Threat Intel Content Update: 5/6/25

Threat Content Highlights

Threat Profiles

• “Trending & Emerging Threats” weekly update: DragonForce Ecosystem
  • The DragonForce group has made headlines recently after claiming a series of attacks targeting prominent UK retail brands, prompting a response from national cybersecurity authorities.
  • The group has claimed attacks on victims in a wide range of industries & locations since launching its ransomware activities in 2023, underscoring its relevance well beyond the UK retail sector.
  • This Threat Profile includes the DragonForce Group object, authored by our partners at Trellix (learn more about our recent collaboration), as well as key Software previously known to be used by these actors.

Threat Objects

• We added multiple Campaigns that showcase various actors’ recent use of sophisticated social engineering methods to successfully compromise organizations in a range of sectors & regions:
  • Operation Deceptive Prospect
  • ClickFake Interview
  • 2024-25 State-Sponsored Actor ClickFix Use
  • Operation Code on Toast