutions including desktop, web, and mobile applications. [+] www.srishtisoft.com DragonRaaS 💌 ID 16058
Ransomware	eosspartners.com id16057 View details	2024-12-15	United States	Services
🫠 Oops, EOSS Partners been hacked 🔥 [+] EOSS Partners is a company specialized in providing technological solutions for the oil and gas sector. It operates in several countries including Argentina, Colombia, Ecuador, the United States, and more. The company offers maintenance and technical support services to improve operational efficiency. [+] eosspartners.com Dragons 💟. ID 16057
Ransomware	ssfirm.com.sa id16056 View details	2024-12-15	Saudi Arabia	Finance / Legal / Insurance
🫠 Oops, ssfirm.com.sa been hacked 🔥 [+] Al Saleh, Al Sihli & Partners Law Firm is a Saudi law firm established in 2014. [+] ssfirm.com.sa Dragons 💟. ID 16056
Ransomware	k-boss.net id16055 View details	2024-12-15	Korea, Republic of	Other
🫠 Oops, K-BOSS been hacked 🔥 [+] K-BOSS is a spatial survey system that allows users to create and distribute location-based surveys online. The collected data is analyzed and visualized in 2D or 3D for efficient results. [+] k-boss.net Dragons 💟. ID 16055
Ransomware	tekryse.com id16054 View details	2024-12-15	United States	Services
👈 Oops, all the files have been encrypted 🔥 [+] TekWyse Consulting specializes in providing technical and consulting services as part of the KingWyse LLC group. The site offers a wide range of services, including technical support, device management, website development, cloud services, and security and technical solutions for businesses and individuals. It also features training and educational services to enhance digital and technical skills. [+] tekryse.com Dragons 💟. ID 16054
Ransomware	parkaire.net id16053 View details	2024-12-15	India	Manufacturing / Engineering
🫠 Oops, parkaire been hacked 🔥 [+] Parkaire.net is for an Indian company that makes heat exchangers and industrial coolers. They also offer thermal and mechanical designs. Based in Delhi. [+] parkaire.net Dragons 💟. ID 16053
Ransomware	www.infoer.com.ar id16052 View details	2024-12-15	Argentina	Services
🫠 Oops, www.infoer.com.ar been hacked 🔥 [+] The website www.infoer.com.ar is a specialized online platform based in Argentina that provides technical services or business information tailored to various industries. [+] www.infoer.com.ar Dragons 💟. ID 16052
Ransomware	eye-ed.com id16051 View details	2024-12-15	United States	Education
🫠 Oops, eye-ed been hacked 🔥 [+] Yes, the Eye-Ed website is owned by Real Eyes, LLC and provides educational services specializing in optometry, accredited by COPE. [+] eye-ed.com Dragons 💟. ID 16051
Ransomware	tg777.pub id16050 View details	2024-12-15	Japan	Communication / Marketing
👈 Oops, all the files have been encrypted 🔥 [+] The website tg777.pub focuses on providing services related to online casino games and entertainment, promoting the "8K8" application as a comprehensive gaming platform. [+] https://tg777.pub/dragon.php 💌 DragonRaaS 💟 ~ ID 16050
Ransomware	timesexpress.net id16049 View details	2024-12-15	United Arab Emirates	Communication / Marketing
🫠 Oops, Times Express been hacked 🔥 [+] The Times Express website specializes in publishing articles and news about entertainment, technology, and online casino games, covering a variety of topics including public figures and modern trends. [+] timesexpress.net Dragons 💟. ID 16049
Ransomware	kpr-rm.com id16048 View details	2024-12-15	United Kingdom	Communication / Marketing
🫠 Oops, KPRRM been hacked 🔥 [+] The KPRRM website offers a wide range of specialized services and products in areas such as procurement and supply chain, oil and gas, as well as operational maintenance. It also provides logistics and warehousing services. [+] kpr-rm.com Dragons 💟. ID 16048
Ransomware	shoor.cc id16047 View details	2024-12-15	Saudi Arabia	Agriculture / Food
🫠 Oops, shoor.cc been hacked 🔥 [+] shoor.cc provides consultancy services in various fields such as health, finance, and agriculture. Clients can request expert advice, and experts can join to offer their services. [+] shoor.cc Dragons 💟. ID 16047
Ransomware	pid.co.zw id16046 View details	2024-12-15	Zimbabwe	Construction / Real Estate
🫠 Oops, pid.co.zw been hacked 🔥 [+] The website www.pid.co.zw belongs to Plan Infrastructure Development in Zimbabwe. The company specializes in infrastructure development, including roads, housing, and public facilities. They work on projects like transforming the "Sakuba" area into a smart city by 2030. [+] pid.co.zw Dragons 💟. ID 16046

Dragonransomware

Overview

Top Countries

Known Leak Locations (1)

Top Activity Sectors (13)

Typical Attacks (10)

Victims (39)

Restricted Access

Now you can see the leak, not just the listing