FlagThis

The ransomware landscape continues to experience significant turbulence as groups target each other's infrastructure and tactics shift. Notably, a group known as DragonForce has been actively hacking its rivals, with RansomHub, a major Ransomware-as-a-Service (RaaS) platform and one of the most active groups, being their latest target. DragonForce has previously targeted Mamona and BlackLock. This takeover of RansomHub could lead to a significant shift in the RaaS model, potentially leading to affiliates developing their own brands and further fragmenting the threat landscape.

Researchers infiltrated the online infrastructure associated with BlackLock ransomware and uncovered configuration files, credentials, and a history of executed commands. This also resulted in clear web IP addresses being revealed, which were hidden behind Tor infrastructure. BlackLock, which emerged in January 2025 and was previously known as El_Dorado, had listed 46 victims prior to the incident. Coincidently (or maybe using the same exploit) BlackLock’s leak site was also defaced.

Hunters International, a RaaS group that some believe evolved from Hive, appears to be rebranding and shifting operations, moving away from an unprofitable and risky ransomware business and focusing solely on exfiltrating data and extorting victims. The decision appears to come in the wake of international law enforcement operations. Hunters appears to be shifting its operations, dropping the encryption part of the equation and focusing purely on data exfiltration and extortion, launching under the name “World Leaks”.

ImgSrc: cyble.com

References :

• bsky.app: There's a ransomware group named DragonForce going around hacking its rivals. After Mamona and BlackLock, the group has now hacked RansomHub—a major RaaS platform and one of the most active groups today.
• cyble.com: Ransomware Attack Levels Remain High as Major Change Looms
• Searchlight Cyber: BlackLock Ransomware Exposed and DragonForce Makes Moves
• BlackFog: BlackFog Report Reveals Record Number of Ransomware Attacks from January to March
• www.tripwire.com: Ransomware reaches a record high, but payouts are dwindling

Classification:

• HashTags: #Ransomware #Cybersecurity #DataBreach
• Company: Cyble
• Target: Organizations globally
• Attacker: RansomHub, DragonForce
• Product: Ransomware-as-a-Service
• Feature: Ransomware attacks
• Malware: RansomHub, Akira, Qilin, SafePay, Fog, CL0P, DragonForce
• Type: Ransomware
• Severity: Major