Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2672 published victims and 5 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Qilin is tracked by Dark Eye as a ransomware group with 2672 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
2672
- Leaked 440 16.5%
- Pending 2222 83.2%
- Deleted 10 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 3h ago | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Down checked 3h ago | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
| Leak location 2 | Onion service | Down checked 3h ago | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
| Leak location 4 | Onion service | Down checked 3h ago | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 1 | Onion service | Down checked 3h ago | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
Top Activity Sectors (18)
- Not identified 512
- Services 310
- Communication / Marketing 276
- Manufacturing / Engineering 258
- Finance / Legal / Insurance 206
- IT 180
- Construction / Real Estate 173
- Healthcare / Pharma 147
- Retail / E-commerce 113
- Education 84
- Public Sector 79
- Transportation / Travel / Logistics 68
- Energy 57
- Hospitality / Food & Beverage / Tourism 51
- Agriculture / Food 46
- Telecommunications 34
- NGOs / Associations 28
- Sports 1
Typical Attacks (52)
▼How Qilin typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Qilin.
-
T1190 Exploit Public-Facing Application Initial Access
What they do: Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.
What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
-
T1566.001 Spearphishing Attachment Initial Access
What they do: Qilin has been delivered to victims through malicious email attachments.
What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
-
T1566.002 Spearphishing Link Initial Access
What they do: Qilin has been delivered via malicious links in spearphishing emails.
What that means: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
-
T1047 Windows Management Instrumentation Execution
What they do: Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
What they do: Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.
What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
-
T1059.001 PowerShell Execution
What they do: Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1059.003 Windows Command Shell Execution
What they do: Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1204.001 Malicious Link Execution
What they do: Qilin has been executed by luring victims into clicking links in spearphishing emails.
What that means: An adversary may rely upon a user clicking a malicious link in order to gain execution.
-
T1204.002 Malicious File Execution
What they do: Qilin has been delivered to victims through spearphishing emails with malicious attachments.
What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.
-
What they do: Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
What they do: Qilin can configure a Winlogon registry entry.
What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
-
What they do: Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.
What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.
-
What they do: Qilin can use an embedded Mimikatz module for token manipulation.
What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
-
What they do: Qilin has pushed a scheduled task via a Group Policy Object for payload execution.
What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
-
T1548.002 Bypass User Account Control Privilege Escalation
What they do: Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.
What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1036.004 Masquerade Task or Service Stealth
What they do: Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.
What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1070.004 File Deletion Stealth
What they do: Qilin can delete itself from infected hosts after execution.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1480 Execution Guardrails Stealth
What they do: Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1480.002 Mutual Exclusion Stealth
What they do: Qilin can create a mutex to ensure only one instance is running.
What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
-
T1678 Delay Execution Stealth
What they do: Qilin has the ability to delay execution.
What that means: Adversaries may employ various time-based methods to evade detection and analysis.
-
T1222 File and Directory Permissions Modification Defense Impairment
What they do: Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.
What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Qilin can terminate antivirus-related processes and services.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1685.005 Clear Windows Event Logs Defense Impairment
What they do: Qilin has the ability to clear Windows Event Logs.
What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
-
T1688 Safe Mode Boot Defense Impairment
What they do: Qilin can reboot targeted systems in safe mode to avoid detection.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1003.001 LSASS Memory Credential Access
What they do: Qilin can employ an embedded Mimikatz module to dump LSASS memory.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1007 System Service Discovery Discovery
What they do: Qilin can identify specific services for termination or to be left running at execution.
What that means: Adversaries may try to gather information about registered local system services.
-
T1012 Query Registry Discovery
What they do: Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.
What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
-
T1016 System Network Configuration Discovery Discovery
What they do: Qilin can accept a command line argument identifying specific IPs.
What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
-
T1018 Remote System Discovery Discovery
What they do: Qilin can enumerate domain-connected hosts during its discovery phase.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1057 Process Discovery Discovery
What they do: Qilin can define specific processes to be terminated or left alone at execution.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1069.002 Domain Groups Discovery
What they do: Qilin can run PowerShell cmdlets to discover domain groups.
What that means: Adversaries may attempt to find domain-level groups and permission settings.
-
T1082 System Information Discovery Discovery
What they do: Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: Qilin can exclude specific directories and files from encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1087.001 Local Account Discovery
What they do: Qilin can list all local users found on a targeted system.
What that means: Adversaries may attempt to get a listing of local system accounts.
-
T1087.002 Domain Account Discovery
What they do: Qilin can use PowerShell cmdlets to enumerate domain users.
