Signalis
sign in--:--:--UTC
Threat actors

Cmdorganization

☆ pin
Also known as CMD Organization
Reports
39
First seen
May 14, 2026
Last seen
Jul 31, 2026
Motivation
Financial

Targeting

Sectors
Healthcare ×8Education ×7Manufacturing ×7Professional Services ×5Retail & E-commerce ×4Energy & Utilities ×2Other ×2Financial Services ×1
Victim regions
×1
×20
United States×20
Canada×5
Australia×3
India×1
United Kingdom×1
Ghana×1
Japan×1
Pakistan×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×1T1005 Data from Local System ×1T1486 Data Encrypted for Impact ×1T1490 Inhibit System Recovery ×1

Indicators

domain ×85ip_v4 ×63hash_sha1 ×4hash_md5 ×3

Indicator values are available on Pro and via the API.

Recent reports

High

Cmdorganization claims breach of Stewart Belland & Associates Inc.

ransomware.liveHigh

Cmdorganization claims Contact Group in ransomware extortion post

ransomware.liveHigh

Cmdorganization publishes Collège Mont Notre-Dame de Sherbrooke as ransomware victim

ransomware.liveHigh

Cmdorganization publishes Rondout Electric as ransomware victim

ransomware.liveHigh

Cmdorganization claims B-K Tool & Design breach on ransomware.live

ransomware.liveHigh

Cmdorganization publishes T. Simon Jewelers as ransomware victim

ransomware.liveHigh

Cmdorganization Claims Attack on Saint George's School

ransomware.liveHigh

Cmdorganization claims Target Energy Solutions victim

ransomware.liveHigh

Cmdorganization publishes Els for Autism Foundation as ransomware victim

ransomware.liveHigh

Cmdorganization claims Golden Star Resources in ransomware extortion

ransomware.liveHigh

Cmdorganization publishes Finance Yorkshire as ransomware victim

ransomware.liveHigh

Mount Royal University confirms breach; CMD Organization claims attack and demands ransom

Bleeping ComputerHigh

Cmdorganization publishes Mount Royal University as ransomware victim

ransomware.liveHigh

Cmdorganization ransomware: Medlink Georgia health center breached

ransomware.liveHigh

Cmdorganization claims Port Angeles Composite LLC ransomware attack

ransomware.liveHigh

Cmdorganization claims Lørenskog kommune victim on ransomware.live

ransomware.liveHigh

Cmdorganization claims METCO Services, Metco Southeast victim

ransomware.liveHigh

Cmdorganization claims Fidelity Security Group victim on ransomware.live

ransomware.liveHigh

Cmdorganization publishes Kohinoor Mills as ransomware victim

ransomware.liveHigh

Cmdorganization publishes Coldstat Refrigeration as ransomware victim

ransomware.liveHigh

Cmdorganization claims EON Meditech Pvt as new ransomware victim

ransomware.liveHigh

Cmdorganization claims Union Tractor ransomware victim

ransomware.liveHigh

Cmdorganization publishes Wall ISD as ransomware victim

ransomware.liveHigh

Cmdorganization claims Pinnacle Re-Tec victim on ransomware.live

ransomware.liveHigh

Cmdorganization publishes Southern Design RV as ransomware victim

ransomware.liveHigh

Cmdorganization ransomware gang publishes New FACOM Co., Ltd. as victim

ransomware.liveHigh

Cmdorganization claims SeeWriteHear in ransomware attack

ransomware.liveHigh

Cmdorganization claims Lake Washington School District in ransomware extortion post

ransomware.liveHigh

Cmdorganization publishes Lee Law Offices as ransomware victim

ransomware.liveHigh

Cmdorganization claims Capital Family Physicians victim on ransomware.live

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans