Aegis Project Controls targeted by Dragonforce ransomware group

• Ransomware group: Dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: February 28, 2026

The ransomware group known as Dragonforce has listed approximately 213.26 GB of data, which they claim belongs to the United States-based professional services firm Aegis Project Controls, on their dedicated leak site. The announcement, posted on February 28, 2026, marks a significant escalation in the pressure being applied to the organization by the threat actors.

Details of the claimed attack

According to the claims made by Dragonforce, the initial breach occurred on January 26, 2026. The group has utilized its leak site to list the stolen data in an attempt to exert maximum pressure on the organization. Notably, the group has adopted a highly aggressive and threatening tone toward the leadership of Aegis Project Controls. The threat actors have stipulated a 15-day deadline for compliance to avoid further consequences.

In their communication, the group has explicitly accused the organization of failing to contact the FBI following the incident. This tactic is a common characteristic of modern ransomware operations, where attackers attempt to isolate the victim from law enforcement to increase the likelihood of a ransom payment. By publicly criticizing the organization's response, the group aims to damage the firm's reputation and create internal pressure within the company's management structure.

Data allegedly involved in the breach

The announcement claims that the stolen data contains highly sensitive documentation. The group asserts that the files include information related to military-critical facilities, biosecurity laboratories, and critical infrastructure projects. Previews provided via screenshots show various technical documents that appear to be related to the company's core business operations, specifically regarding construction scheduling and project management services.

The specific types of data mentioned in the listing include:

• Project documents
• Military facility data
• Critical infrastructure records
• Biosecurity laboratory data

About Aegis Project Controls

Aegis Project Controls is a consulting firm operating within the construction industry. The company provides a specialized suite of services, including 4D scheduling, project management, construction scheduling, and professional training. They focus on large-scale infrastructure and critical facility projects, which often involve complex logistics and high levels of regulatory oversight.

Analysis and potential implications

The alleged presence of data concerning military and critical infrastructure facilities suggests that this incident may pose significant risks to national security. Because the organization is located in the United States, the breach could potentially trigger federal investigations and lead to complex legal consequences under relevant national regulations. The nature of the data suggests that the impact extends beyond simple corporate espionage, moving into the realm of national safety and security.

The group's use of double extortion—a method where attackers both encrypt data and threaten to leak it—combined with direct threats against company leadership, significantly increases the risk of reputational damage. Furthermore, such high-profile leaks often lead to secondary phishing attacks, where criminals use the stolen information to craft highly convincing social engineering campaigns against the organization's clients or partners.

While public information regarding the Dragonforce group remains limited, their operational model suggests a sophisticated structure. The group reportedly provides infrastructure to various affiliates, which indicates that this specific attack may have been supported by a broader, organized cybercriminal ecosystem. For organizations in the professional services and construction sectors, particularly those handling critical infrastructure, this incident highlights the necessity of robust incident response plans and strict adherence to regulatory reporting requirements to mitigate the fallout of such sophisticated threats.