[DRAGONFORCE] – Ransomware Victim: Latona Trucking

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the DRAGONFORCE Onion Dark Web Tor Blog page.

Ransomware group:
DRAGONFORCE
Victim name:
LATONA TRUCKING

AI Generated Summary of the Ransomware Leak Page

On October 26, 2025, Latona Trucking, a United States-based transportation and logistics provider, was listed as a ransomware victim on a leak page attributed to the threat group dragonforce. The entry identifies Latona Trucking as operating in the Transportation/Logistics sector, with 100–249 employees and annual revenue of 1–5 million USD. The post notes the existence of a claim URL, indicating the attackers provide a link for verification or engagement; however, the metadata does not specify a compromise date or clearly categorize the impact as data encryption or data exfiltration. Because no explicit compromise date is present, the post date—2025-10-26 05:23:03.092966—is treated as the disclosure date. The page references the victim’s site latonatrucking[.]com to establish the business identity, with the domain shown defanged for safety. No additional victim names are given in the provided excerpt beyond Latona Trucking.

No screenshots or images are reported on the leak page (images_count is 0), and there are no downloadable files or media listed in the metadata. The data does not include a ransom amount or a stated demand, and the lack of explicit impact details indicates that the post does not confirm whether data was encrypted or simply leaked within this dataset. Given the absence of a listed compromise date, the published date functions as the reference timestamp for the incident. The presence of a claim URL suggests a conventional ransom-facing post structure, but the exact data types compromised and the scope of the breach remain unspecified in the available information.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features