Main Place Mall Data Breach

On October 2, 2026, the Netrunner ransomware group listed Main Place Mall, a retail shopping complex located in Malaysia, on its dark web leak site. Netrunner employs a double extortion tactic, which involves stealing data before deploying ransomware and threatening publication of the exfiltrated information. This incident highlights the ongoing threat posed to retail organizations by ransomware groups. SOCRadar’s threat intelligence platforms detected stealer-log activity linked to Main Place Mall’s administrative domains between January and June 2026, a six-month period preceding the leak-site listing. The compromise of administrative-level credentials is of significant concern in the underground markets, as it can facilitate lateral movement within a network and enable threat actors to deploy ransomware without requiring further privilege escalation. This timeline aligns with the typical attack chain observed in infostealer-to-ransomware operations.

SOCRadar’s analysis revealed stealer-log activity associated with Main Place Mall’s administrative domains during the period of January through June 2026. This six-month window of credential compromise preceded the Netrunner group’s public listing of the victim on its leak site. The discovery of administrative-level credentials in underground markets is particularly alarming, as such access provides a direct pathway for threat actors to conduct lateral movement within a victim’s network and position themselves to deploy ransomware without the need for further privilege escalation. This sequence of events is consistent with the infostealer-to-ransomware attack lifecycle. The identified timeline strongly suggests a connection between the compromise of administrative credentials via stealer malware and the subsequent ransomware attack. Administrative credentials are highly sought after by threat actors because they grant extensive access and control over network resources, making them ideal for facilitating widespread compromise and data encryption. The presence of these credentials in underground forums indicates a potential initial access vector or a significant step in the compromise chain, allowing threat actors to operate with elevated privileges. Retail organizations should prioritize the implementation of multi-factor authentication (MFA) on all administrative accounts, ideally before any data breach is publicly announced. Regularly auditing credentials against dark web intelligence feeds and tightening access privileges are crucial defensive measures. Broad administrative accounts represent the most valuable targets for attackers employing this methodology, underscoring the need for stringent access control and monitoring.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.