Ransomware victim disclosure
← All victimsNational Astronomical Research Institute of Thailand
listed as narit.or.th · Claimed by apt73 · listed 6 hours ago
Status timeline
- Listed
May 21, 2026
- Data leaked
At a glance
- Group
- apt73
- Status
- Data leaked
- Country
- TH
- Sector
- Public Sector
- Listed on leak site
- May 21, 2026
About the victim
AI dossier — public-source company profileThe National Astronomical Research Institute of Thailand (NARIT) is a Thai government scientific organization operating as a public entity. It conducts astronomical research, operates multiple observatories and telescope networks, develops space technology, and provides astronomy education and services to the public, schools, and industry.
- Industry
- Scientific Research & Astronomy
- Address
- 260 Moo 4, Don Kaew Sub-district, Mae Rim District, Chiang Mai 50180, Thailand
Attack summary
Severity: high — Confirmed exfiltration of 16,807 files from a government scientific research organization, including financial and sensitive data. Government entities are high-value targets; exposure of internal documents and financial records poses operational and security risks.APT73 claims to have exfiltrated 16,807 files from NARIT, including internal documents, financial reports, and sensitive information. The group is offering the data for sale with a deadline of 2026-05-27, requesting ransom to prevent publication.
Data the group says was taken
AI dossier — extracted from the leak post- internal documents
- financial reports
- sensitive information
What the group claims
The National Astronomical Research Institute of Thailand (Thailand's National Astronomical Resear...
The leak post
captured from the group's siteDeadline: 2026/05/27 12:00:00 UTC +0 The National Astronomical Research Institute of Thailand (Thailand's National Astronomical Research Institute), a Thai government scientific organization dedicated to astronomy, space research and the popularization of science. Internal documents, financial reports, sensitive information. Total number: 16,807 files. | *Until the files will be available left* | *We always initially offer to buy data by origin company. But we are also ready to consider third-party offers.* | | --- | --- | *If you see that a timer is running in your company's block, you have a chance to avoid a data leak. To do this, you need to write to us in the form and indicate your details. Our support team will contact you shortly and help you. **You must understand that there is no time to think, you must make a decision quickly, the timer has started.** If you see a button at the bottom of your company's publication, this means that all data is publicly available. If you are a customer or employee of a company that has been affected, please contact us and give us the information about yourself that you want removed. We will check what we have related to you and …
Sources
Source
Indexed 6 hours agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.