Royal Thai Air Force Data Breach

thegentlemen listed the Royal Thai Air Force (RTAF) on its leak site on 2026-10-10. The RTAF is Thailand’s aerial defense branch, and a military listing is a significant departure from this group’s typical pattern. Over the preceding 60 days, thegentlemen claimed 222 victims globally, with the vast majority being commercial entities across sectors such as Manufacturing and Healthcare, and were concentrated in the US, UK, and Brazil. The RTAF does not fit this usual profile. This deviation suggests three potential scenarios: a deliberate shift in targeting towards government entities, opportunistic exploitation of an already exposed system, or a compromise that extended to RTAF-connected vendors. While the available stealer-log data does not definitively confirm the cause, it does validate that a real and sustained compromise occurred.

The stealer-log analysis indicated a severe exposure in the sample, with 23 employee credentials on organizational systems (Category A) identified across military-owned domains. These credentials span from 2024-12-13 to 2026-10-11, indicating a nearly two-year period where infected military workstations continuously exfiltrated credentials to criminal marketplaces without detection. This means that any actor with access to these credential markets had ongoing visibility into the RTAF’s authentication infrastructure throughout this extended timeframe. The affected domains included iam.rtaf.mi[.]th (identity and access management portal), competency.rtaf.mi[.]th (personnel competency system), and dict.rtaf.mi[.]th. The exposure of IAM portal credentials is particularly critical in a military context, as it can facilitate user enumeration, privilege escalation testing, and pivoting to downstream systems, potentially granting access to the network’s authentication layer. The compromise of the competency system further elevates the risk by exposing personnel data. Given the severity and duration of the credential exposure, the RTAF should treat this as an active incident. Recommended immediate actions include forced credential rotation across all rtaf.mi[.]th systems, conducting endpoint forensics on affected workstations, and coordinating with Thailand’s National Cybersecurity Agency (NCSA) for a comprehensive response.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.