Background and Timeline: On February 13, 2026, the CYFIRMA research team issued an advisory regarding “Ransoomed,” a new extortion-focused ransomware strain. The malware has been identified as an emerging threat that has been active since late 2025 and is currently being promoted on various underground forums. This group follows a professional “Ransomware-as-a-Service” (RaaS) model to attract affiliates.

Modus Operandi: Ransoomed utilizes AES-256 and RSA-2048 encryption to lock a broad range of local files on Windows systems, appending the “.ransoomed” extension to each. The malware deploys a ransom note titled “!!!READ_ME!!!.txt” which provides payment instructions and tight deadlines. The actors caution victims against self-recovery and demand proof of payment be sent to a specific OnionMail address to receive the private decryption key.

Victims and Financial Impact: The attackers demand a payment of 2.5 Bitcoin (worth hundreds of thousands of dollars in 2026) to a specified cryptocurrency wallet. The financial damage includes both the ransom cost and the operational downtime associated with the data lockout. There is currently no confirmed evidence that paying the ransom leads to data restoration, and no free decryption tools are available for this specific strain.

Investigation and Agencies Involved: CYFIRMA’s Threat Discovery Process identified the malware while monitoring underground forums where the group portrays itself as a sophisticated RaaS offering. Security firms are analyzing the encryption routine to determine if any implementation flaws exist that could allow for file recovery without payment. The group’s activity is being mapped across multiple industries and geographic regions.

Arrests and Suspects: No arrests have been made, as the Ransoomed group operates through decentralized affiliates and encrypted communication channels. The actors appear to be a highly professional syndicate focused on infrastructure-level lockout for maximum leverage. They are identified as part of a trend where ransomware groups are pivoting back to data encryption as simple data-theft tactics become less lucrative.

Broader Implications and Trends: The emergence of Ransoomed confirms that ransomware remains a dangerous and evolving threat to Windows-based enterprise networks. It highlights the shift where attackers return to “decription-motivated settlements” as organizations become more resilient to pure data extortion. This incident reinforces the need for verified, offline backups as the primary defense against catastrophic data loss.