DragonForce Ransomware Group Targets Saudi Arabia: A Growing Concern for Cybersecurity

Last week, a disturbing trend emerged in the Middle East as Resecurity researchers reported that the notorious DragonForce ransomware group has set its sights on organizations in the Kingdom of Saudi Arabia (KSA). This latest development is part of an alarming increase in cyber threats facing the region, with critical infrastructure and major corporations under siege.

A significant incident involving a prominent real estate and construction company in Riyadh shed light on the scope and audacity of the DragonForce ransomware attack. With projects tied to major conglomerates in the energy, oil and gas, government, and defense sectors, this cyber assault has far-reaching implications for national security and economic stability.

The attack began with a data leak from the targeted company, which reportedly exceeded 6 TB in volume. The exfiltrated data included internal and confidential documents related to the operations and clients of the company, creating a high-stakes game of cat and mouse between the attackers and the organization's security team.

According to Resecurity, DragonForce sent a ransom demand to the victim on February 14, 2025, with a deadline set for one day before Ramadan begins on February 28, 2025. However, rather than honoring the deadline, the group released the stolen data, making it clear that they were not interested in negotiations.

The use of a dedicated URL for the leaked data, separate from the official DLS site, further emphasizes the sophistication and cunning of the DragonForce gang. As cybersecurity experts warn, this type of attack highlights the severity of the threat posed by ransomware groups like DragonForce to critical infrastructure and major corporations in KSA.

With the targeting of KSA by these malicious actors, concerns about the security of the region's critical infrastructure have reached a fever pitch. The implications for affected companies, national security, and economic stability are far-reaching and alarming. As we move forward, it is essential to stay vigilant and adapt our defenses against this evolving threat landscape.

Stay ahead of the curve by following me on Twitter: @securityaffairs, Facebook, and Mastodon for the latest updates on cybersecurity threats like DragonForce ransomware.

Join the conversation:

Share your thoughts on how this incident will impact the region's security posture. Let's work together to stay informed and protect our digital assets from the ever-present threat of cyberattacks like DragonForce ransomware.