CNESTEN (Morocco) listed by Qilin ransomware group

Overview

The Qilin ransomware group added CNESTEN, Morocco's Centre National de l'Energie et des Technologies Nucleaires (National Center for Nuclear Energy, Science and Technology), to its leak site on 11 October 2026. The listing follows reported infostealer activity attributed to the group, though the exact scope of the stolen data has not been disclosed.

What was published

• Group: Qilin (RaaS, active on the leak blog at the.onion address above).
• Posting date: 2026-10-11 (listing discovered the same day).
• Data volume and types: not disclosed at the time of writing.
• The group's short claim references prior infostealer activity, suggesting credentials or session tokens as a possible initial access vector, per third-party reporting.

Risks for affected individuals

CNESTEN is a Moroccan state body that coordinates research and applications of nuclear energy and radiation technologies across energy, medicine, agriculture and industry. It is not a reactor operator; its mandate is research, regulation support and technology transfer for peaceful uses of nuclear science in the Kingdom. Staff, partners and regulated institutions could face credential reuse and targeted phishing if account data is confirmed among the stolen material.

What remains unknown

Whether any data was exfiltrated, which systems were affected, and whether CNESTEN has confirmed the incident are not independently verified. The leak URL returned no live page during capture, so no screenshot was available and the group's full description could not be retrieved.

What affected people should do

Members of the public should monitor official CNESTEN communications on cnesten.org.ma for an authoritative statement. Anyone who holds an account, credential or certificate issued by CNESTEN should change related passwords and enable strong authentication once official guidance is published.