APT73 2026 activity
Extortion group. 6 reports in 4 countries: 0 confirmed, 6 claimed or disputed. Latest 21 May 2026.
Thailand · 
Bangladesh · 
Kenya · 
Philippines
🎯 What sources say
- Thailand: Listed Mahidol University in April and NARIT in May 2026. ransomware.live Thailand
- Philippines: Listed about 50 GB of alleged DPWH files in March and the dpwh.gov.ph domain in April. Daily Tribune
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedNational Astronomical Research Institute of Thailand | Thailand | 21 May 2026 | Government | Data leak | APT73 | Claimed. APT73 listed narit.or.th on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedMahidol University | Thailand | 27 Apr 2026 | Education | Data leak | APT73 | Claimed. APT73 listed mahidol.ac.th on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedBank Asia | Bangladesh | 27 Apr 2026 | Finance | Data leak | APT73 | Claimed. APT73 listed bankasia-bd.com on its leak site. No statement from the bank was found. | ransomware.live✓ 8 Nov |
| ⚠️ ClaimedNOVOAIR | Bangladesh | 27 Apr 2026 | Transport | Data leak | APT73 | Claimed. APT73 listed the private airline's domain novoair-bd.com on its leak site the same day as Bank Asia. | ransomware.live✓ 8 Nov |
| ⚠️ ClaimedIFMIS, National Treasury | Kenya | 14 Apr 2026 | Government | Data leak | APT73 | Claimed. The Bashe group, also tracked as APT73, listed the Treasury's financial management system ifmis.go.ke on its leak site. Leak size is unknown. | Breachsense · ransomware.live✓ 8 Nov |
 ⚠️ ClaimedDepartment of Public Works and Highways (DPWH) | Philippines | 23 Mar 2026 | Government | Data leak | APT73 | Claimed. Bashe (APT73) listed about 50 GB of DPWH files on its leak site; Secretary Vince Dizon said initial findings showed internal systems secure. | Daily Tribune · Ransomware.live (Philippines)✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology