Qilin, the crew that has named more Malaysian organisations than any other in our tracking, added Pengurusan Aset Air Berhad (PAAB) to its leak site on 18 October. PAAB is not a household name, but it sits close to the centre of Malaysia's water system: on its own website the company says it plans, develops, rehabilitates and finances water infrastructure, and describes itself as part of the government's effort to restructure the country's water services industry. The independent tracker ransomware.live recorded the listing at 09:47 UTC that day.
The listing is a claim made by the gang, not a confirmed breach. Qilin's post, as captured by the tracker, carries no description, no data sample and no stated leak size, and PAAB's website showed no incident notice when we checked. Nothing published so far suggests any effect on water supply.
Three infrastructure names in six days
PAAB was the third Malaysian organisation tied to essential services to appear on a leak site in a week. On 17 October LockBit listed OCK Group Berhad, which the gang's own post describes as a provider of telco network services and infrastructure in Malaysia. On 13 October a newer crew, Orova, listed Alfameli Group, which ransomware.live's record describes as a privately owned oil and gas support company working in offshore catering, facilities management and manpower supply.
Three different crews posted these, and nothing connects them beyond the country. The volume is not unusual either: our incident tracking has logged three Malaysian claims a week for the past two weeks, in line with its summer pattern. What has changed is who is being named. A water infrastructure body, a telecoms contractor and an offshore energy supplier are the sort of targets where a quiet intrusion matters more than the leak-site post itself. In September another crew, Dire Wolf, listed the Port of Tanjung Pelepas, so this is not the first time in recent weeks that Malaysian infrastructure has turned up on these sites.
Qilin keeps coming back to Malaysia
Qilin accounts for 26 of the 96 Malaysian claims in our data, nearly three times as many as the next crew, The Gentlemen. It also posted 87 claims worldwide in the last 30 days, the third-highest of any group. Its Malaysian listings since late August include KenEp Resources, which our data files under energy and utilities, and CareClinics, filed under healthcare. Background on the group, which our Atomic Fusion taxonomy calls Whip Flux, is on our Qilin actor page, and our earlier reporting on extortion crews turning on ports and fuel terminals covers the wider infrastructure trend.
Report to MyCERT, and distrust lures that name them
Any of the three that finds evidence of an intrusion should report it to MyCERT, Malaysia's national computer emergency response team. Suppliers, contractors and partners of the three named organisations should treat unexpected invoices, payment-detail changes or project documents that reference them with suspicion until the companies say otherwise, and should review any remote access those firms hold into their own networks. More on Malaysia's national defences is on our Malaysia country page.
None of the three has publicly confirmed an incident that we could find, and leak-site claims are sometimes wrong. But when these lists start to carry the organisations behind a country's water and telecoms infrastructure, it is worth paying attention before any data starts to appear.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.