TIW Group
Attack Intelligence
TIW Group was compromised in a ransomware attack attributed to dragonforce in January 2026. The organization, operating in the Technology sector in United Kingdom, was added to the group's data leak site as part of an extortion campaign.
dragonforce operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.
TIW Group consists of two related contracting entities: Tidewater Interior Wall and Ceiling, Inc. and Mid-Atlantic Painting, Inc., offering Class-A drywall and painting services since 1998 and 2002 respectively. They cater to builders and general contractors, providing high-quality, efficient, and timely residential and commercial services. With a strong focus on customer service and a well-seasoned staff, TIW Group ensures excellence in every project with a combination of drywall and painting applications.
Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2025-5777, which may have been leveraged as initial access vectors or for lateral movement.