Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2672 published victims and 5 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Qilin is tracked by Dark Eye as a ransomware group with 2672 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
2672
- Leaked 440 16.5%
- Pending 2222 83.2%
- Deleted 10 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 1h ago | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Down checked 1h ago | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
| Leak location 2 | Onion service | Down checked 1h ago | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
| Leak location 4 | Onion service | Down checked 1h ago | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 1 | Onion service | Down checked 1h ago | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
Top Activity Sectors (18)
- Not identified 512
- Services 310
- Communication / Marketing 276
- Manufacturing / Engineering 258
- Finance / Legal / Insurance 206
- IT 180
- Construction / Real Estate 173
- Healthcare / Pharma 147
- Retail / E-commerce 113
- Education 84
- Public Sector 79
- Transportation / Travel / Logistics 68
- Energy 57
- Hospitality / Food & Beverage / Tourism 51
- Agriculture / Food 46
- Telecommunications 34
- NGOs / Associations 28
- Sports 1
Typical Attacks (52)
▼How Qilin typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Qilin.
-
T1190 Exploit Public-Facing Application Initial Access
What they do: Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.
What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
-
T1566.001 Spearphishing Attachment Initial Access
What they do: Qilin has been delivered to victims through malicious email attachments.
What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
-
T1566.002 Spearphishing Link Initial Access
What they do: Qilin has been delivered via malicious links in spearphishing emails.
What that means: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
-
T1047 Windows Management Instrumentation Execution
What they do: Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
What they do: Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.
What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
-
T1059.001 PowerShell Execution
What they do: Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1059.003 Windows Command Shell Execution
What they do: Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1204.001 Malicious Link Execution
What they do: Qilin has been executed by luring victims into clicking links in spearphishing emails.
What that means: An adversary may rely upon a user clicking a malicious link in order to gain execution.
-
T1204.002 Malicious File Execution
What they do: Qilin has been delivered to victims through spearphishing emails with malicious attachments.
What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.
-
What they do: Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
What they do: Qilin can configure a Winlogon registry entry.
What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
-
What they do: Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.
What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.
-
What they do: Qilin can use an embedded Mimikatz module for token manipulation.
What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
-
What they do: Qilin has pushed a scheduled task via a Group Policy Object for payload execution.
What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
-
T1548.002 Bypass User Account Control Privilege Escalation
What they do: Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.
What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1036.004 Masquerade Task or Service Stealth
What they do: Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.
What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1070.004 File Deletion Stealth
What they do: Qilin can delete itself from infected hosts after execution.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1480 Execution Guardrails Stealth
What they do: Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1480.002 Mutual Exclusion Stealth
What they do: Qilin can create a mutex to ensure only one instance is running.
What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
-
T1678 Delay Execution Stealth
What they do: Qilin has the ability to delay execution.
What that means: Adversaries may employ various time-based methods to evade detection and analysis.
-
T1222 File and Directory Permissions Modification Defense Impairment
What they do: Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.
What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Qilin can terminate antivirus-related processes and services.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1685.005 Clear Windows Event Logs Defense Impairment
What they do: Qilin has the ability to clear Windows Event Logs.
What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
-
T1688 Safe Mode Boot Defense Impairment
What they do: Qilin can reboot targeted systems in safe mode to avoid detection.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1003.001 LSASS Memory Credential Access
What they do: Qilin can employ an embedded Mimikatz module to dump LSASS memory.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1007 System Service Discovery Discovery
What they do: Qilin can identify specific services for termination or to be left running at execution.
What that means: Adversaries may try to gather information about registered local system services.
-
T1012 Query Registry Discovery
What they do: Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.
What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
-
T1016 System Network Configuration Discovery Discovery
What they do: Qilin can accept a command line argument identifying specific IPs.
What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
-
T1018 Remote System Discovery Discovery
What they do: Qilin can enumerate domain-connected hosts during its discovery phase.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1057 Process Discovery Discovery
What they do: Qilin can define specific processes to be terminated or left alone at execution.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1069.002 Domain Groups Discovery
What they do: Qilin can run PowerShell cmdlets to discover domain groups.
What that means: Adversaries may attempt to find domain-level groups and permission settings.
-
T1082 System Information Discovery Discovery
What they do: Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: Qilin can exclude specific directories and files from encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1087.001 Local Account Discovery
What they do: Qilin can list all local users found on a targeted system.
What that means: Adversaries may attempt to get a listing of local system accounts.
-
T1087.002 Domain Account Discovery
What they do: Qilin can use PowerShell cmdlets to enumerate domain users.
What that means: Adversaries may attempt to get a listing of domain accounts.
-
T1135 Network Share Discovery Discovery
What they do: Qilin has the ability to list network drives.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1673 Virtual Machine Discovery Discovery
What they do: Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.
What that means: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.
