☑️ Weekly Darkweb – April Week 5, 2026

🔍 Internal Data of Egyptian Refining Company ‘A’ Under EGPC Leaked by BASHE Ransomware Gang

• On April 27, Egyptian refining company ‘A’, a subsidiary of the Egyptian General Petroleum Corporation (EGPC), had been listed as a victim on the BASHE ransomware gang’s data leak site.

  ✓ Company ‘A’ is a key player in Egypt’s energy industry, refining over 3.5 million tons of crude oil annually, with an annual revenue of approximately USD 3 billion.

• As evidence of the attack, the BASHE ransomware gang uploaded images of internal documents, including oil processing facility blueprints and employee attendance reports.

• On April 29, the ransomware gang released a link to a 500MB dataset containing internal documents, financial statements, and personal files of employees.

🔍 Japan Aerospace Exploration Agency Database for Sale on Dark Web

• On April 27, a post offering 7TB database of the Japan Aerospace Exploration Agency (JAXA) was identified on the dark web hacking forum ‘PwnForums.’ (Price: USD 500)

  ✓ JAXA, established in 2003 to conduct basic aerospace research and develop rockets and satellites, is a leading research organization that has successfully carried out projects such as the 2024 lunar landing mission.

• Forum user ‘APT001’ claimed to have obtained the data directly and uploaded a screenshot of the file tree as evidence of the attack.

  → On April 1, a post claiming the exfiltration of 6.9 TB of data from the JAXA was uploaded to the ALP-001 ransomware gang’s data leak site. The site is currently inaccessible.

🔍 Confidential Security Strategy Data of Taiwan and China Offered for Sale

• On April 26, a post offering confidential security strategy data related to Taiwan and China was uploaded on the dark web hacking forum ‘DarkForums.’ (Price: USD 16,000)

• The threat actor claims to have obtained 1.8 GB of data, including cybersecurity and strategic intelligence, infrastructure and economic reports on Taiwan-based global semiconductor manufacturer ‘T’, Chinese naval radar R&D data, and China’s Wuling Base military infrastructure project document.

• As evidence, the threat actor uploaded images of a cyber threat analysis report issued by Taiwan’s National Information Security Center (NICS), a commendation letter for construction quality excellence from Taiwan’s Ministry of National Defense, and a confidential report on a Chinese naval radar R&D project.

*The full report is available upon request and for XARVIS subscribers.