1. Executive summary
The Aoqin ransomware group listed SILIKO d.o.o., a Slovenian manufacturer of elastomer and thermoplastic components, on its leak site on 2026-11-04. The listing states a status of "Not paid" and a data publication date of 2026-11-09 14:00 UTC, and claims data types of banking, clientsData and confidential. SILIKO reports 70 percent of its production exported to the European Union, predominantly to German automotive buyers, and also supplies the household appliances, electrical, sanitation and construction industries. No CVE, exploitation state or MITRE ATT&CK profile is associated with this item, and the attribution rests on the operator's own leak-site claim. For EMEA financial services the direct risk is low; the relevant exposure is third-party, through any client that sources components from SILIKO or shares banking and client data with it in a supplier relationship.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | SILIKO is a manufacturing supplier whose listing claims "banking" and "clientsData" among the data types held, so a financial client may hold an ICT or data-sharing relationship with it. | Clients that contract SILIKO as a supplier should confirm whether it processes or holds their data and apply third-party risk management to that relationship. |
| NIS2 Art. 21(2)(d): supply chain security measures | The same supplier relationship, where the client is an in-scope entity and SILIKO sits in its supply chain. | In-scope entities should assess supply chain exposure to this supplier and record the outcome. |
No DORA incident-reporting article is engaged on the facts available: the listing is an operator claim, and no source confirms that a financial services client of SILIKO has suffered an incident.
3. Technical analysis & attack chain
The listing establishes one thing: Aoqin claims SILIKO as a victim, with status "Not paid", a data publication date of 2026-11-09 14:00 UTC, and claimed data types of banking, clientsData and confidential. It does not establish how access was obtained, what data was actually taken, when the intrusion occurred, or whether SILIKO has confirmed the claim. No source in this item states an initial access vector, an exploited vulnerability, a CVE, malware capabilities, persistence, command-and-control, lateral movement or exfiltration detail. The revenue figure of $61.6M and headcount of 130 are as given in the listing.
The "banking" data type in the listing is the operator's own label. It does not show that any bank is a SILIKO customer, that banking credentials or account data were taken, or that a financial institution is affected. Adverse Trace assesses the financial-sector relevance as indirect and unconfirmed, resting on the operator's claim alone.
No MITRE ATT&CK profile exists for Aoqin, so no technique mapping is offered and the attribution is unconfirmed. The group name is the operator's own.
4. Mitigation & containment
P1 (within 24h)
- Clients with a supplier relationship to SILIKO should contact their SILIKO account or procurement contact to ask whether SILIKO confirms the listing and whether any client data or banking details held by SILIKO are in scope. Record the answer.
- Where a client has shared banking or client data with SILIKO, identify what was shared and treat it as potentially exposed until SILIKO confirms otherwise.
P2 (within 72h)
- Review payment instructions and callback procedures for any transaction touching SILIKO or its known banking details, given the "banking" data type in the listing. Confirm changes to bank details by a known voice contact, not by email.
- Check third-party registers for SILIKO as a supplier and note the listing against the entry.
P3 (within 7 days)
- If SILIKO confirms data loss affecting the client, run the client's own incident classification and reporting process under its DORA or NIS2 obligations as applicable.
No fixed release, patch, indicator or vendor advisory is named in public reporting for this item, so no technical containment step can be specified beyond the supplier verification above.
5. Indicators of compromise
No indicators of compromise available in the source material. The listing gives no hashes, domains, IP addresses, file paths or other atomic values. The only observable is the leak-site entry itself, which is a publication, not an indicator.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- ransomware.live, "Ransomware: Aoqin named SILIKO d.o.o. (SI)", https://www.ransomware.live/id/U0lMSUtPIGQuby5vLkBBb3Fpbg==, 2026-11-04
- ransomware.live, "Victim: SILIKO d.o.o. – Aoqin", https://www.ransomware.live/id/U0lMSUtPIGQuby5vLkBBb3Fpbg==
Both sources are the same leak-site index entry; the claim is single-sourced to the operator and has no independent corroboration.
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services: a single leak-site listing of a non-financial manufacturing victim, with no CVE, no confirmed data theft and no demonstrated link to a financial institution. The attribution to Aoqin is the operator's own claim and is unconfirmed, and no MITRE ATT&CK profile exists for the group. The client-impact assessment is third-party only: a financial client that uses SILIKO as a supplier, or has shared banking or client data with it, should verify exposure directly with SILIKO before the stated publication date of 2026-11-09 14:00 UTC. Adverse Trace will monitor for SILIKO's confirmation or denial and for any Aoqin technical reporting, and will reissue if a financial-sector victim or a technical indicator set emerges.
Published via PulseTrace — Adverse Trace threat intelligence.