DragonForce Ransomware Cartel: New Variant, Affiliates, and Attacks

DragonForce, a ransomware-as-a-service group, has rebranded as a cartel, allowing affiliates to white-label payloads and create variants like Devman and Mamona/Global. The group employs BYOVD attacks using vulnerable drivers to terminate processes and has reinforced its encryptor to avoid weaknesses. Scattered Spider, a financially driven actor, has partnered with DragonForce, leading to over 200 victims across various sectors. The group's most notable attack targeted a major retailer in collaboration with Scattered Spider.