Classification: TLP:CLEAR | Publication Date: 2026-11-14 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

AOQIN Ransomware Gang: 3 New Leak-Site Listings Across Hospitality, Transportation & Technology

Executive Summary

Dark web monitoring of the AOQIN ransomware group's .onion leak site shows three new listings published between 2026-11-11 and 2026-11-13. AOQIN claims to have compromised the following organizations:

The Tidewater Inn (Hospitality, US) — listed 2026-11-13
Airblue (Transportation, PK) — listed 2026-11-12
Tyfone (Technology, US) — listed 2026-11-11

A leak-site listing is an accusation by a criminal actor, not a confirmed breach. None of these listings constitute evidence that any named organization suffered an intrusion, and this briefing makes no such assertion. What the data does tell us is operationally useful: AOQIN is actively publishing, its current targeting spans hospitality, transportation, and technology verticals, and its geographic footprint in this window covers the United States and Pakistan. Security teams in these sectors — particularly organizations operating VMware vCenter, JetBrains TeamCity, Cisco FMC, or Check Point gateways — should treat this as a cue to run the detection content below, not as confirmation of any specific incident.

Sourcing & Verification

Corroboration status: 0 of 3 listings were independently observed by a second leak-site crawler. All 3 listings are single-source — observed via ransomware.live only, with no second-crawler confirmation that the postings even exist on the actor's infrastructure.
What a listing means: Inclusion on a leak site reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in this data — including multi-source — confirms that any intrusion occurred. Only the named organization or its regulator can confirm an incident.
Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — AOQIN

Profile elements below reflect open-source reporting and community tracking of this actor; where reporting is thin, we say so.

Aliases: AOQIN is tracked under a small set of community-assigned labels; no widely adopted alternate branding has been consistently reported. Analysts should also key on infrastructure and TTP overlaps rather than name alone.
Operating model: Assessed as a closed or semi-closed operation rather than a broad affiliate-driven RaaS. Recent victimology — small-batch, geographically dispersed postings — is consistent with a tight operator set rather than high-volume affiliate churn.
Ransom demands: Typical demands reported for actors of this size fall in the low-to-mid six-figure USD range, scaled to victim revenue, with negotiation conducted over a TOR-hosted chat portal.
Initial access methods (reported): Spear-phishing with macro-enabled Office documents, exploitation of internet-facing remote access (VPN concentrators, RDP exposed to the internet, weak MFA posture), and opportunistic exploitation of known-vulnerable edge devices and management platforms.
Extortion approach: Double extortion — data theft prior to encryption, with leak-site publication used as leverage. The three listings this week follow that playbook: name-and-shame postings designed to pressure organizations into payment.
Dwell time: Actors in this class typically dwell 5–14 days between initial access and detonation, using the window for credential theft, lateral movement, and staged exfiltration. That dwell window is the defender's opportunity — everything in the Detection Engineering section is built around catching activity inside it.

Current Campaign Analysis

Sector targeting. The current posting window shows three sectors: hospitality (The Tidewater Inn, US), transportation (Airblue, PK), and technology (Tyfone, US). This is a notably mixed spread. Hospitality and transportation organizations tend to run lean security teams with high-value PII/payment data stores; a technology-sector listing suggests the group will also pursue firms whose own customer data or source code carries extortion value.

Geographic concentration. Two of three listings are US-based; one is Pakistan-based. There is no tight geographic pattern — this reads as opportunistic access-driven targeting rather than a deliberate regional campaign.

Victim profile. Based on the sectors involved, the claimed organizations span SMB-to-mid-market hospitality, a national commercial airline, and a mid-size technology vendor. Estimated annual revenues in these profiles range from low eight figures (hospitality) to nine figures (national carrier). The common denominator is not size — it is likely perimeter exposure and data value.

Posting cadence / escalation. Three listings in three consecutive days (11-11, 11-12, 11-13) is an accelerated cadence relative to a group with only three postings in its last 100-tracked window. This could indicate a batch of accesses maturing simultaneously (consistent with opportunistic exploitation of a common exposed technology), or an attempt to build leak-site momentum. Watch for follow-on postings in the same sectors over the next 7–10 days.

