ThreatCluster

Qilin, DragonForce, and LockBit Form Ransomware Alliance

First seen 19 Dec 2025, 21:58 UTC • •48

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

On September 15, 2025, the ransomware group DragonForce announced an alliance with Qilin and LockBit via a post on a Russian underground forum. This coalition is recognized as a significant development in the cybercriminal landscape, potentially increasing the threat level of ransomware attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 213d ago How this analysis works

More articles in this cluster (3)

Threat Graph

6 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
Malware
Ransomware

Threat Actor (3)

DragonForce
Lockbit
Qilin

Relationships

DragonForce uses Data Breach
DragonForce uses Malware
DragonForce uses Ransomware
Lockbit uses Data Breach
Lockbit uses Malware
Lockbit uses Ransomware
Qilin uses Data Breach
Qilin uses Malware
Qilin uses Ransomware

Following this threat?

Track DragonForce in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware…

[DRAGONFORCE] Ransomware Attacks Target Community Property Management and Owen Leigh Optometry On September 16, 2026, the DRAGONFORCE ransomware group listed two organizations on a leak site: Community Property Management in the U.S. and Owen Leigh Optometry in the U.K. Community Property Management is reported to have over 200 GB of data claimed as stolen, while Owen Leigh Optometry's alleged data exfiltration…