A new ransomware organization has emerged in the threat landscape and is actively being tracked as the “Read The Manual” (RTM) Locker Gang. Motivated by opportunity rather than specific industries, RTM actors operate under the modus operandi of stealth, avoiding headlines in the news all while still making money from ransom demands. What is slightly different with this threat organization is that all mission dossiers and attacks are carried out by individual subgroups of the organization, adhering to strict rules of engagement set by group leaders. RTM actors will utilize social engineering and/or vulnerability exploitation to gain access into victim systems. Once compromised, threat actors will utilize numerous customized scripts to quietly encrypt their victim’s data, tactically removing data from the recycle bin and any shadow copies created from the device. After the data is communicated back to actor-controlled command-and-control (C2) servers, victims have forty-eight (48) hours to begin negotiations with the threat actors before their data gets posted on the RTM public leak site. Ransom demands are often low enough that the group does not attract significant attention from the media, fulfilling their modus operandi. CTIX continues to monitor threat organizations throughout the landscape and will provide additional details accordingly.