INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Thegentlemen Publishes New Victim Skyplan Services
| 2026-10-09 19:26 CRITICAL LOW RANSOMWARE & EXTORTION
Executive Summary
AI-generated
On October 6, 2026, Skyplan Services Limited, a private aviation flight planning and dispatch company based in Calgary, Alberta, Canada, with operations in Dubai (UAE), China, and Finland, employing approximately 85 people, was targeted by an attack. The attackers compromised the DNS records of skyplan.com, which is hosted on Barracuda's cloud services. No well-known cloud or SaaS service was detected, but the company's flagship Aurora Flight Planning System was affected. Twelve employees were found to have been involved in the compromise, and one third-party employee credential was exposed. The attack occurred approximately three days before it was discovered by security researchers on October 9, 2026.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
NORTH_AMERICA
NORTH_AMERICA
NORDICS
NORDICS
technologytechnology
retailretail
energyenergy
financefinance
manufacturingmanufacturing
healthhealth
Incident Timeline
2026/10/06
Threat actors used a phishing campaign to target Skyplan Services Limited, resulting in the compromise of sensitive information.
Click on any entity below to view its context and source!
target_region
Canada
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
target_region
United Arab Emirates
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
target_region
China
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
target_region
Finland
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
organisation
UTC
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
organisation
Skyplan Services Limited
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
2026/10/09
Threat actors used a phishing campaign targeting Skyplan Services Limited, resulting in the publication of a new victim on Thegentlemen.
Click on any entity below to view its context and source!
target_region
Canada
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
target_region
United Arab Emirates
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
target_region
China
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
target_region
Finland
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
organisation
UTC
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
organisation
Skyplan Services Limited
…ng
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
skyplan.com zoominfo.com/c/skyplan-services-ltd/81691062 Skyplan Services Limited is a private, self-funded aviation flight planning and dispatch company founded in 1983 in Calgary, Alberta, Canada, with major operations in Dubai (UAE), China, and Finland, employing ~85 people.
2026/10/09
Threat actors used Infostealer to target Skyplan Services, a company providing flight planning services.
Click on any entity below to view its context and source!
organisation
Microsoft 365
…nclude:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all
Cloud / SaaS Services Detected
No well-known cloud or SaaS service detected.
Legal Disclaimer:
Ransomware.live
does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
organisation
cfgg9oikc9d4fj785tua9ku6g7
v
…nclude:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all
Cloud / SaaS Services Detected
No well-known cloud or SaaS service detected.
Legal Disclaimer:
Ransomware.live
does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
organisation
Skyplan Services
🏴☠️ Thegentlemen has just published a new victim : Skyplan Services.
organisation
Tracxn
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
organisation
Boeing
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
organisation
ARINCDirect
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
organisation
Collins Aerospace
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
organisation
Lido (Lufthansa Systems
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
financial
1 company
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
organisation
Infostealer
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
organisation
HudsonRock
Compromised Employees
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
organisation
ParanoidLab
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
organisation
DNS Records
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
organisation
DNS
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
data_breach
12 Party Employee Credentials
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
organisation
Barracuda
Barracuda
d127877b.ess.barracudanetworks.com.
Tactical Metrics
Metrics
infrastructure
Microsoft 365
Affected Product
Click for context!
…nclude:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all
Cloud / SaaS Services Detected
No well-known cloud or SaaS service detected.
Legal Disclaimer:
Ransomware.live
does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
Metrics
data_breach
365
Gqv3C4Shpn64Oldnmb35G4Njq2 Ot9Cv9Q2C9C4R1J07E3O1Iu2S4 H1G3D22Jbdjmlol88Ekcgel2Fu
…nclude:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all
Cloud / SaaS Services Detected
No well-known cloud or SaaS service detected.
Legal Disclaimer:
Ransomware.live
does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
Metrics
financial
1
Financial Impact / Stolen Funds
The company is ranked #1 among independent flight planning competitors (Tracxn), led by CEO Mohammad Sami, competing against giants like Jeppesen (Boeing), ARINCDirect (Collins Aerospace), and Lido (Lufthansa Systems).
Metrics
data_breach
12
Party Employee Credentials
Infostealer activity detected by
HudsonRock
Compromised Employees:
0
Compromised Users:
12
Third Party Employee Credentials:
1
External Attack Surface:
8
Exposure Report
by
ParanoidLab
221
Passwords
11 critical
DNS Records:
The following DNS records were found for the victim's domain.
Intelligence Sources
Ransomware Live
2026-10-09
Unpublish from Social Media?
Are you sure you want to delete this podcast video from all synchronized social networks (YouTube, Facebook, Threads)?
Important:
Due to Meta API restrictions, Instagram Reels cannot be deleted automatically via API by third-party apps.
View Profile to Delete Manually
View Profile to Delete Manually
Tactical Intelligence
Report Intelligence Issue
Podcast Options
Generate
Incident Version History
CURRENT VERSION
Last Updated: 2026-10-10T12:04
Comprehensive Tactical Telemetry
Highly Correlated Entities
16x
organisation
Identified Entity
UTC
entity
6x
industry
Targeted Sector
Finance
sector
5x
timeline
Temporal Reference
2026/10/09
date
4x
target region
Target Country
Canada
country
2x
tactic
Cyber Operation Type
Exfiltration
tactic
Contextual Telemetry
Context Block
15 METRICS
attribution
Attributing Entity
Sector
Agriculture and Food Production
Education
Energy & Utilities
Financial Services
Government & Defense
Healthcare
Hospitality
Manufacturing
Other
Professional Services
Retail & E-Commerce
Technology
Transportation
Description:
authority
infrastructure
Affected Product
Microsoft 365
software
data breach
Gqv3C4Shpn64Oldnmb35G4Njq2 Ot9Cv9Q2C9C4R1J07E3O1Iu2S4 H1G3D22Jbdjmlol88Ekcgel2Fu
365
gqv3c4shpn64oldnmb35g4njq2 ot9cv9q2c9c4r1j07e3o1iu2s4 h1g3d22jbdjmlol88ekcgel2fu
malware
Malware Payload
Hydraq
tool
general metric
Aircraft Types
450
aircraft types
general metric
Fuel Locations
1,600
fuel locations
financial
Financial Impact / Stolen Funds
1
company
tactic
MITRE ATT&CK Technique
T1589.001 - Credentials
technique
general metric
Infostealer Activity
0
infostealer activity
data breach
Party Employee Credentials
12
party employee credentials
general metric
External Attack Surface
1
external attack surface
general metric
Exposure Report
8
exposure report
general metric
Paranoidlab
221
paranoidlab
general metric
Critical Dns
11
critical dns
general metric
%
5
%
Click on any entity below to view its context in the main text!
Selective Unpublish
Selecciona las redes de las que quieres eliminar esta publicación. El sistema intentará borrar el post real de la API y limpiará la base de datos para que puedas volver a lanzarlo.
By navigating this website, you accept the use of strictly necessary technical cookies for session security and basic platform functionality. We do not use tracking or advertising cookies.
Read our Privacy Policy.