DragonForce is retained as a financially motivated ransomware/extortion profile that has been reported as a RaaS and cartel-style operation. Public sources describe multiple boundaries that should not be collapsed automatically: DragonForce Malaysia hacktivist branding, DragonForce ransomware/RaaS operations, affiliate use of LockBit- and Conti-derived payloads, and Scattered Spider actors deploying DragonForce ransomware in some intrusions. IntelliOS treats those as source-backed relationships and deployment context, not proof that every named group or toolchain is the same actor. Current enrichment emphasizes DragonForce ransomware behavior, affiliate tooling, SimpleHelp exploitation reports, and public malware/file/network observables.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.