Qilin ransomware group lists www.afmco.jo on its leak site

• Ransomware group: Qilin
• Country: Jordan
• Sector: Government & Defense
• Announcement date: July 31, 2025

Qilin ransomware group claims breach of Aqaba Special Economic Zone Authority

The Qilin ransomware group has listed the domain www.afmco.jo on its leak site, claiming that the Aqaba Special Economic Zone Authority (ASEZA) has been targeted in a cyberattack. According to the group's announcement, the incident occurred on July 30, 2025. The threat actors allege that they have successfully gained access to administrative and governmental data belonging to the authority.

To support their claims of a successful data exfiltration, the group has shared various screenshots depicting the institution's internal operations. These visual proofs are intended to demonstrate that sensitive information has been taken from the organization's systems. While the group has made these claims, the full scope and specific content of the alleged exfiltration remain unverified.

Details of the alleged data exfiltration

The screenshots provided by the threat actors appear to contain various internal files. These include tables and documents that seem to represent internal administrative files, personnel records, or operational data. However, the group has not provided a detailed breakdown regarding the full scope or the specific content of the exfiltrated data.

The types of data mentioned in the listing include:

• Administrative documents
• Operational records

No information was provided regarding the total size of the data, the specific file count, or a ransom demand. The announcement type is categorized as a data leak.

About the Aqaba Special Economic Zone Authority

The Aqaba Special Economic Zone Authority (ASEZA) is a governmental body responsible for the administration, regulation, and development of the special economic zone in Aqaba, Jordan. Its primary mission is to promote economic growth within the region by overseeing various activities, including investment, tourism, and logistics operations.

Risk assessment and implications of the incident

This incident may pose a significant risk due to the potential exposure of sensitive administrative and operational data. Because the target is a government authority, the breach could lead to compliance issues regarding data protection regulations in Jordan. The nature of the attack highlights the ongoing threat posed by RaaS (Ransomware-as-a-Service) groups like Qilin, which has been active since 2022 and targets various sectors.

Given Qilin's known use of double-extortion tactics, there is a possibility that the institution's operational continuity could be disrupted and the stolen data could be misused by third parties. In double-extortion schemes, attackers not only encrypt systems to disrupt operations but also threaten to release sensitive information to pressure the victim into paying. The leaked information may be utilized for targeted phishing attacks or corporate identity theft, posing long-term risks to the organization and its stakeholders.

For organizations in the government and defense sectors, such incidents underscore the importance of robust cybersecurity frameworks. Defensive measures typically include maintaining offline backups, implementing strict access controls, and conducting regular security audits to detect unauthorized access early. Protecting sensitive administrative and operational data is critical to maintaining public trust and ensuring the continuity of essential governmental services.