☑️ Weekly Darkweb: October 2026, Week 1

🔍 Indonesian Maritime Security Agency Database Leaked on Dark Web

• On October 6, a post disclosing an employee database belonging to the Indonesian Maritime Security Agency was found on the dark web hacking forum ‘BreachForums.’

✓ The Indonesian Maritime Security Agency (fka Badan Keamanan Laut Republik Indonesia): A government agency responsible for maritime surveillance, enforcement against maritime crime, and search and rescue operations. The agency reports directly to the president.

• The threat actor ‘KNOK666X’ published 10 sample records containing personal information, including names, national identification numbers, and contact details. Some records also included passport numbers with notes identifying the individuals as agency personnel.

• According to S2W’s user profiling tool, the threat actor also posted a data leak involving Indonesian low-cost carrier ‘C’ on the same day. Since June, the actor has published a series of leaks involving Indonesian government institutions and universities, including the Directorate General of Taxes, the Ministry of Education and Culture, and the State Intelligence College.

🔍 Data Access to U.S. Defense Company Offered for Sale on Dark Web

• On October 7, a post offering access to 480 GB internal data of U.S. defense company ‘M’ and its subsidiary ‘C’ was observed on the dark web hacking forum ‘DarkForums.’

✓ ‘M’: A US-based defense contractor established in 2016, providing aviation logistics, intelligence, surveillance and reconnaissance (ISR), and cyber warfare support services.

• The threat actor ‘marlanwg’ claimed that ‘M’ serves as a contractor conducting reconnaissance flights for U.S. Special Operations Command (SOCOM). According to the actor, the accessible data includes unencrypted administrator credentials for military equipment and a roster identifying more than 14 special operations personnel.

• The actor stated that the access would be sold exclusively to a single buyer, describing the information as having significant strategic value at the nation-state level. The listing also offered screenshots of the file directory and redacted previews of sample files.

🔍 Emirati Low-Cost Carrier ‘F’ Targeted in Ransomware Attacks and Leaks

• On October 7, a post claiming the theft of approximately 4 GB of data from Dubai-based low-cost carrier ‘F’ was found on the Everest ransomware gang’s leak site.

✓ ‘F’: A state-owned, low-cost airline in Dubai serving approximately 140 routes worldwide. The company reported annual revenue of approximately USD 3.7 billion in 2025.

• The group claimed that the stolen dataset comprises 16,517 files totaling 4.36 GB, including flight operations and crew training materials, employee personnel and training records, and technical documentation from manufacturers.

• Separately, on October 2, a Telegram user was observed requesting account credentials associated with the airline’s domain in “EV V3,” a private Telegram group used to trade compromised accounts. The user subsequently received a username and password file.

➢ On September 30, a first officer reportedly attacked the captain with an emergency axe and attempted to seize control of a ‘F’ aircraft operating a flight from Dubai to Tel Aviv.