What that means: Adversaries may attempt to get a listing of domain accounts.
-
T1135 Network Share Discovery Discovery
What they do: Qilin has the ability to list network drives.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1673 Virtual Machine Discovery Discovery
What they do: Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.
What that means: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.
-
T1680 Local Storage Discovery Discovery
What they do: Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1021.004 SSH Lateral Movement
What they do: Qilin can enable SSH access on ESXi hosts.
What that means: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).
-
T1570 Lateral Tool Transfer Lateral Movement
What they do: Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.
What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
-
T1071.002 File Transfer Protocols Command and Control
What they do: Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.
What that means: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
-
T1219.002 Remote Desktop Software Command and Control
What they do: Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.
What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
-
T1486 Data Encrypted for Impact Impact
What they do: Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Qilin can terminate specific services on compromised hosts.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
-
T1529 System Shutdown/Reboot Impact
What they do: Qilin can initiate a reboot of the backup server to hinder recovery.
What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Tools Observed (27)
▼Software Qilin has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
Mimikatz
Defense evasion
EDRSandBlast
PCHunter
PowerTool
Toshiba power management driver (BYOVD)
Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
YDArk
Zemana Anti-Rootkit driver
Discovery
Nmap
Nping
Discovery & enumeration
Nmap
Nping
Exfiltration
EasyUpload.io
EasyUpload
LOLBAS (living-off-the-land binaries)
fsutil
PsExec
WinRM
Networking & tunnelling
Proxychains
OffSec
Cobalt Strike
Evilginx
NetExec
Offensive security tooling
Cobalt Strike
Evilginx
NetExec
RMM Tools
ScreenConnect
Remote monitoring & management
NetSupport
ScreenConnect
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README-RECOVER-[rand]_2.txt
-- Qilin We have 3.4TB of your data stored on our servers. Contact us or we will publish this data on our blog, in the media and pass it on to the relevant authorities. We are ready to offer you a discount in case of payment within a week. Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: 2ir53sQQAU Domain: [snip] login: [snip] password:[snip]
README-RECOVER-[rand].txt
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: [snip] Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion login: [snip] password:[snip]
DtMXQFOCos-RECOVER-README.txt
-- Agenda
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
- Employees personal dataCVsDLSSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients databillsbudgetsannual reportsbank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials
-- Credentials
Extension: DtMXQFOCos
Domain: wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion
login: [snip]
password: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (2672)
Search, filter and paginate the victim timeline for Qilin. Showing 1601–1700 of 2672.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Grupo Promasa id23293 View details | Mexico | Communication / Marketing | pending | ||
|
Grupo Promasa is a company that operates in the Building Materials industry. It employs 250to499 people and has 10Mto25M of revenue. The company is headquartered in San Pedro Sula, Cortes, Honduras. The amount of downloaded data is unknown at ... |
||||||
| Ransomware | KHL Printing id23292 View details | Singapore | Communication / Marketing | pending | ||
|
KHL Printing, Singapore - one of the largest printing companies in Southeast Asia with the most comprehensive range of services. KHL Printing offers end-to-end solutions from conceptualization to delivery of print products and other platform ... |
||||||
| Ransomware | Real Estate Specialists id23291 View details | United States | Construction / Real Estate | pending | ||
|
Real Estate Specialists is dedicated to managing and maintaining rental properties in southeast Wisconsin, focusing on enhancing their performance since 1982. They offer a comprehensive range of property management services, catering to prope ... |
||||||
| Ransomware | Samera Health id23290 View details | United States | Healthcare / Pharma | pending | ||
|
Samera Health is a Third Party Administrator (TPA) that provides Health, Dental, and Vision benefits for employer groups. The company focuses on delivering innovative and cost-saving solutions while ensuring a positive customer experience thr ... |
||||||
| Ransomware | CHDFS id23289 View details | United States | Services | pending | ||
|
CHDFS Inc is dedicated to providing social services and support for individuals, families, and communities in need. They offer a range of programs including OPWDD, OMH, Early Intervention, and Health Home Care Management. Their mission focuse ... |
||||||
