Six Government Agencies on Two Continents Just Warned About a Ransomware Franchise. It Even Rewrote Its Own Victim's MFA to Let Itself In.

Government Advisory Ransomware

August 2026  ·  8 min read

On August 10, the FBI, CISA, the NSA, the US Secret Service, the Department of Defense Cyber Crime Center, and South Korea's National Police jointly warned about a ransomware operation that doesn't run like a gang anymore — it runs like a franchise. The people breaking in and the people who wrote the software are no longer the same people. One documented intrusion is the kind of detail that changes how you think about multi-factor authentication. Here's how the operation is structured, what actually happened, and what stops it.

---

Most of the ransomware coverage in this series has described a single group doing everything: breaking in, moving around, encrypting, extorting. The operation described in this joint advisory works differently, and the difference matters, because it's where a lot of modern ransomware is heading.

Rather than one team running start to finish, the people who built the ransomware now license it out. They provide the software, a management dashboard, and instructions. Independent criminals — sometimes explicitly recruited former penetration testers, people who understand how networks are broken into professionally — do the actual break-ins, using the provided toolkit. The proceeds get split. Nobody involved needs to be a programmer, and nobody involved needs to be a burglar. The roles are separated, the way a franchise separates the person who owns the brand from the person who runs the shop.

6 agencies

across two continents co-signed a single advisory about one ransomware operation

The advisory carries the joint authority of the FBI, CISA, the NSA, the US Secret Service, the Department of Defense Cyber Crime Center, and South Korea's National Police Agency — built on forensic detail from real investigated intrusions. Coordination at that scale reflects a group whose targets already span government, critical infrastructure and commercial organisations across multiple continents, and whose franchise model is actively expanding its reach.

How the franchise is structured

The operation first appeared as ordinary ransomware. What changed it into something worth six agencies' attention was a business decision: rather than keep growing one team, the operators opened the software up as a service, complete with the infrastructure that implies.

Three roles, one operation

The platform The core group builds and maintains the ransomware itself — a management panel, a configurable builder that lets each affiliate tailor their attack, and payloads that run on both Windows and Linux systems. They maintain the leak site where stolen data gets published and the negotiation channel where ransom gets discussed.

The affiliates Independent operators — including, according to the advisory, people specifically recruited for offensive security experience — run the actual intrusions using the provided toolkit. They find the target, break in, move around, and deploy the payload. What used to require building your own tools from scratch is now a matter of using someone else's, competently.

The brand The group has already changed its public name once, adopting a new alias as it expanded the affiliate program. Rebranding is a defensive move of its own — it complicates tracking, resets some reputational damage, and lets the operation keep growing under new cover while functioning identically underneath.

The franchise structure is what makes this a bigger problem than a single skilled group, not a smaller one. Skill was always the bottleneck on how many attacks a ransomware operation could run. Separate the software from the person using it, and the bottleneck moves — from "how many capable attackers exist" to "how many people can be recruited to run someone else's tool." That number is much larger, and it's the same shift toward lowered skill barriers this series has tracked across several posts this year.

What one investigated intrusion actually looked like

The advisory is built on forensic detail from real cases, not a general description. Two findings from those investigations are worth understanding on their own.

The path into one victim's systems

1

Initial access through internet-facing remote-access infrastructure. The affiliates primarily got in through known weaknesses in VPN and firewall equipment exposed to the internet — the same category of device covered in our earlier post on network hygiene.

2

Lateral movement and credential harvesting. Once inside, the affiliates moved between systems and extracted password data directly from the organisation's domain controllers — the central directory that manages every account's access.

3

The authentication system itself was tampered with. In one documented case, the actors altered the underlying logic of a remote-access portal so that a one-time code of their own choosing would always be accepted as valid — regardless of what the legitimate system was supposed to require.

4

Evidence removal. Command history and access logs were deliberately cleared to slow down the eventual investigation.

5

Exfiltration before encryption. Documents, databases, personal information and internal communications were copied out before anything was locked, so the extortion threat exists even if backups make encryption recoverable.

Read step three again, because it's the detail that should reshape how you think about multi-factor authentication. This was not a case of stolen credentials or a phished login. The organisation's MFA was switched on, configured, and working exactly as intended right up until the attackers changed what "working" meant. They didn't get past the checkpoint — they rewrote the checkpoint. That's a different, deeper level of access than any password-theft technique in this series, and it's a reminder that MFA depends entirely on the integrity of the system enforcing it.

