Asyaport Data Breach

N0n has listed Asyaport, a container terminal operating in Turkey, on its dark web leak site. The listing occurred on October 12, 2026, and is part of a larger campaign that targeted 72 organizations within a 60-day period. The victims in this campaign are primarily port operators, shipping lines, and maritime manufacturers, with a geographical focus across Asia and the Americas. Asyaport has not yet made any public statements regarding this listing. The critical nature of port operations and their role in global trade supply chains can make such organizations attractive targets for ransomware and extortion activities. N0n’s recent activity shows a broad targeting strategy, with significant focus on the Transportation, Technology, and Healthcare sectors. The group’s primary victim countries during the preceding 60 days included the United States, South Korea, and Brazil. The October 12 listing appears to be a specific initiative targeting the maritime sector. Notable organizations also claimed in this recent campaign window include Ocean Network Express (Singapore, Transportation), CULines (China, Transportation), T.S. Lines (Taiwan, Transportation), and ZPMC (China, Manufacturing). The inclusion of these companies demonstrates a clear pattern of targeting within the maritime logistics and related manufacturing industries.

Analysis of stealer-log data revealed four employee credentials associated with Asyaport’s corporate authentication systems. This finding aligns with N0n’s typical modus operandi observed in this particular campaign, suggesting compromised endpoints used by port operations staff. The strategic location of Turkey as a key transit hub for trade between Europe and Asia further amplifies the significance of this credential exposure. The presence of four active credentials for an organization operating a major port represents a substantial foothold, potentially allowing an attacker to authenticate as legitimate staff and move laterally within the network before any ransomware deployment. The observed credential exposure on the domain asyaport[.]com is a significant indicator of potential compromise. While this does not confirm a full breach, it provides a clear potential entry vector for threat actors. The compromised credentials could be utilized to gain access to sensitive systems, including VPN gateways, terminal management systems, and remote-access platforms, which are critical for port operations. Such access can facilitate further reconnaissance, lateral movement, and ultimately, the deployment of ransomware. Given the exposure of these credentials, it is imperative for Asyaport to implement robust security measures. This includes rotating all credentials associated with any account that accesses VPN gateways, terminal management systems, and remote-access platforms. Furthermore, enforcing phishing-resistant multi-factor authentication (MFA) across all remote access entry points is a critical step. The N0n listing should be treated as an immediate trigger for a comprehensive credential audit and review of security posture, rather than a situation to be passively monitored.