Skip to main content
Darkfield

Operator dossier

CMD ORGANIZATION is a ransomware operator currently active on public leak sites. Darkfield has indexed 15 public victims claimed by this operator between May 14, 2026 and June 15, 2026. CMD ORGANIZATION is a ransomware group first observed in May 2026, with financial gain assessed as the primary motivation based on available indicators. Due to the extremely limited public reporting on this group, comprehensive technical attribution and operational details have not yet been documented by major threat intelligence vendors or government agencies such as CISA or the FBI. Based on available data, CMD ORGANIZATION has recorded a single known victim, with targeting concentrated in the United States and focused on the engineering sector, suggesting either a nascent operation in its early stages or a highly selective targeting methodology. No publicly documented information is currently available regarding their initial access vectors, encryption methods, extortion tactics, tooling, or affiliations with other known threat actors or ransomware-as-a-service ecosystems. No notable high-profile campaigns, law enforcement actions, or confirmed rebranding activity has been publicly attributed to this group at this time. CMD ORGANIZATION should be considered an emerging or low-visibility threat actor warranting continued monitoring as additional victims or technical indicators may surface and enable more comprehensive profiling by the security research community.

Recent disclosures by CMD ORGANIZATION

All 15 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for CMD ORGANIZATION →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

CMD ORGANIZATION

15 victims indexed · first seen 2 months ago · last activity 1 month ago

15
Victims indexed
#186 of 364 tracked operators
1m
Active period
May 2026 → Jun 2026
—
Countries hit

At a glance

Status
active
First seen
2 months ago
Last activity
1 month ago
Onion sites
1 known endpoint

About

CMD ORGANIZATION is a ransomware group first observed in May 2026, with financial gain assessed as the primary motivation based on available indicators. Due to the extremely limited public reporting on this group, comprehensive technical attribution and operational details have not yet been documented by major threat intelligence vendors or government agencies such as CISA or the FBI. Based on available data, CMD ORGANIZATION has recorded a single known victim, with targeting concentrated in the United States and focused on the engineering sector, suggesting either a nascent operation in its early stages or a highly selective targeting methodology. No publicly documented information is currently available regarding their initial access vectors, encryption methods, extortion tactics, tooling, or affiliations with other known threat actors or ransomware-as-a-service ecosystems. No notable high-profile campaigns, law enforcement actions, or confirmed rebranding activity has been publicly attributed to this group at this time. CMD ORGANIZATION should be considered an emerging or low-visibility threat actor warranting continued monitoring as additional victims or technical indicators may surface and enable more comprehensive profiling by the security research community.

References

1 link

External sources curated by the MISP threat-intel community.

Recent victims

Loading…

Onion infrastructure

1 known
  • http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time CMD ORGANIZATION posts a victim.

Add CMD ORGANIZATION to your watchlist — Pro pings you within 5 minutes of any new CMD ORGANIZATION leak-site post, Telegram callout, or affiliate-rebrand inference.