CNESTEN Data Breach

SOCRadar’s CTI analysis has identified a ransomware claim by the actor qilin targeting CNESTEN, a national nuclear energy research organization operating in Morocco’s energy and utilities sector. The claim was published on October 11, 2026. While the exact method of initial access remains undetermined, the intelligence suggests a potential link to infostealer campaigns, revealing credential exposure across organizational systems. CNESTEN’s critical infrastructure and sensitive research make it a potentially attractive target for ransomware operations. The qilin ransomware group has been active and prolific, claiming 214 victims in the 60 days leading up to this report. Their operations exhibit a global reach, with a primary focus on the Manufacturing and Technology sectors. The leading victim geographies for qilin are the United States, the United Kingdom, and Germany. This specific incident in Morocco’s energy sector represents a deviation from qilin’s typical targeting pattern, as the energy and utilities industry is not listed among their most frequently targeted sectors.

SOCRadar’s investigation involved querying the domain kerix[.]net, which is identified as a third-party Moroccan business directory and not part of CNESTEN’s own infrastructure. The stealer-log intelligence indicated a “notable_exposure_in_sample” of 23 records. These records were categorized as Category B, signifying external user accounts on organizational portals within the queried directory. It is crucial to emphasize that these 23 records do not represent CNESTEN employee credentials or compromise of CNESTEN-owned systems. The recovered data points to active infostealer campaigns targeting users of Moroccan business platforms, rather than a direct compromise of CNESTEN’s authentication infrastructure. This finding should not be interpreted as evidence of a workstation-level breach at CNESTEN. The initial access vector for qilin into CNESTEN remains undetermined based on this specific data sample. The absence of CNESTEN-domain credentials in the queried stealer logs suggests that the group may have employed alternative methods for initial access, such as VPN exploitation, phishing with direct malware delivery, or the use of purchased access from initial access brokers. Alternatively, relevant credentials might exist under a corporate domain not included in this particular query. Given CNESTEN’s role as a nuclear energy research organization, it should be considered a high-priority target for incident response efforts, irrespective of this scope limitation. The ransomware listing serves as the primary indicator of a potential breach, while the stealer-log data, in this instance, is inconclusive regarding the specific initial access method.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.