Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Dragonransomware ransomware

39 victims listed on the Dragonransomware leak site across 21 countries. Most recent disclosure .

Victims
39
0.2% of all tracked
Countries
21
Most: India
Sectors
10
Most: Technology
First seen
Dec 2024
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Dragonransomware and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Dragonransomware is a newly released ransomware offering compact file size and customizable features. the group has struck 39 victims across 21 countries including India, United States, and Saudi Arabia.

Who Dragonransomware is

Dragon Ransomware, is promising rapid and customizable ransomware operations for Windows systems. Key features include a compact 50KB file size, ultra-fast encryption speed, and a builder tool that allows users to personalize ransomware configurations. The tool will be available to the public once the team reaches 1,000 subscribers on their channel, signaling a potential rise in availability to threat actors.

Recorded activity

Disclosures attributed to Dragonransomware in this database run from December 2024 to December 2024, totalling 39 victims — 0.2% of everything tracked here. Dragonransomware has listed victims in 21 countries in this database, most often India, followed by United States and Saudi Arabia. The sectors appearing most in its listings are Technology, Business Services, Transportation/Logistics.

YARA detection rules

dragonransomware.yar 
/*
dragonransomware ransomware
*/

rule dragonransomware_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.dragonransomware"
        description = "Detects dragonransomware ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "dragonransomware" ascii nocase
        $name2 = "DRAGONRANSOMWARE" ascii
        $onion  = "dragonransomware.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Dragonransomware, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Dragonransomware has disclosed 39 victims on its leak site, 0.2% of all ransomware listings tracked in this database. Its earliest disclosure here dates to December 2024.

The group has listed organisations in 21 countries, most often in India (10 victims), followed by United States, Saudi Arabia, United Kingdom.

By industry, its listings concentrate in Technology, Business Services, Transportation/Logistics — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Dragonransomware is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Dragonransomware victims 39

Organization Disclosed
phantomsecurity.ca
CACanada
amlakparto.ir
IRIran
cafunesol.in
INIndia
eosspartners.com
USUnited States
eye-ed.com
USUnited States
hinodes.in
INIndia
inda.edu.uy
UYUruguay
k-boss.net
KRSouth Korea
kpr-rm.com
GBUnited Kingdom
logikaservicios.cl
CLChile
londonsmt.org
GBUnited Kingdom
mtucker.com
USUnited States
oakenglish.com
CNChina
parkaire.net
INIndia
pid.co.zw
ZWZimbabwe
sadr.ws
SASaudi Arabia
salesmandiary.com
INIndia
shambhaviayurveda.in
INIndia
shintex.by
BYBelarus
shoor.cc
SASaudi Arabia
snedai.com
CICôte d’Ivoire
ssfirm.com.sa
SASaudi Arabia
starlinkvietnam.vn
VNVietnam
stleasing.tj
TJTajikistan
synoveboure.wz.cz
CZCzech Republic
tekryse.com
USUnited States
tg777.pub
JPJapan
timesexpress.net
AEUAE
w3webschools.com
INIndia
wahaj-almassa.com
SASaudi Arabia
www.beikelogistics.com
CNChina
www.brachapundak.co.il
ILIsrael
www.bsisp.ly
LYLibya
www.infoer.com.ar
ARArgentina
www.machighway.com
USUnited States
www.manahotels.in
INIndia
www.srishtisoft.com
INIndia
www.whiteleafent.net
INIndia
www.zawwali.com
INIndia

Frequently asked questions

What is Dragonransomware ransomware?

Dragonransomware is a ransomware threat group that has claimed 39 victims since its first known activity in December 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Dragonransomware attacked?

Dragonransomware has claimed 39 victims in our database, representing 0.2% of all tracked ransomware attacks. The most targeted countries are India, United States, Saudi Arabia, United Kingdom.

Which countries does Dragonransomware target?

Dragonransomware has attacked organizations in 21 countries. The top targeted countries are: India, United States, Saudi Arabia, United Kingdom.

Which industries does Dragonransomware target?

Dragonransomware most frequently targets the Technology, Business Services, Transportation/Logistics sectors based on victim disclosures in our database.

Is Dragonransomware still active?

Dragonransomware's most recent victim disclosure in our database was on December 17, 2024. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.