DragonForce and Anubis Ransomware Gangs Launch New Affiliate Programs

Secureworks Counter Threat Unit (CTU) researchers have uncovered innovative strategies deployed by the DragonForce and Anubis ransomware operators in 2025.

These groups are adapting to law enforcement pressures with novel affiliate models designed to maximize profits and expand their reach, showcasing the resilience and ingenuity of modern cybercriminals in underground forums.

DragonForce Pioneers a Distributed Affiliate Branding Model

DragonForce, first identified in August 2023 as a conventional ransomware-as-a-service (RaaS) operation, has undergone a significant transformation by March 2025.

Initially gaining traction after advertising on dark web forums in February 2024, the group amassed a victim count of 136 on its leak site as of March 24, 2025.

In a bold move announced on March 19 via an underground post, DragonForce rebranded itself as a “cartel” and shifted to a distributed model.

This new approach allows affiliates to establish their own unique “brands” while leveraging DragonForce’s robust infrastructure, including administration ...