Ransomware victim disclosure
← All victimsThe company MST (Sanko Makina and ASKO Holding)
Claimed by blacknevas · listed 20 days ago
Status timeline
- Listed
Apr 30, 2026
- Data leaked
At a glance
- Group
- blacknevas
- Status
- Data leaked
- Country
- TR
- Sector
- Manufacturing
- Listed on leak site
- Apr 30, 2026
About the victim
AI dossier — public-source company profileASKO Holding is a Turkish holding company rooted in the Konukoğlu family's commercial tradition, operating across construction machinery, agricultural machinery, energy, and technology sectors through more than 8 subsidiaries. Its subsidiary MST (operating under the Sanko Makina brand) designs and manufactures armored backhoe loaders and telehandlers supplied to the Turkish Armed Forces, Gendarmerie, and Police for military engineering and counter-terrorism operations. The group employs over 1,800 people and exports to more than 45 countries.
- Industry
- Defence & Military Engineering Equipment Manufacturing
- Address
- Turkey (Gaziantep region, associated with Konukoğlu family / Sanko Group); full street address not stated in available sources
- Employees
- 1800
Attack summary
Severity: critical — The victim is a confirmed supplier to Turkish national defence forces (TSK, Gendarmerie, Police) working with the Presidency of Defence Industries (SSB); seven months of exfiltrated data from a defence-sector manufacturer constitutes a regulated, nationally sensitive data exposure with potential implications for military procurement, operational security, and state defence programmes.The group claims to have exfiltrated a significant volume of data over seven months and subsequently encrypted the stolen files, storing them in secure storage; a ransom of 15 bitcoins is demanded for their release.
Data the group says was taken
AI dossier — extracted from the leak post- Exfiltrated corporate files (volume unspecified)
- Encrypted copies of stolen data
- Potential defence/military contract documentation
- Operational and supplier records
What the group claims
The company MST (Sanko Makina and ASKO Holding) has direct and close ties to the Turkish defense industry. It serves as an important supplier of specialized military engineering equipment for Turkish security forces. Here is exactly how the company is connected to the defense sector: 1. Production of Armored Construction Equipment: Ordinary construction machinery is vulnerable in combat zones. MST develops and manufactures armored backhoe loaders and telehandlers specifically designed for military needs. The cabins, engine compartments, and vital components of these machines are protected by armor capable of withstanding small arms fire and improvised explosive device (IED) blasts. 2. Supplies for the Army and Police: The primary customers for MST's military products are the Turkish Armed Forces (TSK), the General Command of the Gendarmerie, and the General Directorate of Security (Police). 3. Specific Applications: MST's military equipment is actively used by engineering troops and special forces for the following tasks: • Digging trenches and building defensive berms on the front lines; • Dismantling barricades, destroying militant shelters, and clearing streets during anti-terrorist operations (such equipment was heavily used by Turkish security forces during urban operations in the southeastern part of the country); • Safely neutralizing explosive devices on roads; • Constructing and fortifying military outposts and bases. 4. Integration into State Defense Programs: MST works in close cooperation with the Presidency of Defense Industries (SSB) of Turkey. The production of indigenous armored engineering equipment is part of Turkey's state strategy for import substitution and ensuring the national army's independence from foreign suppliers. 5. Participation in Defense Exhibitions: The MST brand regularly showcases its military developments at major international arms exhibitions, such as IDEF (International Defence Industry Fair), offering its armored special equipment not only to the domestic market but also for export to allied nations. Information for our partners: > Over the course of seven months, a significant volume of data was stolen. > The obtained files were encrypted and stored in secure storage. > The stated starting price is 15 bitcoins.
Sources
Source
Indexed 20 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