| Ransomware | More Than Gourmet id23286 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
More Than Gourmet, USA - is a food company based on classic French culinary traditions. MTG products are used in gourmet restaurants, resorts and sold in specialty gourmet food stores. Privately held since 1993, MTG has been financially soun ... |
||||||
| Ransomware | Magna Hospitality Group id23284 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Magna Hospitality Group, USA - a private equity firm dedicated to the investment, development and management of hotel properties. Magna employs more than 100 professionals specializing in all areas including investment, finance, legal, hotel ... |
||||||
| Ransomware | KIS Asset Evaluation id23282 View details | United States | Finance / Legal / Insurance | pending | ||
|
KIS Asset Evaluation, Korea - company operating in the financial market, strives to become the No. 1 company in the field of financial asset valuation. KIS Pricing offers a wide range of services and solutions required in the financial indust ... |
||||||
| Ransomware | Applied Technology Resources id23280 View details | United States | IT | pending | ||
|
Applied Technology Resources, Inc. is an international leader in Title Search Exams throughout the United States, offering unmatched accuracy and turnaround times through their proprietary information system. The company specializes in custom ... |
||||||
| Ransomware | Northern Light Technologies id23279 View details | Canada | IT | pending | ||
|
Founded in 1984, Northern Light Technologies (NLT) designs and manufactures underground lighting and networking solutions for the mining and tunnelling industries with manufacturing/assembly locations in Canada, Australia and Chile. Northern ... |
||||||
| Ransomware | Tri City Foods id23273 View details | United States | Agriculture / Food | pending | ||
|
Founded in 2003 and headquartered in Downers Grove, Illinois, Tri City Foods is a franchisee of the Burger King restaurant chain. The company owns and operates locations in and around Chicago, Illinois. A group of companies was attacked: lmc ... |
||||||
| Ransomware | GURBAG id35715 View details | Türkiye | Retail / E-commerce | pending | ||
|
N/A |
||||||
| Ransomware | JA Jennings id23218 View details | United Kingdom | Construction / Real Estate | pending | ||
|
Founded in 1917, J.A. Jennings is a mid-size full-service construction company which constructs private sector commercial interiors projects as well as full-scale building renovations and infrastructure programs throughout the New York City m ... |
||||||
| Ransomware | BIOPHARMEX, SA de CV id23217 View details | Mexico | Communication / Marketing | pending | ||
|
BIOPHARMEX specializes in transforming scientific innovations into health solutions, providing over 30 medical products in Mexico from 10 different countries. The company serves more than 2,000 physicians who use and prescribe their products ... |
||||||
| Ransomware | Stephenson's Rental Services id23216 View details | Canada | Services | pending | ||
|
Stephenson's Rental Services is a Canadian construction equipment and tool rental company that has been operating for over 70 years. The company provides a wide range of rentals, including construction equipment, scaffolding, and small tools, ... |
||||||
| Ransomware | London Women's Clinic id23215 View details | United Kingdom | Healthcare / Pharma | pending | ||
|
London Women's Clinic is a leading fertility clinic established in 1985, offering a wide range of fertility treatments and services across fourteen locations in the UK. Their offerings include IVF, ICSI, IUI, egg donation, and surrogacy, cate ... |
||||||
| Ransomware | Scales Sales & Service id23214 View details | United States | Retail / E-commerce | pending | ||
|
Scales Sales & Service LLC was originally founded in 2004 in Omaha, Nebraska. A full-service scale company with locations in Greeley, CO, Colorado Springs, CO, Denver, CO, Omaha, NE, Kearney, NE, Scottsbluff, NE and Atlantic, IA, in addition ... |
||||||
| Ransomware | Laloma id23213 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
La Loma Tamales is a Mexican restaurant chain in the Minneapolis-St. Paul area known for its traditional, handmade tamales made from fresh ingredients, including a unique process of cooking and grinding their own corn. They offer both savory ... |
||||||
| Ransomware | Khatami Law id23212 View details | United States | Finance / Legal / Insurance | pending | ||
|
Hoss Law is a law firm specializing in personal injury and family law services, dedicated to helping clients in Sacramento and surrounding areas. They focus on maximizing compensation for accident victims and offer a no-win, no-fee guarantee, ... |
||||||
| Ransomware | SANgel id23211 View details | Gabon | Communication / Marketing | pending | ||
|
SANgel est une entreprise gabonaise de production et de distribution alimentaire basée à Libreville, dans la province de l'Estuaire. Fondée en 1994, l'entreprise est spécialisée dans les produits surgelés, qu'elle importe, transforme et ... |
||||||
| Ransomware | Kudela & Weinheimer id23210 View details | United States | Construction / Real Estate | pending | ||
|
