Recent threat intelligence reports confirm that the pksf-bd.org Palli Karma-Sahayak Foundation (PKSF), a major non-profit development and financial institution in Bangladesh, has been targeted in a ransomware attack. The incident was officially discovered on September 28, 2026, at 18:03 UTC.
The MedusaLocker ransomware group has claimed responsibility for the intrusion. According to currently available threat intelligence, the exact ransom demand and the total volume of exfiltrated data remain undisclosed. However, preliminary leak data from the threat group indicates the extraction of 13 organizational emails to establish proof of the breach. A secondary claim of an attack on PKSF was also published by the threat group Bavacai on October 1, 2026, indicating sustained threat actor interest in the organization.
PKSF plays a central role in poverty reduction and microenterprise funding across Bangladesh. When institutions of this scale are compromised, the disruption risks impacting grassroots financial services and interconnected networks, including mobile financial services (MFS).
From a Digital Forensics and Incident Response (DFIR) perspective, this incident reinforces several critical priorities for the financial and development sectors:
- Credential and Phishing Defense: Historical threat intelligence shows that PKSF-related credentials have previously appeared in third-party data breaches and combo lists. Phishing and stolen credentials remain the most common initial access vectors for syndicates like MedusaLocker. Proactive credential monitoring is a strict requirement.
- Forensic Readiness: Maintaining robust, immutable logs across all network endpoints and integration APIs is necessary to rapidly trace lateral movement and verify the exact scope of data exfiltration.
- Data Resilience: Organizations must maintain tested, offline backups to mitigate operational downtime during the containment and recovery phases.
As cybercriminals increasingly target regional financial and development institutions, shifting from reactive mitigation to proactive, intelligence-driven defense is essential.
Sources
- HookPhish (September 29, 2026): Ransomware Group medusalocker Hits: PKSF — Palli Karma-Sahayak Foundation. Details the initial breach timeline (September 28, 2026, at 18:03 UTC).
- Breachsense (September 29, 2026): Palli Karma-Sahayak Foundation Data Breach Report. Confirms MedusaLocker's claim and historical credential exposure intelligence.
- SOCRadar (October 1, 2026): Palli Karma-Sahayak Foundation Ransomware Attack by Bavacai. Tracks the secondary claim by the Bavacai threat group.
- PC Risk Malware Research (May 2026): BAVACAI Ransomware Analysis. Provides context on Bavacai's relationship to the MedusaLocker ransomware family and its encryption methodologies.