SKY CC Company Limited Data Breach

On October 14, 2026, SKY CC Company Limited, a business services company based in Thailand, was listed on the LockBit 5 ransomware group’s leak portal. This listing was observed by SOCRadar, and their stealer-log telemetry indicated significant prior credential exposure for the company’s domain, skycc[.]co[.]th. The nature of SKY CC Company Limited’s operations and its digital footprint may have made it an attractive target for ransomware and extortion activities. LockBit 5 has claimed responsibility for 44 other victims in the preceding 60 days, primarily targeting the professional services and healthcare sectors. Their most frequent victim countries include Germany, the United States, and the Netherlands. Notable recent victims listed by the group include Argentina Valores S.A. (Argentina), GRUNENWALD (Germany), CO.R.I.S. S.r.l. (Italy), and FDC Putman (Netherlands). SKY CC Company Limited’s location in Thailand represents a geographical expansion for LockBit 5 beyond its typical European and North American operational focus.

SOCRadar’s stealer-log telemetry identified seven records associated with SKY CC Company Limited. Over a 28-day period spanning June to July 2026, two distinct corporate-domain usernames appeared repeatedly. Multiple authentication events were logged against the primary Azure AD login endpoint and tenant-specific OAuth2 authorization URIs. This pattern of multiple users and repeated authentication events is consistent with either persistent attacker access or unrotated credentials following an initial compromise. The access to Azure AD and OAuth2 could enable token acquisition, lateral movement, and persistence across cloud-connected services. The presence of these records does not definitively confirm that LockBit 5 successfully utilized these credentials for a ransomware attack. However, the observed activity aligns with the typical modus operandi of ransomware groups like LockBit 5, which often involves initial access brokers (IABs) acquiring stealer logs, validating corporate credentials, and then selling this access. The multiple authentication events targeting Azure AD and OAuth2 endpoints suggest that such a credential handoff may have already occurred. Immediate actions are recommended to mitigate potential risks. This includes rotating all compromised sessions and initiating a tenant-wide audit. Continued monitoring of dark web marketplaces and stealer-log feeds is also advised. Proactive credential hygiene checks, including password rotation and multi-factor authentication reviews, are crucial. Organizations should also monitor alternate corporate domains and review activity logs for Microsoft 365, VPNs, and remote-access portals.