KW Landscape Architects is a landscape architecture firm that specializes in creating exceptional built environments by balancing innovation with functionality. With over 30 years of experience, they offer services across various markets incl ... |
||||||
| Ransomware | Distribuciones Camba id23209 View details | Spain | Hospitality / Food & Beverage / Tourism | pending | ||
|
Distribuciones Camba is a wholesale distributor of snacks and candies throughout Galicia. They offer a wide range of products including beverages, chocolates, gummies, and toys, catering primarily to the hospitality sector. Their distribution ... |
||||||
| Ransomware | Klima-Therm id23208 View details | Poland | Services | pending | ||
|
The Company provides innovative air-conditioning, ventilation, cooling and heating solutions and is rapidly growing its business in the Renewable Energy Sources (RES) segment. The flagship brands distributed by Klima-Therm include: Fujitsu, K ... |
||||||
| Ransomware | The Blood and Marrow Transplant Group of Georgia id23207 View details | United States | Healthcare / Pharma | pending | ||
|
The Blood and Marrow Transplant Group of Georgia (BMTGA) specializes in providing advanced care for patients undergoing blood and marrow stem cell transplantation, acute leukemia treatment, and CAR T-cell immunotherapy. They are recognized fo ... |
||||||
| Ransomware | Platinum Wines & Spirits id23206 View details | Singapore | Other | pending | ||
|
Platinum is one of the leading wines and spirits distributors in Singapore, having been in the industry for over a decade. Being the appointed wholesaler for many major wines and spirits companies like Beam Suntory Asia, Bacardi-Martini Singa ... |
||||||
| Ransomware | Sports Medicine and Orthopaedics id23205 View details | United States | Healthcare / Pharma | pending | ||
|
Sports Medicine and Orthopedics is committed to providing excellent patient care and education to orthopedic patients across Rhode Island, Massachusetts, and Connecticut. Led by Dr. Jack Goldstein, a Fellowship Trained Orthopaedic specialist, ... |
||||||
| Ransomware | Winholt Equipment Group id23204 View details | United States | Agriculture / Food | pending | ||
|
Winholt Equipment Group, founded in 1946 and headquartered in Woodbury, New York, is a manufacturer of food service, food handling, and material handling equipment. As a multiple-facilities manufacturer, we have the resources to quickly reac ... |
||||||
| Ransomware | All Weather Architectural Aluminum id23203 View details | United States | Communication / Marketing | pending | ||
|
All Weather Architectural Aluminum specializes in custom windows and doors, providing innovative solutions for both residential and commercial projects. Their extensive range includes sliding, folding, and pivot designs, catering to the uniqu ... |
||||||
| Ransomware | Wassa, SRO id23202 View details | Czechia | Communication / Marketing | pending | ||
|
In 2012, we established a sheltered workshop and we provide more than 100 protected work positions and offer new and new jobs. We can offer so called facultative compensation to our customers and reduce the penalties given by the law for not ... |
||||||
| Ransomware | SIGN Fracture Care International id23201 View details | United States | Education | pending | ||
|
SIGN Fracture Care International is a humanitarian organization dedicated to creating equality in fracture care globally by building sustainable orthopedic capacity in developing countries. They provide education to surgeons and donate the ne ... |
||||||
| Ransomware | Indian Spring Country Club id23200 View details | United States | Communication / Marketing | pending | ||
|
Located in beautiful Boynton Beach, Florida, Indian Spring Country Club is a gated, private country club that has the total package ...championship golf, tennis, fitness, casual and formal dining. The Indian Spring Country Club experience is ... |
||||||
| Ransomware | Grande Prairie Public Library id23199 View details | United States | Communication / Marketing | pending | ||
|
The Grande Prairie Public Library District is located at 3479 West 183rd Street, in Hazel Crest, Illinois. We serve the communities of Hazel Crest and Country Club Hills. We provide service to all residents living within our district boundari ... |
||||||
| Ransomware | BARCO Rent-A-Truck id23198 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Barco Rent-A-Truck is a leading provider of corporate 4x4 pickup truck rentals in the United States, offering a comprehensive fleet of brand new trucks, including 1/2, 3/4, and 1-ton models. Their services cater to a wide range of clients, fr ... |
||||||
| Ransomware | Octomeca OY id23197 View details | Finland | Communication / Marketing | pending | ||
|
Octomeca Oy specializes in load protection solutions for transportation and warehousing, offering a range of stretch film wrapping machines designed to meet demanding packaging challenges. Their products include various series of wrapping mac ... |
||||||
| Ransomware | Gas Generator Solutions id23196 View details | United Kingdom | Energy | pending | ||
|
Gas Generator Solutions (GGS) is a privately owned, independent organization established to provide Lab Managers with single point of contact for the Servicing and Repair of ANY Laboratory Gas Generator within their facility, independent of b ... |
