Astino Berhad Data Breach

Qilin ransomware listed Astino Berhad on its dark web portal on November 2, 2026, with the listing identified through SOCRadar’s Dark Web Monitoring service. Astino Berhad is a Malaysia-based manufacturer focused on building materials and industrial products, serving regional Southeast Asian markets. The company’s industrial profile and Southeast Asian operating footprint align closely with the victim types Qilin has most frequently claimed, so the listing appears consistent with the group’s established targeting behavior rather than an anomalous selection. Qilin is among the most active ransomware operators currently tracked globally, claiming 202 other victims within the same 60-day window. The group’s victim set skews toward Manufacturing, Technology, and Other sectors, with activity concentrated in the United States, Spain, and Germany, and manufacturing remains its most frequently claimed sector. Other recent listings with manufacturing or APAC overlap include Shibata Co., Ltd., Honghwa International, TRAUCO AG, and Proterial. Astino Berhad fits this pattern as a Malaysian manufacturer, matching Qilin’s dominant sector preference and extending the group’s recent run of manufacturing and APAC-adjacent victims.

SOCRadar’s stealer-log database — a repository of credentials stolen by information-stealing malware and traded on criminal markets — returned four records tied to astino[.]com[.]my. Two of these records directly target the WordPress admin login at astino[.]com[.]my/wp-login[.]php, meaning administrative credentials for the company’s content management system are circulating in criminal datasets. A third record pairs a corporate @astino.com.my email address with a service hosted in South Korea, indicating that an employee device was compromised and its stored credentials exfiltrated. A fourth record pairs a corporate email address with the company root domain. Collectively, the credentials span December 2025 to September 2026, a nine-month window with no evidence of rotation. This exposure matters against the backdrop of Qilin’s typical attack model, which relies on sourcing stolen credentials through underground markets, authenticating to internet-facing systems, and then deploying ransomware. Under that model, a live admin credential for the corporate CMS is a plausible entry point, allowing an operator to log in directly rather than exploit a technical vulnerability. The record tied to a compromised employee device further broadens the potential access surface, since credentials harvested by infostealers are traded on criminal markets and may remain valid long after the original infection. This remains a possible scenario supported by telemetry rather than a confirmed intrusion path: the stealer-log records demonstrate credential exposure, but they do not establish that Qilin used these specific credentials to access Astino Berhad’s systems. The priority response items are credential rotation for all astino[.]com[.]my accounts, an audit of the affected employee devices, and a review of CMS access logs from December 2025 onward. The nine-month exposure span without evidence of rotation makes these steps urgent, as credentials left unchanged for that long are more likely to still be valid and usable by threat actors operating in underground markets.