Risk Letters
About Sign in ENDA

Threat actor

DragonForce

TLP:CLEAR

Facts

  • Origin: Malaysia
  • Motivation: Financial
  • Malware and tools: Advanced IP Scanner, Mimikatz, PingCastle, SoftPerfect NetScan
  • Techniques (MITRE ATT&CK): User Execution, Indicator Removal: File Deletion, Impair Defenses: Disable or Modify Tools, File and Directory Discovery, Data Encrypted for Impact
  • Last seen: 15 October 2026

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.

© The Risk Letters 2026 · Privacy policy · Terms of sale · Refund policy