||||||
| Ransomware | Cellini Design Center id23195 View details | Singapore | Retail / E-commerce | pending | ||
|
Cellini is a Singapore-based online furniture shop offering a wide selection of designer home furniture that embodies comfort, luxury, and quality. The company specializes in various furniture categories, including living room, dining room, a ... |
||||||
| Ransomware | Stowaway Storage id23194 View details | United States | Communication / Marketing | pending | ||
|
Opened in the fall of 1998, Stowaway Storage has long been part of the North Haven community. The business has always been family owned and operated since it's beginning. Owner Raymond V Iannucci started the company on land previously utilize ... |
||||||
| Ransomware | Long Island Weight Loss Institute id23192 View details | United States | Healthcare / Pharma | pending | ||
|
Long Island Weight Loss Institute is a medical weight loss clinic that offers physician-supervised weight loss programs designed to treat the whole person. The clinic provides individualized support tailored to each patient's unique needs wit ... |
||||||
| Ransomware | Integrasoft id35716 View details | Mexico | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Gainesville Regional Airport id35717 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
N/A |
||||||
| Ransomware | pandarose.ca id23155 View details | Canada | IT | pending | ||
|
A full range of technology consulting services—from infrastructure and specialized software to digital strategy and support. 1.This is a Non-Disclosure Agreement (NDA) between Fuels Inc. (the client) and Panda Rose Consulting Studios Inc. ... |
||||||
| Ransomware | montship.ca id23154 View details | Canada | Communication / Marketing | pending | ||
|
Montship is Canada's largest shipping agency, providing comprehensive agency services for liner vessels and ports across the country. 1.The document is an internal financial report of Trealship Services Inc. (TSI), prepared by the Allied Mar ... |
||||||
| Ransomware | dalton.com id23153 View details | United States | Healthcare / Pharma | pending | ||
|
Founded in 1986, Dalton Pharma Services is a contract pharmaceutical company providing a full range of development and manufacturing services to pharmaceutical and research companies worldwide. 1.The document is a bank statement from MUFG Ba ... |
||||||
| Ransomware | bmcinnovation.com id23152 View details | United States | Communication / Marketing | pending | ||
|
BMC Strategic Innovation is a company specializing in strategic marketing that collaborates with partners to develop unique solutions to complex problems. They use a modular approach to tailor their services to individual client needs, drawin ... |
||||||
| Ransomware | gslong.com id23151 View details | United States | Agriculture / Food | pending | ||
|
GS Long provides specialized services in plant nutrition, plant protection, and field consulting for the agricultural industry. The company specializes in developing customized solutions to increase crop yields and safety. Committed to buil ... |
||||||
| Ransomware | arpis.com id23150 View details | United States | Communication / Marketing | pending | ||
|
For fifty years, Arpi's has maintained this traditional approach to providing the highest quality service to our Calgary customers in the heating and cooling industry.Arpis Industries is proud to be recognized for its services and commitment ... |
||||||
| Ransomware | pcdpackaging.com id23149 View details | United States | Finance / Legal / Insurance | pending | ||
|
Development of customized industrial packaging. Single-use racks, export packaging, packaging for power units, specialized packaging, packaging for sea containers. 1.The document is an official bank statement from PCD Packaging de México S. ... |
||||||
| Ransomware | coppage.net id23146 View details | United States | Construction / Real Estate | pending | ||
|
At Coppage Construction, we design and build homes. 1.The document is a statement of income for Coppage Construction Company, Inc. for the period ending April 30, 2025. 2.The document is a report entitled “Work in Process” by Coppage Co ... |
||||||
| Ransomware | arizonafireplaces.com id23145 View details | United States | Construction / Real Estate | pending | ||
|
Arizona Fireplaces offers its customers top-notch quality and service for fireplaces and accessories from leading global brands. 1.Arizona Department of Revenue — Contractor’s Certificate (Form 5005) “Contractor's Certificate for Prime ... |
||||||
| Ransomware | Beta Dyne id23139 View details | United States | Energy | pending | ||
|
Beta Dyne, USA - develops and manufactures electrical equipment for the industrial plants, communications и medical. With over 20 years in the power industry, Beta Dyne, Inc. has developed a wide range of unique and high performance power pr ... |
||||||
| Ransomware | Middlesex Appraisal Associates id23138 View details | United States | Communication / Marketing | pending | ||
|