2 continents worth of law enforcement agencies co-authored the advisory, reflecting forensic evidence gathered across multiple independent investigations Joint Advisory AA26-222A, Aug 2026

1 rebrand already completed by the operators specifically to support the affiliate program's expansion and complicate tracking Joint Advisory AA26-222A

2 systems targeted for extortion leverage on every intrusion — the data itself, stolen before encryption, and the encrypted systems, held for ransom. Two threats, one payment demand. Joint Advisory AA26-222A

The one piece of genuinely good news

Buried in the technical detail is something unusual: researchers examining the ransomware's Linux-targeting component found that it generates its encryption keys so poorly that, in some cases, defenders can reconstruct them from other evidence on the system and recover files without paying anything. This is rare — most ransomware implements its cryptography competently, because getting it wrong is bad for the operators' business model.

This is exactly why acting fast and getting the right help matters more than paying immediately. If your business is ever hit by any ransomware variant, the honest first move is not deciding whether to pay — it's finding out whether you have to. Engage an incident response professional before making that call. Sometimes the attacker's own mistake is the fastest way out.

What this means for a small business specifically

The targets named in the advisory are large — governments, critical infrastructure, sizeable commercial organisations. It's tempting to read that as reassurance. It shouldn't be, for the same reason the franchise structure exists in the first place: affiliates are independent operators looking for targets, and a franchise model rewards volume over selectivity. The tools that get an affiliate into a well-defended government network work just as well, with less resistance, against a small business running the same category of exposed VPN appliance with the same unpatched firmware.

The techniques in this advisory are also not exotic. Exposed remote-access infrastructure, credential harvesting from a directory service, log deletion to buy time — every one of these is a documented, addressable weakness, not a capability unique to a nation-state.

Five things to check this week

1

Patch internet-facing VPN and firewall equipment first

Free · Do first

This was the documented entry point. Remote-access infrastructure sits permanently exposed to the internet and is exactly what affiliates scan for. Confirm with whoever manages your systems that firmware and software on these devices is current, and ask when it was last checked.

2

Protect your directory service like the crown jewel it is

Review · Free

The domain controller that manages every account's access is a single point that, once reached, hands an attacker the keys to everything. Ask whether it's monitored for unusual access attempts and whether administrative access to it is tightly restricted and logged.

3

Send your logs somewhere the attacker can't reach them

Low cost

Evidence deletion is a standard step in this playbook, and it works because logs usually live on the same systems the attacker already controls. Forwarding logs to a separate, restricted system means deleting the local copy no longer erases the trail — and gives investigators something to work with if the worst happens.

4

Keep offline, tested backups — because encryption isn't the only threat

Essential

Double-extortion means backups solve only half the problem: they get you your systems back, but they don't undo data already stolen. Still essential, still non-negotiable, and worth confirming — as our earlier post on this topic put it — that a restore has actually been tested, not just configured.

5

Have a written incident response plan, and know who to call

Free

Given the rare possibility of recovering without paying in some cases, speed and the right expertise on the first call matter enormously. A documented plan with named decision-makers and a response contact already identified is the difference between an organised response and a panicked one.

The Veriti Spottr CyberScore's Exposure and Security Posture components track exactly the weaknesses this advisory describes — exposed remote-access infrastructure, directory service hardening, and incident readiness. Our Threat Intelligence feed surfaces confirmed-exploited vulnerabilities in the same category of equipment named here. A franchise model means more affiliates looking for the same easy openings. Knowing which of those openings you have is the whole defence.

The short version

This isn't one sophisticated group anymore — it's a platform, licensed out to whoever wants to run it, expanding specifically because the model works. Six government agencies across two continents thought that expansion was worth a joint warning. One of the investigated intrusions shows attackers who didn't just get past multi-factor authentication, they rewrote what it meant for a code to be valid.

None of the fixes are exotic. Patch the internet-facing edge, protect the directory that controls every account, get your logs somewhere safe, keep backups that have actually been tested, and know who you're calling before the day you need to. The operation scaled by industrialising the attack. The defence hasn't had to change to match it — it's the same list this series has repeated all year, and it still works.

Find out whether the openings this advisory describes exist in your business.

View the Threat Intelligence feed → Find Out More About Veriti Spottr →

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com