[dragonforce]

July 11, 2026

• Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen · Threat Intelligence

in Progress Orders ShareFile Storage Controllers Offline Over Active Zero-Day Threat

June 20, 2026

• DragonForce affiliates deployed a custom Go RAT, Backdoor.Turn, that hides C2 inside legitimate Microsoft Teams relay infrastructure, observed by Symantec/Carbon Black against a major U.S. services firm. The Hacker News, SecurityWeek · Ransomware & Extortion

in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

June 19, 2026

• DragonForce ransomware affiliates deployed a custom Go RAT (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure, evading network detection during lateral movement and exfiltration at a major US services firm, per Symantec/Carbon Black (The Hacker News, The Register). · Threat Activity & Intrusions

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

June 17, 2026

• DragonForce ransomware deployed a custom Go backdoor (Backdoor.Turn) that hides C2 traffic inside legitimate Microsoft Teams relay infrastructure to evade network detection. SecurityWeek, BleepingComputer. · Threat Activity

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists