1. Executive summary
Ransomware.live indexed a Rhysida leak-site claim naming Malaysian maritime services provider MISC Group and alleging the theft of 29,841 files totalling 28.4 GB. The claimed data includes crew identity records, command workstation files, privileged credentials, ship security passwords, safety reports, ship plans, charter documents and custody-transfer records. The claim is single-sourced and the underlying data has not been independently examined; attribution to Rhysida is unconfirmed because the named actor has no MITRE ATT&CK profile. No CVE has been assigned, so no CVSS severity or CISA KEV exploitation state applies; EMEA financial institutions with maritime finance, insurance, payment or counterparty exposure to MISC face a conditional risk of credential misuse, document-enabled fraud and disclosure of commercially sensitive information.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The available reporting confirms only the public disclosure step. It does not establish how MISC Group was accessed or whether ransomware was deployed.
- On 26 October 2026, Ransomware.live indexed a publicly visible extortion-site entry naming MISC Group as a Rhysida victim. The entry attributes 29,841 files and 28.4 GB of data to the alleged compromise.
All subsequent details originate from that entry. They are single-sourced; verify before enforcement. Ransomware.live states that it indexes material posted publicly by ransomware operators and does not access or possess the underlying stolen data.
The operator claims that 16,918 files, totalling 15.5 GB, came from Master, Chief Officer and Bridge user folders on command workstations. The alleged files include PST mail archives. No workstation operating system, host name, file path or collection tool is identified.
The claimed crew records cover about 30 seafarers and include IMO FAL Form 5 crew lists, passport numbers associated with Malaysian, Philippine, Indonesian and Indian personnel, Seafarer Employment Agreements containing dates of birth, home addresses and salaries, and a scan of a fourth officer's PRC passport. The source does not establish whether every listed record was published or merely offered by the operator.
The entry claims exposure of credentials or access codes for:
- ECDIS, CCTV and AIS systems.
- Fire and gas alarm panels.
- Physical door access.
- The Ship Security Plan under ISPS controls.
- NS5 and Dualog mail accounts.
- Domain administrator accounts.
- OCIMF and SIRE web accounts.
The source does not specify whether these credentials remain valid, whether they are shared across vessels, or whether the associated systems accept remote authentication. Exposure alone does not establish that an operator can reach or control shipboard systems.
The alleged internal records include a complaint concerning an assault or harassment allegation against a Chief Engineer dated 25 August 2026 and an FR-HR25 investigation report. The operator also claims possession of reports concerning two vessel-listing events during ballasting or deballasting, an event allegedly not reported to the flag state, a VDR sensor failure and radar misuse during collision avoidance.
The listing describes about 20 internal ISM non-conformities, including rusted cargo pipelines and high-voltage gloves that had allegedly expired in 2021. It contrasts these records with ABS statutory audits dated 17 October 2025, which it characterises as clean. It also references a Japan port state control deficiency recorded at Himeji on 9 December 2025 and statements attributed to four officers. These assertions have not been corroborated by MISC Group, ABS, a flag state or a port authority in the material available.
Commercial and technical documents allegedly include drydock repair specifications held in an SQLite MSL dataset, ExxonMobil and APLNG delivery and redelivery certificates, CTMS custody-transfer data, electronic documents and ship plans. If authentic, these records could support convincing payment diversion, contract fraud or impersonation attempts against banks, insurers, charterers and other maritime counterparties.
No source identifies an initial access vector, exploited component, vulnerability, payload, persistence method, privilege-escalation path, command-and-control channel, lateral-movement technique or exfiltration mechanism. No CVE has been assigned, so no CVSS severity or CISA KEV exploitation state applies.
4. Mitigation & containment
P1 within 24 hours
- MISC Group and directly exposed counterparties should activate incident response, preserve available identity, endpoint, mail, firewall and remote-access logs, and collect forensic images from implicated command workstations where this can be done without affecting vessel safety.
- Vessel operators should disconnect implicated Master, Chief Officer and Bridge workstations from non-essential corporate and shore connectivity where operationally safe. Navigation, alarm and safety functions must not be interrupted without vessel authority and an approved fallback.
- Administrators should rotate the claimed domain administrator, NS5, Dualog, OCIMF and SIRE credentials from a known-clean administrative system. Active sessions, application passwords and recovery tokens associated with those accounts should be revoked.
- Vessel authorities should replace ECDIS, CCTV, AIS, fire and gas panel, door-access and Ship Security Plan passwords under approved shipboard change control. Replacement credentials should not be transmitted through mailboxes or workstations covered by the claim.
- Financial institutions should identify active MISC relationships across payments, trade finance, marine lending, insurance and custody-transfer activity. MISC-themed instructions involving new bank details, urgent payments, charter documents or employee data should require callback verification through a previously established contact channel.
- Organisations should not block infrastructure or files solely on the basis of this report because the source provides no atomic indicators.
P2 within 72 hours
- Investigators should review sign-ins for the claimed exposed accounts, focusing on new source locations, unusual vessel-to-shore access, unexpected administrative sessions, newly registered authentication methods and unexplained privilege changes. These are defensive search criteria, not observed indicators from the incident.
- Mail administrators should inspect affected accounts for forwarding rules, delegate access, mailbox export activity and authentication after credential rotation. PST archives in the claimed collection may provide historical contacts and conversation context for impersonation.
- Identity teams should determine which privileged credentials were present on each alleged workstation and rotate any dependent credentials. Reusing the same replacement value across vessels or safety systems should be prohibited.
- Fraud teams should add manual verification to payment or account-change requests that cite the exposed charter certificates, crew records, custody-transfer data, ship plans or safety reports.
- MISC Group should validate the claimed file count and data categories against internal inventories without downloading or handling unlawfully obtained material.
P3 within 7 days
- Vessel and shore IT teams should review network separation between bridge, safety, administration and corporate systems, then remove any non-essential access path found during the review.
- Data owners should determine which crew members, vessels and counterparties are affected and assess notification duties in each applicable jurisdiction. The available source does not establish the residence of affected individuals beyond the nationalities associated with some passport records.
- Counterparties named in confirmed exposed documents should be notified through established security or legal contacts so they can review account access and payment controls.
- Maritime finance and insurance teams should reassess decisions that depended on the allegedly exposed audit, safety or incident records only after the records have been authenticated through authorised channels.
- Incident responders should retain evidence needed to establish initial access, persistence, lateral movement and exfiltration. There is no vendor patch, fixed version or configuration advisory associated with this report.
5. Indicators of compromise
No indicators of compromise available in the source material.
The incident claims and alleged data scope are single-sourced; verify before enforcement.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Ransomware.live, “Victim: MISC Group: rhysida”, https://www.ransomware.live/id/TUlTQyBHcm91cEByaHlzaWRh, 26 October 2026.
8. Adverse Trace position
We assess this as an unverified but potentially material disclosure for organisations with direct MISC Group, vessel, crew, maritime finance or insurance exposure. No CVE has been assigned, so no CVSS severity or CISA KEV exploitation state applies. Attribution to Rhysida remains unconfirmed because the named actor has no MITRE ATT&CK profile, and the compromise details and data inventory are single-sourced; verify before enforcement. The immediate client action is to identify relevant business relationships, protect accounts named in the claim and apply independent verification to MISC-related payment or document requests. Adverse Trace will monitor for confirmation from MISC Group, affected counterparties or other independent sources, and for technical indicators that support detection or retrospective scoping.
Published via PulseTrace — Adverse Trace threat intelligence.