ENAP Egypt Branch Ransomware Claim by Aoqin (Nov 2026)

Claim Summary

The ransomware group Aoqin has allegedly listed Petroshahd (Enap Sipetrol International - Egypt Branch) on its dark web leak site. According to the threat actor, the claim was posted on November 4, 2026, with a threatened data publication date of November 11, 2026 at 11:00 UTC. The listing states “Status: Not paid,” suggesting the group claims a ransom demand has gone unanswered.

The victim is purportedly the Egypt branch of ENAP, a Chilean state-owned energy company. The leak site entry describes ENAP as established in 1950 and headquartered in Las Condes, Chile, engaged in hydrocarbon exploration, production, and refining. Notably, the listing’s country field reads “CL” (Chile) while the named entity is an Egypt branch, an inconsistency worth flagging. No data volume was disclosed.

This claim has NOT been independently verified. It remains an unconfirmed assertion by a threat actor.

Threat Actor Profile

Aoqin is a low-profile ransomware operation with no publicly documented track record. Yazoul Security has no confirmed victim count, no verified tooling inventory, and no public research references for this group. This absence of intelligence is itself significant: it may indicate a new or rebranded operation, a small affiliate, or a group that deliberately avoids researcher attention.

Because known tools and tactics are unknown, defenders should not assume a specific initial access vector, encryption routine, or exfiltration toolset. Treat Aoqin as an unknown-quantity actor and apply generic ransomware defenses. No YARA rules or detection signatures specific to Aoqin are currently available; organizations should rely on behavioral detections for credential theft, data staging, and mass file encryption rather than named-actor signatures.

Alleged Data Exposure

According to the threat actor, the claimed data types include confidential internal documents, client data, and banking information. The group did not disclose a data volume, which is unusual for leak site posts and may indicate either an early-stage listing or an attempt to inflate perceived impact without evidence.

Yazoul Security has not seen, verified, or obtained any of the allegedly stolen data. No samples, credentials, or download references are included here by policy. The banking data claim, if true, would be the most sensitive element, but it is entirely unsubstantiated at this time.

Potential Impact

If the claim is accurate, potential exposure could include client records and financial information tied to ENAP’s Egypt operations. Energy sector entities face elevated risk from operational disruption and regulatory scrutiny. However, ransomware groups routinely exaggerate scope and data sensitivity to pressure victims into payment. The mismatch between the Chile country tag and the Egypt branch designation further undermines confidence in the listing’s accuracy.

What to Watch For

• Whether Aoqin publishes data on the stated November 11 deadline or extends it, a common pressure tactic.
• Any confirmation or denial from ENAP corporate or the Egypt branch.
• Regional regulatory notifications, which often surface before public statements.
• Reuse of leaked banking data in follow-on fraud or business email compromise campaigns.
• Appearance of Aoqin in future leak site posts, which would help establish a track record.

Defenders in the energy sector should review third-party access, enforce phishing-resistant MFA, segment backup infrastructure, and monitor for unusual data staging. See our advisory library for ransomware hardening guidance.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware leak site. Yazoul Security has NOT independently verified the breach, the data types, the data volume, or the involvement of Aoqin. Nothing in this report should be treated as fact. The threat actor may be exaggerating, misattributing, or fabricating the claim entirely. Organizations named should be presumed innocent of any wrongdoing, and readers should await official confirmation before drawing conclusions.