A prominent ransomware organization is undergoing a significant evolution, rebranding itself as a “cartel” and broadening its business approach. This shift is indicative of a rising trend in cybersecurity referred to as RaaS, or ransomware-as-a-service.

As reported by cybersecurity firm Secureworks, which acquired screenshots of the announcement shared on an underground forum on March 19, the group known as DragonForce is transitioning to a decentralized framework. This innovative strategy enables other ransomware operatives to utilize DragonForce’s infrastructure and tools, presenting them under their unique branding.

In essence, DragonForce is providing a “white label” solution — akin to how Costco markets products under its Kirkland Signature label that are actually produced by recognized manufacturers. Affiliates will have the opportunity to rebrand DragonForce’s ransomware tools as their own offerings.

“This approach distinguishes DragonForce from other RaaS providers and may entice a broader spectrum of affiliates,” Secureworks articulated. “The accessible infrastructure and intuitive tools pave the way for threat actors who might lack advanced technical abilities.”

Although the concept of increasing accessibility to ransomware is concerning, a DragonForce spokesperson informed Bleeping Computer that the organization is “exclusively financially driven” while asserting adherence to a “moral compass,” steering clear of attacks on specific healthcare entities.

Under the newly established “ransomware cartel” framework, DragonForce will retain a 20 percent share of any ransom revenues, according to Bleeping Computer. Affiliates will also receive a range of services, including a management system for their operations, file storage, round-the-clock server oversight, and “battle software” equipped to target platforms such as ESXi, NAS, BSD, and Windows.

By providing these tools and services to cybercriminals with less technical prowess, DragonForce seeks to considerably enhance its reach and clientele.