Middlesex Appraisal Associates, USA - provides appraisal services in Eastern Massachusetts in Middlesex, Essex, Suffolk, Norfolk, Worcester, and Plymouth counties. Founded in 1992, the company provides appraisal and consulting services utiliz ... |
||||||
| Ransomware | Sprague & Jackson id23137 View details | United States | Communication / Marketing | pending | ||
|
Sprague & Jackson, USA - Sprague & Jackson is a tax services firm that offers a range of client services including secure document submission and payment options. They provide personalized assistance through scheduled meetings to help clients ... |
||||||
| Ransomware | Standard Sales Company id35718 View details | United States | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Halifax County Public Schools id35719 View details | United States | Education | leaked | ||
|
N/A |
||||||
| Ransomware | GS Long id35720 View details | Singapore | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Packaging Concepts + Design id35721 View details | United States | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | Dalton Pharma Services id35722 View details | United Kingdom | Services | leaked | ||
|
N/A |
||||||
| Ransomware | vericore.com id35723 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Appalachian Community Federal Credit Union id35724 View details | United States | NGOs / Associations | leaked | ||
|
Back Appalachian Community Federal Credit Union |
||||||
| Ransomware | Rex Md id35725 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | stmg.org id35726 View details | Netherlands | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Rasi Laboratories id23136 View details | India | Agriculture / Food | pending | ||
|
Rasi Laboratories, USA - a manufacturer and developer of nutraceuticals, specializing in dietary supplements like capsules, tablets, probiotics, and functional foods. Their facility in Cranbury, New Jersey, spans 198,500 square feet and is ... |
||||||
| Ransomware | Agencia Tributaria id23134 View details | Spain | Communication / Marketing | pending | ||
|
The Spanish Tax Administration Agency (Agencia Tributaria) - is the revenue service of the Kingdom of Spain. The agency is responsible for the effective application of the national tax and customs systems and for those resources of other Publ ... |
||||||
| Ransomware | Richmond Behavioral Health Authority id23133 View details | United States | Public Sector | pending | ||
|
Richmond Behavioral Health Authority (RBHA) is a statewide organization dedicated to providing comprehensive mental health, mental retardation, substance abuse and prevention services to the residents of the City of Richmond. The organization ... |
||||||
| Ransomware | Centurion Family Office Services LLC id23121 View details | United States | Services | pending | ||
|
Centurion originated as an idea to bring the high-value, high-impact services, traditionally reserved for only the wealthiest of individuals, to a broader network of families and entrepreneurs. Our Family Office Services address the needs of ... |
||||||
| Ransomware | Turnkey Africa id23119 View details | Kenya | IT | pending | ||
|
Turnkey Africa is a leading provider of technology solutions for the insurance industry across Africa, specializing in modernizing operations for traditional digital insurers, bancassurers, and pension administrators. They offer a comprehensi ... |
||||||
| Ransomware | Superior Linen Service id23118 View details | United States | Communication / Marketing | pending | ||
|
The Superior Linen Supply Company is designed to serve as an extension of our customers' business. By providing timely delivery of quality merchandise, outstanding service and affordable prices for over a century, customers have come to know ... |
||||||
| Ransomware | Buanderie Blanchelle id23117 View details | Canada | Communication / Marketing | pending | ||
|
Buanderie Blanchelle specializes in the provision and maintenance of hospital textile products, offering a comprehensive turnkey service that includes product supply, post-use recovery, and distribution at a single per-kilogram rate. They pro ... |
||||||
| Ransomware | Pangea id23116 View details | Chile | Retail / E-commerce | pending | ||
|
PANGEA The Travel Store is a boutique travel agency that designs bespoke, full-service trips tailored to individual tastes. It blends an online platform with physical flagship stores so customers can get face-to-face consultations as well as ... |
||||||
| Ransomware | Victory Christian Center id23115 View details | United States | Communication / Marketing | pending | ||
|
Victory Church is a community-focused church located in Tulsa, OK, dedicated to fostering a space where individuals can love God and love people. The church offers a variety of ministries, including programs for children, youth, and young adu ... |
||||||
| Ransomware | Bay West id23114 View details | United States | Services | pending | ||
|
Bay West LLC provides environmental consulting and remediation services for government and commercial enterprises. The company offers services in the areas of industrial storm water permitting and consulting; brownfield site assessment, clean ... |
||||||
| Ransomware | Florida Marking Products id23113 View details | United States | Communication / Marketing | pending | ||
|
