Inland and Offshore Contractors Hit by qilin - Sep 2026

Claim Summary

The qilin ransomware group has allegedly listed Inland and Offshore Contractors, a Trinidad and Tobago based firm operating in the energy and utilities sector, on its dark web leak site. According to the threat actor, the claimed attack date is September 18, 2026. The listing, reviewed by Yazoul Security analysts, does not disclose a data volume, sample files, or a proof pack at the time of writing.

This claim has NOT been independently verified. It remains a single unconfirmed assertion published by a criminal extortion operation. No victim confirmation, regulatory filing, or third party forensic report has corroborated the listing.

Threat Actor Profile

qilin, also tracked under the name Agenda, is a ransomware-as-a-service operation that emerged in 2022 and has since become one of the more prolific leak site operators. The group is known for double extortion, encrypting victim systems while exfiltrating data to pressure payment.

Public reporting has linked qilin affiliates to a broad toolset that commonly includes Cobalt Strike for command and control, legitimate remote monitoring and management tools for persistence, and exfiltration utilities such as rclone and file transfer services. Initial access is frequently attributed to phishing, exploitation of exposed remote access services, and credential abuse, though the specific entry vector for this alleged incident is unknown.

qilin has historically targeted healthcare, manufacturing, professional services, and critical infrastructure. Its operators have shown a willingness to relist victims and to negotiate aggressively, which means claims should be treated with caution rather than accepted at face value.

No public research references specific to this campaign were available at the time of writing. Detection guidance for qilin activity generally centers on monitoring for unauthorized use of remote access tooling, unusual outbound data transfers, and rapid file encryption behavior. Organizations running endpoint detection should validate that YARA and behavioral rules covering known qilin encryptor strings are current.

Alleged Data Exposure

The leak site entry provides no data volume and no samples. This is notable. Many qilin listings include a proof pack or a partial file tree to demonstrate access. The absence of such material may indicate an early stage listing, a negotiation tactic, or an unsubstantiated claim.

Yazoul Security has not reviewed, downloaded, or validated any data purportedly tied to this incident. No personal information, credentials, or file contents are referenced in this report.

Potential Impact

If the claim is accurate, an energy and utilities contractor could face operational disruption, exposure of proprietary project data, and regulatory scrutiny given the sector’s critical infrastructure profile. Trinidad and Tobago’s energy sector is regionally significant, and supply chain partners may be affected.

However, ransomware groups routinely exaggerate or fabricate claims to pressure victims into payment. A listing alone is not evidence of a successful breach.

What to Watch For

• Any official statement from Inland and Offshore Contractors or its parent entities.
• Disclosure from Trinidad and Tobago regulators or CERT authorities.
• Appearance of data samples or a proof pack on the leak site.
• Relisting or countdown timers, which qilin often uses as pressure tactics.
• Sector wide phishing or exploitation activity targeting regional energy contractors.

Disclaimer

This report is based solely on an unverified claim published by a ransomware group. Yazoul Security has not independently confirmed the alleged attack, the identity of the victim, or the existence of any exfiltrated data. Nothing here should be treated as fact. Organizations should rely on their own incident response and legal counsel before drawing conclusions.