Malas
Data as of August 16, 2026.
Credential exposure before the attack
34.5% of Malas victims whose domain we can identify (10 of 29) had employee credentials leak in the 12 months before Malas named them as a victim.
We don't know whether any of these credentials were how Malas gained initial access.
What industries Malas targets
Sector identified for 11 of 29 victims.
| Technology | 4 | |
| Manufacturing | 3 | |
| Construction | 2 | |
| Financial Services | 1 | |
| Government | 1 |
Where the victims are located
Country identified for 21 of 29 victims.
| Russia | 11 | |
| Italy | 3 | |
| Argentina | 1 | |
| Indonesia | 1 | |
| Germany | 1 | |
| India | 1 | |
| Philippines | 1 | |
| Colombia | 1 |
Most recent Malas victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| ConnectTo connectto.com | Not identified | Not identified | Jun 9, 2023 |
| KOPCHENOV kopchenow.ru | Not identified | Russia | Jun 9, 2023 |
| LunarWeb lunarweb.io | Not identified | Not identified | Jun 9, 2023 |
| Oasis Ads oasisads.com | Not identified | Not identified | Jun 9, 2023 |
| Servista servista.ru | Not identified | Russia | Jun 9, 2023 |
| TSNIIHM (State Scientific Center of the Russian Federation Federal State Unitary Enterprise) cniihm.ru | Government | Russia | May 30, 2023 |
| Custom Manufacturing & Engineering custom-mfg-eng.com | Manufacturing | Not identified | May 30, 2023 |
| glassfurnitura.ru | Manufacturing | Russia | May 30, 2023 |
| Aster Cucine astercucine.it | Manufacturing | Italy | May 24, 2023 |
| EUROEXPO euroexpo.ru | Not identified | Russia | May 24, 2023 |
| KondorCS kondorcs.com | Technology | Not identified | May 24, 2023 |
| altia.es | Not identified | Spain | May 23, 2023 |
| imedi-group.ru | Technology | Russia | May 23, 2023 |
| Clemens Pergler IT Services pergler-it.com | Technology | Not identified | May 23, 2023 |
| Banco Azzoaglio azzoaglio.it | Financial Services | Italy | May 19, 2023 |
| RP Baggio baggio.com.ar | Not identified | Argentina | May 19, 2023 |
| Harita Group bumitama-agri.com | Not identified | Indonesia | May 19, 2023 |
| Diete-Siepmann diete-siepmann.de | Construction | Germany | May 19, 2023 |
| Fitser fitser.com | Technology | India | May 19, 2023 |
| Fort Rolins Collection Agency fortrolins.com.ph | Not identified | Philippines | May 19, 2023 |
Showing the 20 most recent of 29. Browse recent data breaches for more.
Malas leak site
The address we've seen Malas publish victims from. Any .onion address needs the Tor Browser.
malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion
Malas questions
Is Malas still active?
Not for over a year. The last victim we recorded was June 9, 2023. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Malas claimed?
Malas has named 29 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Malas first appear?
The first victim we recorded for Malas was posted on May 19, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Malas target?
Technology accounts for the most victims we can classify, with 4. Manufacturing follows at 3. We could identify a sector for 11 of 29 victims, so treat this as the shape of the targeting rather than a full census.
Has Malas already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.