The Kennedy Group, an Inovar company, specializes in providing innovative labeling and packaging solutions that enhance brand visibility. They offer a wide range of high-performance products, including pressure-sensitive labels, warehouse loc ... |
||||||
| Ransomware | TF LE TOIT FOREZIEN id23112 View details | France | Construction / Real Estate | pending | ||
|
Real estate - build and manage, possibly acquire and develop for the benefit of its members with a view to accessing property through rental with promise of allocation as defined in articles 15 and following of these statutes, collective and ... |
||||||
| Ransomware | Wheale Law Firm id23111 View details | United States | Finance / Legal / Insurance | pending | ||
|
It's Wheale Law Firm's vision that justice is achieved, tailored to each client's case. Most injury lawyers define success in one way: money. Not surprisingly, these attorneys also treat each case and each client the same. You deserve mor ... |
||||||
| Ransomware | ville-elne id23110 View details | France | Communication / Marketing | pending | ||
|
Elne is a commune in the Pyrénées-Orientales department in southern France. It lies in the former province of Roussillon, of which it was the first capital, being later replaced by Perpignan. Its inhabitants are still called Illibériens i ... |
||||||
| Ransomware | Asahi Group Holdings id23109 View details | Japan | Hospitality / Food & Beverage / Tourism | pending | ||
|
Asahi Group Holdings, founded in 1889 and headquartered in Tokyo, Japan, is a global food and beverage manufacturer specializing in both alcoholic and non-alcoholic beverages as well as snack products. The company operates across multiple int ... |
||||||
| Ransomware | Commune De Saint Claude id23108 View details | France | Services | pending | ||
|
The Mairie de Saint-Claude provides a range of municipal services to the residents of Saint-Claude, a town located in Guadeloupe. Their offerings include administrative services, community support, and urban planning initiatives aimed at enha ... |
||||||
| Ransomware | LEYHAUSEN Research id23107 View details | Germany | Communication / Marketing | pending | ||
|
Leyhausen Research GmbH is a leading provider of global field services since 1996, headquartered in Leverkusen, Germany. The company operates state-of-the-art facilities and call centers across Europe, the Middle East, India, and Africa, offe ... |
||||||
| Ransomware | All Truck Transportation Co., Inc. id23101 View details | United States | Transportation / Travel / Logistics | pending | ||
|
All Truck Transportation Co., Inc. is an asset-based carrier offering local and regional truckload transportation solutions. We are headquartered in Chicago, Illinois with a vast network of terminals throughout the Midwest. We operate within ... |
||||||
| Ransomware | Charles River Properties id23100 View details | United States | Communication / Marketing | pending | ||
|
Charles River Properties, USA - a real estate brokerage based in Waltham, Massachusetts, that handles residential and commercial sales and rentals. The company works only with very large properties. In its portfolio you will not find real es ... |
||||||
| Ransomware | Landmark Management id23098 View details | United States | Services | pending | ||
|
Landmark Management, Inc., manages 90 projects, consisting of 2,462 units across 5 states. Whether you are searching for an apartment to rent or a reliable company to manage your rural development property, let us put our thirty-six years of ... |
||||||
| Ransomware | New Jersey Property-Liability Insurance Guaranty Association id23097 View details | United States | Communication / Marketing | pending | ||
|
The New Jersey Property-Liability Insurance Guaranty Association provides essential claims services to claimants and policyholders affected by the insolvency of insurance companies. It operates as a safety net to protect individuals who find ... |
||||||
| Ransomware | SFG Technology Sdn Bhd id23096 View details | Malaysia | IT | pending | ||
|
SFG Technology specializes in high voltage and medium voltage electrical power systems, solar renewable energy, and smart grid solutions. Their product offerings include electrical network management systems, power factor capacitors, and test ... |
||||||
| Ransomware | WebCut Converting id23095 View details | United States | Communication / Marketing | pending | ||
|
WebCut Converting, Inc. specializes in contract slitting, laminating, and sheeting services tailored for the printing, converting, medical, and industrial markets. They process a variety of substrates including films, foams, non-wovens, and p ... |
||||||
| Ransomware | Kecy Metal Technologies id23094 View details | United States | Manufacturing / Engineering | pending | ||
|
Kecy Metal Technologies (formerly Kecy Corporation) was established in 1988 as a supplier of NVH components for Tier 1 Japanese transplants. Kecy has since doubled its capacity to 160,000 ft and consistently increased sales year over year. Ke ... |
||||||
| Ransomware | Volkswagen Group France id23093 View details | France | Manufacturing / Engineering | pending | ||
|
