Beazley Details CMD Organization Ransomware Intrusion and Public Data-Bidding Model
Summary
Beazley Security details a CMD Organization intrusion involving an SEO-poisoned lure, a 25-day dwell, backdoor persistence and GPO/SYSVOL ransomware deployment; the group’s leak site also offers crypto bidding for stolen data.
Key points
- Beazley responders investigated an intrusion attributed to CMD Organization or an affiliate using the group’s locker; the group began posting victims in early April 2026.
- CMD’s leak site includes a crypto-bidding panel for stolen data. Beazley testers submitted a bid, but received no follow-up; responders said the panel may still be in a beta or conceptual phase.
- A Bing SEO-poisoned lure led the victim to a fake-PDF archive containing a JavaScript loader that launched an obfuscated PowerShell payload.
- Responders observed about 25 days between initial access and encryption. They assessed that an initial access broker may have supplied access, but could not confirm this.
- The observed activity included Advanced IP Scanner reconnaissance, credential-based remote execution with Invoke-SMBRemoting, and a backdoor DLL that persisted through startup scripts and Run registry keys disguised as Microsoft Teams.
- The locker was distributed through GPO and SYSVOL and used ChaCha20 and RSA for encryption. Data exfiltration was confirmed by the threat actor, but investigators could not obtain evidence of the tooling or destination.
Article Details
- Attack Vectors
- An SEO-poisoned Bing search lure led the victim to download a fake PDF packaged in an archive containing an encoded JavaScript loader.
- The JavaScript loader was executed with cscript.exe and launched an obfuscated PowerShell payload that contacted C2 infrastructure for additional code.
- Invoke-SMBRemoting was used with harvested victim-account credentials for remote command execution.
- PowerShell scripts were staged in the victim's HKEY_USERS Run registry keys to persist the Meow backdoor.
- The CMD locker was distributed across the victim network through GPO and SYSVOL, encrypting files after approximately 25 days of observed dwell time.
- Data exfiltration was confirmed, but investigators could not recover evidence identifying the exfiltration tool or destination.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cmdofficial[.]com | CMD Organization leak-site domain; its TLS certificate and DNS records were observed when the group's infrastructure emerged. |
| IPV4 | 167[.]99[.]233[.]78 | C2 server contacted by the malicious PowerShell payload to retrieve additional code. |
| IPV4 | 188[.]190[.]2[.]165 | C2 server reported for the Meow backdoor, which sent HTTPS check-ins to it. |
| IPV4 | 209[.]99[.]186[.]211 | Historical IP address associated with the CMD Organization clearnet leak site before it was proxied behind Cloudflare. |
| URL | hxxp[:]//167[.]99[.]233[.]78/mbd | Malicious JavaScript loader URL used to retrieve the payload. |
| URL | hxxp[:]//213[.]165[.]47[.]49/b0c9ed38f2b14c119546.php | C2 URL unpacked by the PowerShell payload into memory. |
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesInvoke-SMBRemoting was used for remote command execution in the victim environment.T1027 · Obfuscated Files or InformationThe loader was encoded and the PowerShell payload was described as complex and obfuscated.T1046 · Network Service DiscoveryAdvanced IP Scanner was used for network reconnaissance after initial access.T1059.001 · PowerShellThe JavaScript loader launched an obfuscated PowerShell payload, and PowerShell scripts were also used for backdoor persistence.T1059.007 · JavaScriptThe encoded JavaScript loader was executed through cscript.exe.T1071.001 · Web ProtocolsThe payload used HTTP-based C2 URLs, and the Meow backdoor sent check-ins over HTTPS.T1078 · Valid AccountsThe operator used harvested credentials from a victim account for remote command execution.T1105 · Ingress Tool TransferThe PowerShell payload contacted its C2 server to retrieve additional code snippets.T1484.001 · Group Policy ModificationThe CMD locker was propagated through the victim network using GPO and SYSVOL.T1486 · Data Encrypted for ImpactThe CMD locker encrypted victim files; the observed incident used full file encryption.T1547.001 · Registry Run Keys / Startup FolderPowerShell scripts were staged as startup items in the victim's HKEY_USERS Run registry keys.
Threat Actors
Malware
Vendors
Products
Tools
Advanced IP ScannerThe threat actor made use of Advanced IP Scanner for additional reconnaissance once inside the environment, a network scanning utility package that we commonly see in ransomware engagements.Invoke-SMBRemotingAfter initial mapping recon, Invoke-SMBRemoting was used with harvested credentials from the original victim’s account to perform remote command execution.PowerShellThe attack began with an SEO-poisoned Bing lure that delivered a malicious JavaScript loader and PowerShell payload.