Six Government Agencies on Two Continents Just Warned About a Ransomware Franchise. It Even Rewrote Its Own Victim's MFA to Let Itself In.
Government Advisory Ransomware August 2026 · 8 min read On August 10, the FBI, CISA, the NSA, the US Secret Service, the Department of Defense Cyber Crime Center, and South Korea's National Police jointly warned about a ransomware operation that doesn't run like a gang anymore — it runs like a franchise. The people breaking in and the people who wrote the software are no longer the same people. One documented intrusion is the kind of detail that changes how you think about multi-factor authentication. Here's how the operation is structured, what actually happened, and what stops it. Most of the ransomware coverage in this series has described a single group doing everything: breaking in, moving around, encrypting, extorting. The operation described in this joint advisory works differently, and the difference matters, because it's where a lot of modern ransomware is heading. Rather than one team running sta...