Du listed on dragonforce leak site

• Ransomware group: dragonforce
• Country: United Arab Emirates
• Sector: Technology
• Announcement date: November 21, 2025

The United Arab Emirates-based telecommunications operator Du has been listed on a leak site by the group known as dragonforce. The listing, which was discovered on November 21, 2025, follows a claim by the threat actor that they have successfully breached the organization's systems.

The claims made by dragonforce

The dragonforce group has posted a listing for the entity Du on its dedicated leak site. According to the group's announcement, the incident involving the organization is claimed to have occurred on November 20, 2025. Through this listing, the group alleges that it has gained unauthorized access to the organization's data.

Ransomware leak sites are a common tool used by cybercriminal groups to exert pressure on victims. In many modern ransomware campaigns, actors employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public platform serves as a powerful lever to coerce the victim into paying a ransom. By publishing the names of high-profile targets, these groups aim to maximize the visibility and psychological impact of their attacks.

Details regarding the data involved

At this stage, there is no screenshot or detailed information available regarding the nature of the leaked or threatened data. The listing names no specific data types or file categories.

The organization profile

Du is one of the two main telecommunications operators in the United Arab Emirates. The company provides a wide array of essential services, including fixed-line, mobile telephony, internet, and digital television services. Additionally, the company is involved in providing data center and satellite services, making it a critical component of the regional technological landscape.

Potential risks and industry implications

This incident may pose potential risks to the organization's telecommunications infrastructure and customer data. While public information regarding the dragonforce group is limited, it is reported that the group has adopted a model of providing infrastructure and branding to affiliates. This model often allows various actors to conduct attacks using a unified identity, which can complicate attribution and defensive efforts.

If a data breach is confirmed, it could lead to the exposure of subscriber personal information and secondary risks such as identity theft. Furthermore, the organization may face legal processes under regulatory requirements within the telecommunications sector. Because the content of the listing is limited, additional evidence may be required to make a definitive assessment regarding the scope and reality of the attack.

For organizations operating within the telecommunications sector, such threats highlight the necessity of robust defensive postures. Common defensive steps include implementing multi-factor authentication across all access points, maintaining rigorous patch management schedules, and conducting regular network segmentation to prevent lateral movement by attackers. Furthermore, continuous monitoring of data egress can help detect unauthorized transfers before significant amounts of information are exfiltrated. Given the critical nature of telecommunications infrastructure, maintaining high levels of redundancy and incident response readiness is essential to mitigate the impact of potential breaches.