cmd organization Ransomware Group
Ransomware group profile
Description
CMD Organization is a new ransomware group that surfaced in May 2026, claiming to be an IT security firm while engaging in ransomware activities. Their unique auction-based extortion model incentivizes financial gain through public listings of stolen data, setting them apart from traditional groups.
Key insights
- •Utilizes an auction-based extortion model to maximize ransom payments.
- •Exploits vulnerabilities in public-facing applications for initial access.
- •Focuses on data extraction from information repositories.
- •Employs tactics like double extortion and public data leaks on dark web platforms.
- •Operates using a combination of onion sites and clearnet domains.
Threat Level & Status Breakdown
For cmd organization · Based on incidents in selected period
Recent activity
Monthly attack count for cmd organization in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for cmd organization
T1213
Data from Information Repositories
T1071
Application Layer Protocol
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1190
T1190
T1041
T1041
T1037
T1037
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(15)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Stewart Belland & Associates Inc. | Canada | Unknown | 4 days ago | |
| Contact Group | Australia | Unknown | 5 days ago | |
| Collge Mont Notre-Dame de Sherbrooke | Canada | Unknown | 5 days ago | |
| Rondout Electric | United States | Unknown | 5 days ago | |
| Finance Yorkshire | United Kingdom | Unknown | 26 days ago | |
| Mount Royal University | Canada | Unknown | 28 days ago | |
| METCO Services, Metco Southeast | United States | Unknown | about 1 month ago | |
| Kohinoor Mills | India | Unknown | about 1 month ago | |
| Union Tractor | United States | Unknown | about 1 month ago | |
| Southern design RV | Australia | Unknown | about 2 months ago | |
| New FACOM Co., Ltd. | Japan | Unknown | about 2 months ago | |
| North Dallas Shared Ministries | United States | Unknown | 2 months ago | |
| Stonehenge Therapeutic Community | United States | Unknown | 3 months ago | |
| Goodstone Group | Australia | Unknown | 3 months ago | |
| Cytek Biosciences | United States | Unknown | 3 months ago |
Affected countries(14)
Countries where this group has been reported to target or leak victims.