The company that runs Manila's LRT-1 light rail line and Vietnam's biggest software exporter both turned up on ransomware leak sites in the last week, according to IntelFusions incident tracking. Qilin listed Light Rail Manila on October 30, and The Gentlemen named FPT Software a day later, alongside Indonesian concrete maker WIKA Beton.
These are unverified claims posted by the gangs themselves. None of the organizations named here has confirmed a breach in anything we have seen, and a leak-site listing is not proof that data was taken.
A rail operator and a telecom on Qilin's list
Light Rail Manila Corporation is the private operator of LRT-1, one of the main rail lines serving Metro Manila. Qilin's listing gives nothing beyond the name and the operator's web domain, so it is not clear what, if anything, was reached, and there is no sign in our data of any disruption to train services. The listing was one of 11 that Qilin posted that day.
Five days earlier Qilin listed Ooredoo Myanmar. The entry pairs that name with a U9 web domain: Ooredoo sold its Myanmar business in 2022, and the network has since traded as U9. If the claim is genuine, it concerns a national mobile operator in a country where, according to our Myanmar profile, no national CERT is listed to coordinate a response.
The Gentlemen's one-day dump
FPT Software and WIKA Beton were part of roughly 50 listings The Gentlemen posted on October 31, about five times the crew's average active day in our data over the past three months, and well above its previous one-day high of 37. The crew's own write-ups describe FPT Software as Southeast Asia's largest IT services company, with clients that include large multinationals, and WIKA Beton as a listed unit of Indonesia's state-owned Wijaya Karya group that supplies bridge girders and railway sleepers to national infrastructure projects. Those descriptions are the gang's marketing, not verified figures.
FPT Software is the one to watch. An IT services firm holds access to its customers' systems and code, so a genuine intrusion there can matter more to the clients than to the firm. That is speculation until FPT or a customer says otherwise, but it is the reason the listing deserves attention.
The rest of the week was smaller: Crypto24 named Philippine technology firm DATEM, and Whitearmor posted Batam shipbuilder KTU Shipyard with what it called a sample file and a screenshot as proof of access. These follow six crews hitting Malaysia earlier in the week and an October that already saw Mat Bao and Thai Lion Air on leak sites.
Ask suppliers now, then report to CERT-PH or VNCERT
Customers of FPT Software, and partners of the other organizations named, should not wait for a disclosure. Ask the supplier directly whether it is investigating, review any VPN, remote-support or shared accounts it holds in your environment, and rotate credentials that cross that boundary. Organizations in the Philippines can report to CERT-PH, the national CERT listed on our Philippines profile, and Vietnamese organizations to VNCERT/CC.
None of these listings proves a breach. What they show is that the region's transport, telecom and outsourcing backbone is now squarely on the target lists of the two busiest extortion crews in our data this week, with 54 and 46 listings respectively.
This briefing is provided by IntelFusions for informational and defensive purposes only. It summarizes extortion claims published by ransomware leak sites. Those claims are made by the attackers, are unverified, and may be false, exaggerated, or recycled from earlier breaches. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.