VULNpocalypse
LowBreach / campaignMonitoring

Orova ransomware group claims MARDEC Berhad on its leak site

The orova ransomware group lists MARDEC Berhad on its leak site, per RansomLook; the claim is unconfirmed, so partners should watch for official notice.

Published
Exploitation
No, only a leak-site listing tracked by RansomLook, not confirmed by the victim

What happened

According to the claim tracker RansomLook, the orova ransomware group posted MARDEC Berhad on its leak site on 2026-11-02. The listing’s description, as reproduced by RansomLook, calls MARDEC Berhad the former Malaysian Rubber Development Corporation (MRDC). It says the company was set up in 1969 as a fully government-owned company.

The leak-site listing is the group’s claim and does not prove anything by itself. MARDEC Berhad has not confirmed it. No independent outlet has reported it, and the available source contains no independent verification.

The following details are not confirmed:

  • the entry point
  • whether data was taken or systems were encrypted
  • the data volume or data types
  • any ransom demand

RansomLook’s page also shows orova posting other organisations on the same date.

Am I affected?

Not confirmed. The source does not name any affected systems, products, customers or data. No CVE or software vulnerability is associated with this claim in the sources.

What to do now

  1. If you are a MARDEC Berhad customer, supplier or partner, watch for an official notice from the company.
  2. Be cautious with unexpected messages that refer to this incident, because the claim has not been verified.
  3. Check the RansomLook orova page for any changes to the listing.

Sources