SFG Technology Sdn Bhd listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Malaysia
• Sector: Energy & Utilities
• Announcement date: October 14, 2025

The Qilin ransomware group has listed the Malaysia-based energy and utilities company SFG Technology Sdn Bhd on its leak site. This announcement, made on October 14, 2025, marks a new instance of the threat actor targeting critical infrastructure providers through extortion-based tactics.

Details of the claimed attack

According to the announcement made by the Qilin group, the organization was targeted in a ransomware incident on October 14, 2025. The threat actors claim to have successfully gained access to the networks belonging to SFG Technology Sdn Bhd. Following this unauthorized access, the group alleges that they have performed a data exfiltration operation, moving sensitive information from the victim's environment to their own controlled infrastructure.

The group continues to employ double extortion tactics, a common method used by modern ransomware operators. In a double extortion scheme, the attackers do not merely encrypt the victim's files to disrupt operations; they also threaten to publish the allegedly stolen data on their public leak site if the ransom demands are not met. This approach places significant pressure on the victim by leveraging the threat of public exposure and regulatory scrutiny.

Data involved in the incident

Regarding the specifics of the breach, there is no specific information regarding the nature of the leaked or threatened data in the provided record or screenshot. The listing does not provide details on the volume of data or the specific types of files that were allegedly targeted during the exfiltration process.

• No specific data types were named in the listing.

About SFG Technology Sdn Bhd

SFG Technology Sdn Bhd is a Malaysia-based engineering firm specializing in high and medium voltage electrical power systems, solar energy, and smart grid solutions. The company provides various energy infrastructure products, including electrical network management systems and power factor capacitors.

Impact and industry implications

The Qilin (Agenda) group is known as a RaaS (Ransomware-as-a-Service) entity that has been active since 2022 and utilizes double extortion tactics. Given that the organization operates in the energy and utilities sector, the breach may pose risks to operational continuity and critical infrastructure security. The nature of the energy sector makes it a high-value target for threat actors due to the essential services provided by such companies.

Depending on the content of the leaked data, risks such as identity theft or targeted phishing attacks against employees and customers may be observed. Furthermore, the organization may face legal sanctions under Malaysian data protection regulations. Considering the group's known methods, the publication of data could potentially have negative impacts on the organization's commercial reputation.

In general, when organizations in the energy and utilities sector face such threats, they must prioritize the security of both their information technology (IT) and operational technology (OT) environments. Maintaining robust network segmentation, implementing strict access controls, and ensuring continuous monitoring of network traffic are standard defensive measures used to mitigate the risk of unauthorized access and data exfiltration. Furthermore, organizations often focus on regular backups and incident response planning to ensure that operational continuity is maintained even in the event of a successful cyberattack.