DragonForce hits Saudi chemical maker
A Saudi Arabian chemical manufacturer is among the first major industrial targets hit by DragonForce in the Kingdom, according to ASEC’s July 2026 weekly roundup. The disclosure confirms the group’s continued push into Gulf manufacturing, following its February 2025 strike on a Riyadh real estate and construction firm that exfiltrated over 6 terabytes of data.
The incident is part of DragonForce’s broader 2026 run. The group claimed 144 victims in Q2, 248 year-to-date through May, and 76 claims in Q2 (45 in Q1). It entered the Q2 top-5 at rank 4, displacing IncRansom, and posted 101 victims in Q1 — a 29% jump from Q4 2025.
How the attack works
Initial access typically arrives through RDP on Port 3389 or an unpatched SSL-VPN appliance—most commonly Ivanti Connect Secure, Fortinet FortiOS, or SonicWall. Affiliates brute-force or reuse credentials to land a shell on the edge, then pivot inward.
Before the encryptor runs, they drop RTCore64.sys, a Bring Your Own Vulnerable Driver (BYOVD) that bypasses EDR and AV on the target. The driver is signed and loaded via a standard sc create / sc start sequence, giving the payload a clean execution context.
The ransomware payload itself is a Visual C++ build derived from the leaked LockBit 3.0 builder that went public in September 2022. DragonForce has kept the core encryption logic but added a custom wiper that scrubs forensic artifacts—registry keys, event logs, and the ransom note file—after the encryptor finishes. The wiper runs as a second-stage binary and is what makes the post-encryption state harder to attribute than a stock LockBit drop."
The DragonForce platform
DragonForce is a ransomware-as-a-service platform built on the leaked LockBit 3.0 builder that went public in September 2022. The group has been active since late 2023 and distinguishes itself with a data audit service that analyzes stolen datasets larger than 300 GB to surface the highest-value files for targeted extortion leverage.
The Q2 2026 tradecraft update introduces Backdoor.Turn, a Go-based remote access trojan that abuses Microsoft Teams TURN-relay for command-and-control concealment. It is the first known malware to misuse the Teams relay mechanism, giving affiliates a cleaner C2 channel than standard RDP or HTTP beacons.
Why this matters for the Gulf
This is DragonForce’s second major Saudi enterprise target. The first was a Riyadh real estate and construction firm hit in February 2025, where the group exfiltrated over 6 terabytes of data and timed the drop just before Ramadan to pressure the victim into paying. That pattern—large Gulf target, high-value data, aggressive leak—has now repeated with the chemical manufacturer, confirming the group’s deliberate push into Kingdom manufacturing.
The consolidation story matters for the Gulf because DragonForce absorbed RansomHub in early 2025. RansomHub’s leak site went dark on March 31, and DragonForce commandeered the infrastructure by April 8, the same day the public takeover was formally recognized. DragonForce then announced RansomHub had “joined the cartel,” leaving the former RaaS inactive as of April 2026. That move tightened the RaaS market and pushed affiliates toward DragonForce, which is why the group is now the #4 RaaS in Q2 2026 with 144 victims, displacing IncRansom from the top-5.
Key points
- DragonForce ransomware group claims a Saudi Arabian chemical manufacturer in ASEC's July 2026 weekly roundup.
- The victim is part of DragonForce's Q2 2026 run of 144 confirmed victims, up 29% from Q1's 101.
- DragonForce is a pro-Palestinian-turned-cybercriminal RaaS platform active since late 2023, built on the leaked LockBit 3.0 builder.
- The group uses double extortion: it encrypts files and leaks data on its DragonLeaks Tor site.
- This is the latest in a string of DragonForce hits on Saudi and Gulf-region industrial and retail targets, including a February 2025 Riyadh real estate firm (6 TB exfil) and the April 2025 M&S/Co-op/Harrods UK retail wave.
Further reading & sources
- Ransomware Spotlight: Ransomhub | TrendAI (US)
- DragonForce Ransomware – Hacktivist Turned Cybercriminal Enterprise - Threat Actors
- Industrial Ransomware Analysis for Q2 2026
- UK Cybercrime Journal: Sustained DragonForce Campaign
- BlackLock Ransomware Exposed After Researchers Exploit Leak Site Vulnerability
- Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target - Brandefense