CVE linkage — hypothesis only. We have no evidence tying any specific CVE to any specific named listing. However, AOQIN-class actors are known to exploit exactly the technology categories currently on the CISA KEV with confirmed ransomware use. Sector-level exposure hypotheses worth hunting against:

CVE-2026-59310 (VMware vCenter path traversal) — virtualization management plane compromise is a classic pre-encryption move; if vCenter falls, hypervisor-wide detonation follows.
CVE-2026-63077 (JetBrains TeamCity deserialization) — build-server compromise fits the technology-sector listing profile and enables supply-chain-flavored downstream access.
CVE-2026-20316 (Cisco Secure FMC hard-coded password) — firewall management compromise yields both initial access and the ability to blind perimeter logging.
CVE-2026-50751 (Check Point improper authentication, IKEv1) — VPN gateway exploitation maps directly to this actor class's remote-access initial vector.
CVE-2026-48027 (Nx Console embedded malicious code) — developer-toolchain compromise fits technology-sector targeting.

Treat these as exposure surfaces to patch and hunt against — not as attribution for any named organization.

Detection Engineering

The Sigma rules below target the TTP chain this actor class runs inside the dwell window: remote-access initial vectors, macro execution, lateral movement via PsExec/WMI, and pre-encryption staging (shadow copy tampering, archive staging).

YAML

---
title: AOQIN-Style Initial Access - Macro-Enabled Office Process Spawning Script Interpreter
id: 8f2a1c3e-7b41-4f9a-9d2e-aoqin000001
status: experimental
description: Detects Microsoft Office processes spawning script interpreters or LOLBins, consistent with phishing-macro initial access used by AOQIN-class ransomware operators.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cmd.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
fields:
  - Image
  - CommandLine
  - ParentCommandLine
  - User
falsepositives:
  - Rare legitimate Office add-ins spawning shell commands
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059
---
title: AOQIN-Style Lateral Movement - PsExec Service Install or Remote WMI Process Creation
id: 8f2a1c3e-7b41-4f9a-9d2e-aoqin000002
status: experimental
description: Detects PsExec-style remote service installation or WMI-spawned processes on remote hosts, a hallmark lateral movement pattern in pre-ransomware intrusion chains.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_psexec_service:
    - EventID: 7045
      ServiceFileName|contains:
        - 'PSEXESVC'
        - '\ADMIN$\'
    - Image|endswith: '\psexec.exe'
  selection_wmi_child:
    ParentImage|endswith: '\wmiprvse.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  condition: selection_psexec_service or selection_wmi_child
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - Computer
falsepositives:
  - Legitimate administrative tooling (SCCM, management agents) — baseline admin accounts and management hosts
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1021.002
---
title: AOQIN Pre-Encryption Staging - Shadow Copy Deletion or Mass Archive Staging
id: 8f2a1c3e-7b41-4f9a-9d2e-aoqin000003
status: experimental
description: Detects Volume Shadow Copy deletion/resize and archive-tool staging of sensitive directories, indicators of ransomware detonation preparation and pre-exfiltration data staging.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'resize shadowstorage'
      - 'Get-WmiObject Win32_Shadowcopy'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '\Users\'
      - '\Shared\'
      - 'recycle'
  condition: selection_vss or selection_staging
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Backup software performing legitimate shadow copy management; IT archiving — whitelist known backup/service accounts
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.collection

KQL — Microsoft Sentinel / Defender

// AOQIN-style pre-ransomware hunt: lateral movement + staging chain on a single host within 60 minutes
// Microsoft Sentinel / Defender XDR
let window = 60m;
let LateralMove =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where (InitiatingProcessFileName =~ "wmiprvse.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe"))
        or (FileName =~ "services.exe" and ProcessCommandLine has_any ("PSEXESVC","ADMIN$"))
        or (FileName =~ "psexec.exe")
    | project LateralTime=TimeGenerated, DeviceName, LateralCmd=ProcessCommandLine, AccountName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","resize shadowstorage","bcdedit")
        or (FileName in~ ("rar.exe","7z.exe","winrar.exe") and ProcessCommandLine has_any (" a "," -p"))
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine;
let NetBeacons =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort in (443, 8443, 8080)
    | where InitiatingProcessFileName in~ ("rundll32.exe","regsvr32.exe","powershell.exe")
    | summarize BeaconCount=count(), RemoteIPs=make_set(RemoteIP, 5) by DeviceName, bin(TimeGenerated, 10m);
LateralMove
| join kind=inner Staging on DeviceName
| where abs(datetime_diff('minute', StageTime, LateralTime)) <= 60
| join kind=leftouter NetBeacons on DeviceName
| project DeviceName, AccountName, LateralTime, LateralCmd, StageTime, StageCmd, BeaconCount, RemoteIPs
| order by StageTime desc;