Volkswagen Group France, a subsidiary of Volkswagen AG, is a prominent player in the automotive industry committed to sustainable mobility. The company focuses on innovation and environmental responsibility through its six brands, addressing ... |
||||||
| Ransomware | Pro-Fab id23092 View details | Canada | Communication / Marketing | pending | ||
|
Pro Fab, Inc. specializes in custom design and fabrication products and services primarily for cleanrooms and industries such as semiconductor manufacturing, medical pharmaceutical labs, and American defense. They offer a wide range of produc ... |
||||||
| Ransomware | Canapés Mobilier Décoration id23090 View details | France | Other | pending | ||
|
L.LOFT offers a selection of customizable sofas and armchairs in leather, fabric, or microfiber: straight sofas, corner sofas, modular armchair combinations, relaxation sofas or armchairs, convertible sofas, occasional chairs, poufs, etc. Ava ... |
||||||
| Ransomware | Prim Saveurs Import Export id23089 View details | France | Communication / Marketing | pending | ||
|
PRIM'SAVEURS IMPORT EXPORT SARL was founded on January 22, 2008, 18 years ago. Its legal form is a limited liability company (without further indication). Its field of activity is: wholesale (business-to-business) of fruits and vegetables. In ... |
||||||
| Ransomware | Rihatec Systemlösungen id23088 View details | Germany | Construction / Real Estate | pending | ||
|
Rihatec specializes in the construction of control cabinets and automation solutions for machines and systems. Based in Munich, the company serves clients in the DACH region with a range of products, including standard and customizable contro ... |
||||||
| Ransomware | Executive Cabinetry id23087 View details | United States | Manufacturing / Engineering | pending | ||
|
Located in Simpsonville, South Carolina, Executive Cabinetry is an industry leader in semi-custom and custom cabinetry. The Executive Cabinetry facility encompasses 226,000 square feet of vertically integrated manufacturing space. Simply stat ... |
||||||
| Ransomware | Alu Perpignan id23086 View details | France | Communication / Marketing | pending | ||
|
ALU Perpignan specializes in PVC and aluminum joinery for individuals and professionals, working on both residential and commercial projects. Drawing on its expertise and know-how, the company offers a wide range of products, including window ... |
||||||
| Ransomware | Home/ Schramm Udo Dipl Kfm Steuerberater id23085 View details | Germany | Finance / Legal / Insurance | pending | ||
|
The Marcus Schramm Law Firm offers competent legal advice and an experienced team. We specialize in various areas of law and place the highest priority on quality and professionalism. The amount of downloaded data is unknown at the moment. I ... |
||||||
| Ransomware | Roger RENARD Entreprise id23084 View details | France | Communication / Marketing | pending | ||
|
A family business founded in 1951 in Amélie-les-Bains (66) by Roger RENARD, we specialize in air conditioning, heating, air handling, smoke extraction, plumbing, water treatment, and thermal process installations. We operate nationwide, bot ... |
||||||
| Ransomware | Hunter Construction Group id23083 View details | United States | Construction / Real Estate | pending | ||
|
With a relentless drive to exceed excellence, Jason and West Hunter III, have grown Hunter Construction Group exponentially from a small landscaping company to one of the most respected contractors in the industry. As an unlimited licensed ge ... |
||||||
| Ransomware | Urban Linker id23082 View details | France | Communication / Marketing | pending | ||
|
Urban Linker is a recruitment agency that specializes in sourcing and placing digital and tech professionals. Founded over eight years ago, the company has a strong presence in France with offices in Paris, Lyon, Toulouse, and Bordeaux, and i ... |
||||||
| Ransomware | Alqueria id23081 View details | Colombia | Communication / Marketing | pending | ||
|
Productos Naturales de la Sabana S.A.S., doing business as Alquería, is a Colombian company that produces food, especially dairy products and beverages. Founded between 1958 and 1959, it currently has 7 processing plants and 21 distribution ... |
||||||
| Ransomware | SICE id23080 View details | Spain | Construction / Real Estate | pending | ||
|
SICE is a leading multinational company in technology integration for public infrastructure management. With over 100 years of history, it has become an international benchmark in the areas of ITS, tunnels, transportation, mobility and smart ... |
||||||
| Ransomware | EURORDIS id23079 View details | France | Healthcare / Pharma | pending | ||
|
EURORDIS is an organization dedicated to advocating for, empowering, and engaging individuals affected by rare diseases across Europe. They provide information and support related to rare diseases, facilitate connections among patient organiz ... |
||||||
| Ransomware | PQCNC Hospitals id23078 View details | United States | Healthcare / Pharma | pending | ||
|
The Perinatal Quality Collaborative of North Carolina is a community-focused organization dedicated to improving maternal and infant health outcomes in the state. They offer various initiatives and resources aimed at enhancing the quality of ... |
||||||