Skip to content
Leak-site post naming MTCO (Mahmoud Altaheni & Partners Trading Co), captured by ThreatCluster
Back to victims

MTCO (Mahmoud Altaheni & Partners Trading Co)

gammax

Ransomware leak-site victim intelligence · EN

Data size
197GB
Files
2,246
Views
99,300
Posted
Aug 1, 2026
Country
Saudi Arabia
Industry
Trading / Wholesale

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

Gammax claims MTCO (Mahmoud Altaheni & Partners Trading Co) was compromised, with 197GB of data allegedly exfiltrated across 2,246 files, according to the leak page. The leak page identifies the victim as a Saudi Arabia–based trading company, with the domain www.mtest.com.sa. The post is in countdown publication status, with the payment status Waiting for payment and a total due of 0.00 BTC, and notes indicate the dataset includes 2,246 files.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
Tor / Onion service

What was taken

MTCO (Mahmoud Altaheni & Partners Trading Co) operates in Saudi Arabia (KSA) and the GCC with 15+ years’ industry experience, established in ...

File types seen
txt × 1
Sample files (1)
tree.txt

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Fiat
$0.00
Rate
—
Link2
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/
Total
0.00 BTC
label
Waiting for payment...
value
Total 0.00 BTC; Fiat $0.00; Rate —; Amount due 0.00 BTC; Network fee 0.0 sat/byte
LINK 2
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/
Payment
Complete to proceed; 0.00000000 BTC (≈ $0.00 USD); Send to Address bc1q...; Waiting for payment...; Total 0.00 BTC; Fiat $0.00; Rate —; Amount due 0.00 BTC; Network fee 0.0 sat/byte
BTC price
0.00000000 BTC (≈ $0.00 USD)
File Tree
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt
File tree
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt
Total due
0.00 BTC
Amount due
0.00 BTC
Fiat value
$0.00
Attachments
10 files
BTC address
bc1q...
Files label
Files Count 2,246 files
Network fee
0.0 sat/byte
Dataset link
File Tree (http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt)
FileTreeLink
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt
View details
View details
Company Email
[email protected]
Company Phone
+966 12 691 5171
Payment_label
Payment
File_Tree_Link
http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/tree.txt
Location_label
Company Location
Location_value
Sari Road, Sari O ce Bldg, Room 501 Jeddah, Saudi Arabia
Payment status
Waiting for payment...
Bitcoin address
bc1q...
Data size label
Data Size 197GB
Payment details
0.00000000 BTC ≈ $0.00 USD; Waiting for payment; Amount due 0.00 BTC
Payment_details
0.00000000 BTC ≈ $0.00 USD; Send to Address bc1q...
Send to Address
bc1q...
Company Location
Sari Road, Sari O ce Bldg, Room 501 Jeddah, Saudi Arabia
Attachments label
Attachments 10 files
Data download note
Access the complete dataset including 2,246 files
Dataset_attachments
10 files
Waiting for payment
Waiting for payment...

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo of Mahmoud Al-Taheni & Partners Trading Co., featuring stylized text and a graphic element above the company name.
onion leak page512 KB
Screenshot of a business invoice with sections for customer details, item descriptions, and financial totals in Saudi Riyals (SAR).
onion leak page483 KB
The image is a document titled "Order Acknowledgement" with sections for sales details, pre-sales information, and approval signatures.
onion leak page294 KB
Document titled "Purchase Order #PO-223" from Dullb Trading and Contracting Company, detailing an order for a cable with associated information and costs.
onion leak page387 KB
Screenshot of a table displaying order details, including columns for Order No, Date, Product category, Project, Customer Ref, Customer, Order Amount, Posted Value, Unposted Value, Posting Preview, and Payments.
onion leak page457 KB
Invoice document with customer information, itemized list of products, quantities, prices, and total amount due, featuring company branding and tax details.
onion leak page328 KB
The image is a delivery order document featuring customer and invoice details, item descriptions, quantities, and a total price.
onion leak page250 KB
The image is a delivery order document featuring customer details, itemized product list, quantities, and total price before VAT.
onion leak page483 KB
Screenshot of a purchasing order document listing items, quantities, unit prices, and total costs for a construction project.
onion leak page426 KB
Document titled "PURCHASE ORDER" with details including vendor information, delivery address, and order specifics. Contains sections for PO number, attention, and validity dates.
onion leak page433 KB

Negotiation
Email [email protected]
Onion http://cdn2sgwsr62mcjmhehmqzqd5pr73gfzrpg2ekthooaagnxgur2nnepqd.onion/e86e8ebd/