CMD Organization - New Ransomware Operator Moves to Place Public Bidding Wars on Ransomed Data

CMD Organization is an emerging ransomware group that first posted victims to their public leak site in early April 2026. CMD Organization’s operating model appears similar to other ransomware operators, leveraging double extortion by both encrypting and exfiltrating data to ransom for profit. In the investigation our responders handled, several weeks of dwell time were observed between initial access and ransomware deployment. While it cannot be confirmed, the gap is consistent with groups that buy access from IABs rather than gaining access on their own. Additional review of tradecraft and capability indicates the group may be operating with purchased or outsourced tooling. The ransomware locker exhibits a limited feature set when compared to binaries from other groups. CMD’s locker lacks built-in propagation capability and performance options seen within more mature examples from other groups. Although able to effectively execute their attack, we assess the group as less mature in operations and more dependent on outsourced access methods and tooling. The subtle practice of using commas for monetary fractions within their bidding panel suggests the platform may be developed outside of Western influence. At the time of writing, the group has posted five victims on their leak site.