apt73 ransomware group lists narit.or.th on its leak site

• Ransomware group: apt73
• Country: Thailand
• Sector: Government & Defense
• Announcement date: May 21, 2026

The threat actor group apt73 claims a breach of NARIT

The National Astronomical Research Institute of Thailand (NARIT) has been listed on a leak site by the threat actor group known as apt73. On May 21, 2026, the group announced that they had successfully targeted the organization, marking a significant potential security incident for the Thai research institution. While the group has initiated a countdown timer regarding the publication of the alleged stolen data, public information regarding the specific identity and capabilities of apt73 remains limited in the public domain.

This type of activity is characteristic of modern ransomware operations that utilize double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish the stolen information on a public leak site, the threat actors aim to pressure the victim into paying a ransom to prevent the disclosure of confidential materials.

Details of the alleged data theft

According to the claims made by apt73, the group has obtained a significant volume of information belonging to the organization. The group asserts that they have accessed a total of 16,807 files. These files are said to include a variety of sensitive materials, such as internal documents and financial reports. The group has not provided information regarding the total size of the data or a specific ransom demand at this time.

Based on samples shared by the group, the leaked content appears to include administrative documents related to office equipment and technical specifications belonging to the institution. The specific types of data mentioned in the claim include:

• Administrative documents
• Financial reports
• Technical specifications

The presence of such documents suggests that the breach may have exposed internal correspondence and procurement processes. Such exposure can lead to various operational and legal complications for a public entity.

About the National Astronomical Research Institute of Thailand

The National Astronomical Research Institute of Thailand (NARIT) is a public research organization operating under the Ministry of Higher Education, Science, Research and Innovation of Thailand. The institute plays a critical role in the scientific community by conducting fundamental research in the field of astronomy. Beyond research, NARIT is responsible for operating various observatories and working to promote astronomical education across the country.

Potential risks and organizational implications

The alleged leak poses several significant risks to the institution. From an operational standpoint, the exposure of internal documents and technical specifications may compromise the organization's operational confidentiality. Furthermore, the breach could have a damaging impact on the institution's corporate reputation. If the leaked data contains personal information, the organization may face legal proceedings under Thai data protection regulations.

There are also concerns regarding intellectual property. The exposure of research data could lead to negative consequences regarding the protection of intellectual property rights, which is vital for a research-focused institution. Additionally, the leaked information could be utilized by malicious actors for secondary purposes, such as identity theft or the execution of targeted phishing attacks against employees or partners.

For organizations in the government and research sectors, maintaining robust cybersecurity postures is essential. This typically involves implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to defend against phishing. Additionally, implementing strict data loss prevention (DLP) measures and ensuring comprehensive logging and monitoring can help detect and mitigate unauthorized data exfiltration attempts before they escalate into large-scale leaks.