PowerShell

# AOQIN Rapid Triage: exposed RDP, new scheduled tasks (7d), shadow copy tampering, suspicious services
# Run elevated on suspect hosts or via your RMM/EDR remote shell.
$ErrorActionPreference = 'SilentlyContinue'
$cutoff = (Get-Date).AddDays(-7)
Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
if ($rdp.fDenyTSConnections -eq 0) {
    $nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication
    Write-Host "[!] RDP ENABLED. NLA enforced: $($nla.UserAuthentication) (1=required, 0=NOT required)" -ForegroundColor Red
    Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalAddress,LocalPort | Format-Table
} else { Write-Host "[+] RDP disabled." -ForegroundColor Green }
Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*' } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute + ' ' + $_.Actions.Arguments}} | Format-List
Write-Host "=== [3] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy
if (-not $shadows) { Write-Host "[!] NO shadow copies present — possible anti-recovery tampering." -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table }
Write-Host "=== [4] Services Installed in Last 7 Days (PsExec-style check) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} |
    Where-Object { $_.Message -match 'PSEXESVC|ADMIN\$|\\Temp\\|\\Users\\Public\\' } |
    Select-Object TimeCreated, Message | Format-List
Write-Host "=== [5] Suspicious Outbound Listeners / Beacons ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established |
    Where-Object { $_.RemotePort -in 443,8443,8080 -and $_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
    ForEach-Object { $p = Get-Process -Id $_.OwningProcess; [PSCustomObject]@{Process=$p.ProcessName; Path=$p.Path; Remote=$_.RemoteAddress + ':' + $_.RemotePort} } |
    Where-Object { $_.Path -notmatch 'Program Files|Windows' } | Format-Table -AutoSize
Write-Host "=== Triage complete. Preserve this output and volatile memory before containment. ===" -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist (before encryption fires):

New local/domain admin accounts or unexpected group membership changes, especially outside change windows.
PsExec service artifacts (PSEXESVC, services installing from ADMIN$, \Temp\, or \Users\Public\).
WMI-spawned shells (wmiprvse.exe → cmd.exe/powershell.exe) across multiple hosts from one source.
vssadmin delete shadows, bcdedit recovery tampering, or shadow storage resizing on servers.
RAR/7z executions staging user shares, finance directories, or database exports.
Unusual outbound 443/8443/8080 traffic from LOLBins (rundll32, regsvr32, powershell) — Cobalt Strike-style beaconing.
Backup system logins from non-backup accounts, or backup job deletions/modifications.

Assets this actor class historically prioritizes for exfiltration:

Customer/guest PII and payment data (hospitality: reservation and POS-adjacent databases).
Passenger and operational data (transportation: booking, crew, and manifest systems).
Source code, signing keys, and customer data (technology: build servers, repositories, CRM exports).
Finance and HR stores everywhere: payroll, banking details, executive mailboxes — high-pressure extortion material.

Containment actions, ordered by urgency:

Isolate affected segments at the switch/EDR level — do NOT power off hosts (preserve volatile evidence).
Disable compromised accounts and force enterprise-wide credential resets, prioritizing Domain Admins, service accounts, and VPN users; revoke active sessions and tokens.
Block identified C2 destinations at egress; sinkhole where possible.
Pull backup infrastructure off the network path of the intrusion and verify an offline/immutable restore point before declaring containment.
Snapshot forensic images of patient zero and any staging hosts; capture memory first.
Engage IR retainer / external support and begin scoping for regulatory notification obligations — do not rely on the leak site (or the absence of a listing) to determine reportability.

Hardening Recommendations

Immediate (24 hours):

Patch or mitigate the CISA KEV items in this brief where present in your environment: CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1), CVE-2026-48027 (Nx Console). If patching is impossible in-window, take the management interface off any internet-reachable path.
Enforce MFA on all remote access — VPN, RDP gateways, and vCenter/TeamCity admin consoles. Disable IKEv1 aggressive mode on Check Point gateways where feasible.
Block Office macros from the internet via Mark-of-the-Web policy; deploy the Sigma rules above to your SIEM today.
Alert on vssadmin/bcdedit execution and on RAR/7z outside sanctioned backup workflows.
Verify backups are offline or immutable and test one restore.

Short-term (2 weeks):

Segment the virtualization and management planes: vCenter, backup servers, and build infrastructure (TeamCity) on isolated networks with tiered admin access only.
Implement a tiered administration model; eliminate standing Domain Admin use; deploy LAPS for local admin rotation.
Deploy egress filtering with default-deny for server VLANs; alert on LOLBin-originated outbound connections.
Stand up honey credentials and canary fileshares to catch enumeration during the dwell window.
Roll out application allowlisting on servers (WDAC/AppLocker) to deny unauthorized archive tools and script interpreters.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

AOQIN Ransomware Gang: 3 New Leak-Site Listings Across Hospitality, Transportation & Technology — Detection Rules Inside