MISC Group
Energy & Utilities · Malezya
MISC Group Incorporated in 1968, MISC Group is a world leading provider of international energy-related maritime solutions and services.29,841 files , 28.4 GBComplete command workstations: Master, Chief Officer and Bridge user folders - 16,918 files / 15.5 GB, including PST mail archives;Crew personal data (PDPA breach): IMO FAL Form 5 crew lists for ~30 seafarers with passport numbers (Malaysia/Philippines/Indonesia/India), Seafarer Employment Agreements with DOB, home addresses and salaries, a full scan of the 4th Officer's PRC passport;Every ship's password: ECDIS, CCTV, AIS, fire & gas alarm panels, door access codes, the Ship Security Plan (ISPS) password, NS5/Dualog mail accounts, domain admin credentials, OCIMF/SIRE web account;Internal investigations: complaint against the Chief Engineer (on-board assault/harassment, 25.08.2026), FR-HR25 investigative report;Incidents: vessel listing during (de-)ballasting - twice, one incident not reported to the flag state; a series of near-misses (VDR sensor failure, radar misuse during collision avoidance);Compliance gap: ~20 internal ISM non-conformities (rusted cargo pipelines, HV gloves expired since 2021) vs 'clean' statutory ABS audits of 17.10.2025; Japan PSC deficiency (Himeji, 09.12.2025) + Statements of Fact from 4 officers;Drydock & charter documentation: repair specs (SQLite MSL), ExxonMobil/APLNG delivery & redelivery certificates, CTMS custody-transfer data, full e-docs and ship plans More
Data size
—
Files
—
Ransomware
Unknown
DayBreach AI intelligence
Timeline
Record updated
Victim announced
Attacker
Rhysida
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs