Digital Event Horizon
The turf war between two prominent ransomware groups, DragonForce and RansomHub, has brought volatility to the extortion ecosystem. With no honor among thieves, both groups are engaged in a battle for dominance, increasing risks for companies and highlighting the importance of robust cybersecurity measures.
The cybercrime world has seen a new era of cutthroat competition among groups involved in ransomware-as-a-service (RaaS). A turf war is brewing between DragonForce and RansomHub, two prominent players in the RaaS sector. The conflict began when DragonForce rebranded itself as a "cartel" in March, expanding its services and attracting more affiliate partners. RansomHub's site was taken down with a hostile takeover message, leading to concerns about follow-up extortion attempts. A RansomHub member defaced DragonForce's site, labeling them "traitors," showcasing the ruthless nature of cybercriminals. The conflict has led to increased volatility in the extortion ecosystem, posing significant risks for companies. The global cost of cybercrime is estimated to reach $10 trillion in 2025, highlighting the growing threat. Experts warn that the turf war could lead to a situation where a victim gets extorted twice, further exacerbating the risks.
The cybersecurity world has witnessed a new era of cutthroat competition among groups involved in ransomware-as-a-service (RaaS). A recent development in this sector has brought to light the escalating conflict between two prominent players, DragonForce and RansomHub. This turf war not only poses significant risks for companies but also raises concerns about the increasing volatility of the extortion ecosystem.
According to experts, the relationship between these two groups began to sour when DragonForce rebranded itself as a "cartel" in March, expanding its services and attracting more affiliate partners. In retaliation, RansomHub's site was taken down with a marker left stating “R.I.P 3/3/25”, believed to be a hostile takeover by DragonForce.
This event marked the beginning of an intense battle within the industry, as both groups seek dominance over the booming criminal ransomware sector. Cybersecurity experts emphasize that no honor is expected among thieves in this world, and the conflict has led to concerns about follow-up extortion attempts, which often lack credibility.
The situation took a darker turn when a RansomHub member defaced DragonForce's site, labeling them "traitors." This act further underscores the ruthless nature of cybercriminals and their tendency to pursue revenge when partnerships go sour.
As companies face an increased risk of being extorted twice due to these conflicts, it is essential to recognize that the extortion ecosystem has become more volatile than ever before. The recent UnitedHealth hack, where a double extortion attempt was made after a ransomware group initially stole $22 million from Notchy's original RaaS partner, highlights this vulnerability.
Cybersecurity firm Group-IB reported that DragonForce listed 82 victims on its dark-web site in the following 12 months, while RansomHub reported about 500 victims on its site in 2024. These statistics serve as a reminder of the booming demand for ransomware services and the increasing competition among groups vying for dominance.
The conflict between DragonForce and RansomHub has also raised concerns among experts regarding the global cost of cybercrime, which is estimated to reach $10 trillion in 2025. The figure is up from $3 trillion in 2015 and comes as hacker groups increasingly look to maximize profit through their attacks.
Jake Moore, global cybersecurity adviser at ESET, warns that the volatility of this situation could make companies' defense and response tactics more vulnerable. He notes that this is a "Wild West" environment where normal competition rules do not apply.
Rafe Pilling, director of threat intelligence at Sophos, cautions that in a worst-case scenario, both groups could target the same victim in a battle for business. This would lead to a situation where the victim gets extorted twice, further exacerbating the risks associated with this conflict.
Toby Lewis, global head of threat analysis at Darktrace, emphasizes the importance of recognizing that "no honor among thieves" exists within the hacking world. He warns that most cybercrime groups have an ingrained need for kudos and one-upmanship, which could lead them to attempt to 'outcompete' each other by trying to attack and extort the same target.
The recent developments in this sector highlight the evolving landscape of ransomware-as-a-service (RaaS) and its impact on companies worldwide. As experts emphasize that a turf war between groups can result in more hacks and further fallout for corporate victims, it is crucial to stay vigilant and take proactive measures to protect against such threats.
In conclusion, the conflict between DragonForce and RansomHub serves as a stark reminder of the volatility within the extortion ecosystem. With no honor among thieves and an increasing focus on maximizing profit, this battle for dominance poses significant risks for companies and underscores the importance of robust cybersecurity measures to mitigate these threats.
Related Information:
https://www.digitaleventhorizon.com/articles/No-Honor-Among-Thieves-The-Turf-War-Between-RansomHub-and-DragonForce-deh.shtml
https://arstechnica.com/security/2025/07/no-honor-among-thieves-ms-hacking-group-starts-turf-war/
Published: Mon Jul 7 15:57:28 2025 by llama3.2 3B Q4_K_M
