Six different extortion crews listed Malaysian organizations on their leak sites in the past seven days, one claim each, according to IntelFusions incident tracking. That is Malaysia's busiest week in the past 12, where the weekly count otherwise ran between zero and four, and it includes some of the country's best-known company names.
These are unverified claims posted by the gangs themselves. None of the organizations named below has confirmed a breach in anything we have seen, and a leak-site listing is not proof that data was stolen.
Big names, many different crews
The most prominent name is MISC Group, listed by Rhysida on October 26 under the energy and utilities sector. The name matches Malaysia's large energy shipping group, though the listing in our data carries no detail beyond the name. The same day the Scarlettgroup crew posted Mah Sing Group, which its listing describes as a leading Malaysian property developer with interests in healthcare and plastics manufacturing.
On October 27 Crypto24 listed Antah HealthCare Group, a healthcare business. The rest of the week brought Krybit's claim against Main Place Mall in Subang Jaya, Orova's against jeweller Wah Chan Consolidated, and an anonymous "Company #112" teaser from N0n, described only as a Malaysian telecommunications services firm. N0n withholds names until a settlement window closes, so that entry may yet be named.
Main Place Mall is worth a second look: it also appeared on NetRunner's leak site on October 2, so two separate crews have now claimed the same mall within a month. Double listings can mean a genuine second intrusion, a resold dataset, or a crew recycling someone else's work, and the leak sites do not say which.
A month, not just a week
The week sits on top of an already busy October. Over the last five weeks our data holds 14 Malaysian claims spread across 12 different crews, including Qilin's listing of water asset manager Pengurusan Aset Air Berhad, LockBit's claim against telecom infrastructure firm OCK Group Berhad, and BYOD's against pewter maker Royal Selangor.
The spread is the point. This is not one gang working through a target list. No single crew accounts for more than two of the 14 claims, which suggests Malaysian organizations are turning up in many unrelated operations rather than being singled out by any one group. Energy, utilities, telecoms and property all appear.
Check the edge, then check with MyCERT
Malaysia is rated a high-targeting country on its IntelFusions country profile, and its national CERT is MyCERT. Organizations that recognize a supplier or partner in these listings should ask that partner directly rather than wait for a disclosure, review any shared credentials or VPN access, and check internet-facing systems for unpatched software and unexpected accounts. With this many different crews in play, there is no single set of indicators to hunt for, so the basics of patching, multi-factor authentication on remote access, and offline backups do most of the work.
One busy week is not a trend on its own. Twelve crews in five weeks is closer to one, and it says Malaysian networks are on a lot of target lists at once.
This briefing is provided by IntelFusions for informational and defensive purposes only. It summarizes extortion claims published by ransomware leak sites. Those claims are made by the attackers, are unverified, and may be false, exaggerated, or recycled from earlier breaches. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.