Skip to content
Leak-site post naming MTCO (Mahmoud Altaheni & Partners Trading Co), captured by ThreatCluster
Back to victims

MTCO (Mahmoud Altaheni & Partners Trading Co)

gammax

Ransomware leak-site victim intelligence · EN

Data size
197GB
Files
2,246
Views
51,200
Posted
Aug 1, 2026
Country
Saudi Arabia (KSA) and the GCC
Industry
trading

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

Gammax claims MTCO (Mahmoud Altaheni & Partners Trading Co) was compromised, with 197GB of data allegedly exfiltrated across 2,246 files, according to the leak page. The leak page identifies the victim as a Saudi Arabia–based trading company, with the domain www.mtest.com.sa. The post is in countdown publication status, with the payment status Waiting for payment and a total due of 0.00 BTC, and notes indicate the dataset includes 2,246 files.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

MTCO (Mahmoud Altaheni & Partners Trading Co) operates in Saudi Arabia (KSA) and the GCC with 15+ years’ industry experience, established in ...

File types seen
txt × 1

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Fiat
$0.00
Rate
—
Total
0.00 BTC
LINK 2
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/
Payment
Complete to proceed
BTC price
0.00000000 BTC (≈ $0.00 USD)
File Tree
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt
File tree
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt
Total due
0.00 BTC
Amount due
0.00 BTC
Fiat value
$0.00
Attachments
10 files
BTC address
bc1q...
Network fee
0.0 sat/byte
Company Email
[email protected]
Company Phone
+966 12 691 5171 (tel:+966 12 691 5171)
Payment status
Waiting for payment...
Bitcoin address
bc1q...
Send to Address
bc1q...
Data download note
Access the complete dataset including 2,246 files

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo of Mahmoud Al-Taheni & Partners Trading Co., featuring stylized text and a graphic element above the company name.
onion leak page512 KB
Screenshot of a business invoice with sections for customer details, item descriptions, and financial totals in Saudi Riyals (SAR).
onion leak page483 KB
The image is a document titled "Order Acknowledgement" with sections for sales details, pre-sales information, and approval signatures.
onion leak page294 KB
Document titled "Purchase Order #PO-223" from Dullb Trading and Contracting Company, detailing an order for a cable with associated information and costs.
onion leak page387 KB
Screenshot of a table displaying order details, including columns for Order No, Date, Product category, Project, Customer Ref, Customer, Order Amount, Posted Value, Unposted Value, Posting Preview, and Payments.
onion leak page457 KB
Invoice document with customer information, itemized list of products, quantities, prices, and total amount due, featuring company branding and tax details.
onion leak page328 KB
The image is a delivery order document featuring customer and invoice details, item descriptions, quantities, and a total price.
onion leak page250 KB
The image is a delivery order document featuring customer details, itemized product list, quantities, and total price before VAT.
onion leak page483 KB
Screenshot of a purchasing order document listing items, quantities, unit prices, and total costs for a construction project.
onion leak page426 KB
Document titled "PURCHASE ORDER" with details including vendor information, delivery address, and order specifics. Contains sections for PO number, attention, and validity dates.
onion leak page433 KB

Negotiation
Email [email protected]