Petroshahd (Enap Sipetrol International – Egypt Branch) Data Breach

Aoqin ransomware listed Petroshahd — the Egypt Branch of Enap Sipetrol International — on its dark web portal on November 4, 2026, identified via SOCRadar’s Dark Web Monitoring service. ENAP (Empresa Nacional del Petróleo) is Chile’s state-owned petroleum company; its international subsidiary Enap Sipetrol operates oil and gas exploration and production assets across multiple countries, including Egypt. The victim is a critical infrastructure target with state-owned enterprise links, operating in the Energy & Utilities sector — a context that elevates the significance of the listing beyond a typical ransomware claim. Aoqin has claimed 4 victims in the 60 days prior to this listing — a focused operational cadence indicating either a nascent group or a selective targeting approach. The other three victims span Goldsmith & Hull (United States, Professional Services), Nextron Technology (China, Technology), and SILIKO d.o.o. (Slovenia, Manufacturing). The cross-continental publication — covering four countries in a single window — points to accumulated victims released in bulk rather than targeted campaigns. Petroshahd’s listing is Aoqin’s first Energy & Utilities target in this dataset, marking a sectoral departure from the group’s recent victim profile while adding geopolitical and sectoral weight to the incident.

SOCRadar’s stealer-log telemetry returned no records for the enap.cl domain. The parent domain has limited inferential value here: Petroshahd’s Egypt Branch likely operates under separate regional hostnames, local IT infrastructure, or partner-system credentials not indexed under enap.cl. The gap between queried domain and operational entity is substantial for a multinational with cross-jurisdictional operations, so the absence of records does not confirm that the organization is unaffected. Credentials may still exist under alternate corporate domains, in feeds outside the queried dataset, or may not yet have been indexed. Credential-based initial access via VPN gateways or remote-access portals remains the most plausible intrusion pathway, consistent with Aoqin’s observed pattern. Infostealer-harvested credentials traded or validated on underground marketplaces can provide ransomware operators or initial access brokers with ready access to corporate accounts, remote-access infrastructure, and Microsoft 365 environments. The absence of records in this query does not change that assessment, and this access method should be treated as a possible scenario rather than a confirmed intrusion path. Petroshahd (Enap Sipetrol International – Egypt Branch) is listed as a claimed victim on November 4, 2026, and the listing has not been independently verified. The energy sector and state-enterprise context warrants elevated monitoring across all regional operational domains, not just enap.cl. Defenders should continue dark web and stealer-log monitoring, perform proactive credential-hygiene checks including password rotation and multi-factor authentication review, monitor alternate corporate domains for exposure, and review VPN, Microsoft 365, and remote-access portal activity for signs of unauthorized access.