Ransomware group profile · #285 by claimed victims

Aoqin ransomware

Aoqin is a ransomware operation tracked by VULONE since November 2026. Its leak site has named 4 victims since November 2026, 4 of them in the last 30 days. The group most often targets Professional Services, Technology, Energy & Utilities.

Active First seen Nov 2026

4Victims claimed on leak sites

4Victims in the last 30 days

4Victims in the last 90 days

4Countries hit

0Leak-site URLs tracked

4 Nov 2026Latest claim recorded

Victimology

Who Aoqin claims to have breached, from 4 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services1

Technology1

Energy & Utilities1

Manufacturing1

Top countries

Chile1

Slovenia1

United States1

China1

Latest claimed victims 4 most recent

Victim	Sector	Country	Claimed
SILIKO d.o.o. siliko d.o.o.	Manufacturing	SI	4 Nov 2026
Petroshahd(Enap Sipetrol International - Egypt Branch)	Energy & Utilities	CL	4 Nov 2026
Nextron Technology	Technology	CN	4 Nov 2026
Goldsmith & Hull	Professional Services	US	4 Nov 2026

All 4 Aoqin victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Aoqin is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Aoqin ransomware still active?

Aoqin is tracked as active. The most recent leak-site claim VULONE recorded is dated 4 November 2026. 4 victims were claimed in the last 30 days.

How many victims has Aoqin claimed?

VULONE has recorded 4 leak-site victim claims attributed to Aoqin since November 2026, across 4 countries and 4 sectors.

Which industries does Aoqin target?

The sectors most often named on the Aoqin leak site are Professional Services, Technology, Energy & Utilities.

Which countries are most affected by Aoqin?

Most Aoqin victims recorded by VULONE are located in Chile, Slovenia, United States.

Where does VULONE get Aoqin victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 4 November 2026. Questions or corrections: research@vulone.com.