Ransomware Group: QILIN

VICTIM NAME: www[.]nexus[.]edu[.]my

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to an educational institution based in Malaysia, specifically associated with the domain www.nexus.edu.my. The attack was discovered and publicly announced on May 27, 2025, with the compromise date suspected to be around the same timeframe. The organization’s mission focuses on promoting diversity and fostering talents through respectful mentorship, emphasizing an inclusive learning environment. The leak includes a screenshot illustrating the impact of the breach, with the compromised data likely affecting internal systems or sensitive operational details.

The threat actors, identified as part of the group “qilin,” have published information related to the breach, although no specific data stealer software is mentioned. The leak page contains a link to a secure onion site for further verification or details. The leaked information may include internal documents or communications supporting the organization’s educational mission, but sensitive PII has been omitted to ensure privacy. Images presented in the leak hint at internal screenshots, possibly including confidential content, but no explicit personal data is visible. The attack underscores cybersecurity risks faced by educational institutions and highlights the importance of robust defense measures against ransomware threats.