AeroVision Avionics, Inc. Data Breach

AeroVision Avionics, Inc., a Taiwan-based company operating under the aai.com.tw domain, has been listed as a victim on the Krybit ransomware group’s dark web portal, published on July 1, 2026. This listing was identified through SOCRadar’s Dark Web Monitoring service. The company is classified within the technology sector, and its Taiwanese base aligns with Krybit’s recent targeting patterns. In the 60 days prior to this listing, Krybit had claimed 34 other victims, with a strong focus on the technology, business services, and transportation and logistics sectors. Geographically, their victims are concentrated in Germany, Taiwan, and Italy. AeroVision Avionics, Inc. fits closely within the group’s established targeting profile.

Initial access correlation against SOCRadar’s stealer-log telemetry returned no direct records for aai.com.tw for the queried timeframe. However, this absence of a direct hit does not confirm a secure credential posture. The organization might operate under alternate domains, or employees may use personal email aliases not captured in the logs. It’s important to note that credentials may have surfaced in feeds outside this dataset, been used and rotated before indexing, or been harvested under personal email aliases not linked to the corporate domain. For groups like Krybit, infostealer-harvested credentials are a documented initial access vector. Threat actors source credentials from underground marketplaces, validate them, and use them to access corporate systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. Therefore, CTI teams should continue monitoring and conduct proactive credential hygiene checks rather than interpreting a null query as complete security.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.