DragonForce ransomware: the cartel that took down M&S and Co-op

Marks & Spencer lost more than £500 million in market value after somebody rang the company's IT helpdesk pretending to be an employee. No zero-day, no elaborate phishing. One phone call, one password reset, and two months later the e-commerce systems of one of the UK's largest retail chains were encrypted. That's DragonForce.

Who DragonForce are

DragonForce emerged in 2023 as a Malaysian hacktivist group, but pivoted quickly to ransomware-as-a-service (RaaS), adopting an affiliate model with a split of up to 80% of the ransom. In March 2025 it went further: it relaunched the operation as a "ransomware cartel", letting affiliates create their own brands using the group's infrastructure, encryptor and tooling — their own name, their own leak site, their own visual identity.

The encryptor's code has a known lineage: part of the routines derives from Conti v3, whose source code leaked in 2022. Rather than building from scratch, the group adapted a base already battle-tested in production by one of the most prolific ransomware collectives in history. In August 2025 they added a data analysis service to generate victim-specific extortion material, available to affiliates targeting companies with annual revenue above $15 million.

By June 2026, according to ransomware.live data, DragonForce had listed 563 victims across 57 countries. The worst-hit sectors are business services (111 victims), manufacturing (97) and technology (58). The US accounts for 280 victims; the UK, 40.

The partnership with Scattered Spider

The attack on Marks & Spencer wasn't carried out directly by DragonForce's core. The initial intrusion was attributed to Scattered Spider (also called Octo Tempest), a young collective specialising in social engineering and initial access, according to an investigation run by CrowdStrike, Microsoft and Fenix24 at M&S's request. The division of labour is complementary: Scattered Spider gets in and harvests credentials; DragonForce supplies the ransomware and runs the extortion.

Scattered Spider's arsenal includes SIM swapping, MFA fatigue and push bombing, and impersonation of support teams. In the M&S case, the tactic was more direct: an operator rang the company's outsourced helpdesk — run by Tata Consultancy Services (TCS) — identified themselves as an employee and requested a password reset. The agent performed the reset without adequate verification. That was confirmed publicly by M&S chairman Archie Norman himself.

From the phone call to NTDS.dit

With credentials in hand, the attackers entered the network at some point in February 2025. Over the following months they moved laterally using living-off-the-land (LOTL) techniques — PowerShell, WMI and legitimate administrative tools such as PingCastle and Advanced IP Scanner. No custom malware, nothing that would trip obvious alerts in an inattentive SOC.

The goal of the reconnaissance phase was NTDS.dit — the Active Directory database that stores the password hashes of every user in the domain. With it exfiltrated, the attackers cracked the hashes offline with tools such as Mimikatz, escalated to privileged accounts and expanded control across the whole infrastructure. Keeping PowerShell audit logs and Active Directory events enabled is exactly the kind of telemetry that lets you detect that movement — access to NTDS.dit should raise an immediate alert in any minimally configured SIEM.

The payload: VMware ESXi as the target

On 24 April 2025, the attackers deployed the DragonForce encryptor on M&S's VMware ESXi servers. The choice of ESXi is calculated: taking the attack up to the hypervisor brings down dozens of VMs at once — e-commerce, payment processing, logistics — all on the same physical hardware.

To get around endpoint protections on the servers, the group used BYOVD (bring your own vulnerable driver): they deployed legitimate but vulnerable drivers — truesight.sys and rentdrv2.sys — that allow code execution in the kernel, from where antivirus and EDR processes can be killed without triggering behavioural alerts.

The immediate result: M&S suspended online orders for five days. With an average of £3.8 million a day in e-commerce sales, the direct losses from that period alone topped £19 million. The company's shares shed more than £500 million in market value over the following weeks.

Co-op and Harrods: the knock-on effect

In the weeks after the M&S attack, the same group of operators targeted Co-op and Harrods. In Co-op's case, DragonForce confirmed it had extracted data on at least 10,000 customers, including loyalty card numbers, names, home addresses, emails and phone numbers. The data was published on the leak site after negotiations broke down.

The pattern is familiar to anyone who followed the "pay or leak" model used by ShinyHunters against Canvas LMS. The difference is that DragonForce combines data extortion with infrastructure encryption — which doubles the pressure: the company has to pay to recover its systems and to prevent the data being published, simultaneously.

What reduces the risk

The M&S attack carries a simple and repeatedly ignored lesson: the helpdesk is attack surface. An identity verification process before any credential reset — a code sent to the line manager, a callback to the registered extension, validation by hardware token — would have stopped the attack before the first byte of data was ever accessed.

• Identity verification at the helpdesk: never perform password resets over the phone without an independent second validation factor.
• Phishing-resistant MFA: FIDO2/passkeys eliminate push bombing and SIM swapping as an entry vector.
• Alerting on NTDS.dit: any access to or copy of the AD database file should raise an immediate SIEM alert.
• ESXi hardening: isolate the hypervisor on separate VLANs, disable SSH when not needed, restrict access by IP.
• LOTL detection: correlate use of Advanced IP Scanner, PingCastle and remote WMI in contexts outside the normal operational pattern.

As of June 2026, DragonForce counts 563 victims and the cartel keeps recruiting affiliates. The social-engineering access model will carry on working as long as the helpdesk is treated as an administrative process rather than a security control point — regardless of how much was spent on firewalls and EDR. If you manage infrastructure, review your credential reset flow today. It costs nothing and it's the control that could have saved £500 million.