-
T1680 Local Storage Discovery Discovery
What they do: Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1021.004 SSH Lateral Movement
What they do: Qilin can enable SSH access on ESXi hosts.
What that means: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).
-
T1570 Lateral Tool Transfer Lateral Movement
What they do: Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.
What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
-
T1071.002 File Transfer Protocols Command and Control
What they do: Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.
What that means: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
-
T1219.002 Remote Desktop Software Command and Control
What they do: Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.
What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
-
T1486 Data Encrypted for Impact Impact
What they do: Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Qilin can terminate specific services on compromised hosts.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
-
T1529 System Shutdown/Reboot Impact
What they do: Qilin can initiate a reboot of the backup server to hinder recovery.
What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Tools Observed (27)
▼Software Qilin has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
Mimikatz
Defense evasion
EDRSandBlast
PCHunter
PowerTool
Toshiba power management driver (BYOVD)
Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
YDArk
Zemana Anti-Rootkit driver
Discovery
Nmap
Nping
Discovery & enumeration
Nmap
Nping
Exfiltration
EasyUpload.io
EasyUpload
LOLBAS (living-off-the-land binaries)
fsutil
PsExec
WinRM
Networking & tunnelling
Proxychains
OffSec
Cobalt Strike
Evilginx
NetExec
Offensive security tooling
Cobalt Strike
Evilginx
NetExec
RMM Tools
ScreenConnect
Remote monitoring & management
NetSupport
ScreenConnect
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README-RECOVER-[rand]_2.txt
-- Qilin We have 3.4TB of your data stored on our servers. Contact us or we will publish this data on our blog, in the media and pass it on to the relevant authorities. We are ready to offer you a discount in case of payment within a week. Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: 2ir53sQQAU Domain: [snip] login: [snip] password:[snip]
README-RECOVER-[rand].txt
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: [snip] Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion login: [snip] password:[snip]
DtMXQFOCos-RECOVER-README.txt
-- Agenda
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
- Employees personal dataCVsDLSSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients databillsbudgetsannual reportsbank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials
-- Credentials
Extension: DtMXQFOCos
Domain: wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion
login: [snip]
password: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (2672)
Search, filter and paginate the victim timeline for Qilin. Showing 1701–1800 of 2672.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | UT Health Austin id23077 View details | United States | Healthcare / Pharma | pending | ||
|
UT Health Austin is the clinical practice of the Dell Medical School located in downtown Austin, offering personalized and comprehensive health care services. The organization provides a wide range of medical services including adult psychiat ... |
||||||
| Ransomware | ZEF's id23076 View details | Finland | Education | pending | ||
|
The Center for Development Research (ZEF) is an institute of the University of Bonn, Germany. It started its research activities in 1997. ZEF’s researchers aim to find science-based solutions to promote sustainable development and planetary ... |
||||||
| Ransomware | Paris Rétina Vision id23075 View details | France | Public Sector | pending | ||
|
The center features a state-of-the-art technical platform on two levels, allowing for the performance of most of your ophthalmological examinations (OCT, optical biometry, visual field, etc.). The center is also equipped with an operating ro ... |
||||||
| Ransomware | Buldi id23074 View details | France | Communication / Marketing | pending | ||
|
Buldi offers a platform for individuals looking to build or expand their homes by configuring their ideal project online. Users can receive up to six personalized proposals from qualified construction professionals in their region. The servic ... |
||||||
| Ransomware | City of Riviera Beach, Florida id23073 View details | United States | Public Sector | pending | ||
|
The City of Riviera Beach is committed to making its' website/social media accessible and user-friendly for everyone. If you are having difficulty viewing or navigating the content on our website, or notice any content, feature, or functional ... |
||||||
| Ransomware | Gittens Healthcare id23072 View details | Spain | Healthcare / Pharma | pending | ||
|
Gittens Healthcare is a leading pharmacy located in Grenada, offering a wide variety of products including vitamins, over-the-counter medications, health and beauty aids, baby care products, and household essentials. The company is committed ... |
||||||
| Ransomware | Trans-World Shipping Service id23071 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Trans-World Shipping Service, Inc. and Toledo Air Cargo, Inc. are full-service companies offering a wide variety of import and export services including US customs brokerage, international freight forwarding, air freight services, warehousing ... |
||||||
| Ransomware | Addis id23070 View details | Ethiopia | Public Sector | pending | ||
|
Addis, Louisiana, located in West Baton Rouge Parish, along the Mississippi River, situated on Louisiana Highway One, is located just minutes from Louisiana’s State Capitol City – Baton Rouge. The Town of Addis is a growing town, home to ... |
||||||
| Ransomware | Ditransa id23069 View details | Colombia | Transportation / Travel / Logistics | pending | ||
|
Ditransa specializes in logistics services aimed at optimizing every stage of the supply chain, from mass transport to last-mile delivery. With over 30 years of experience, the company has established itself as a leader in ground freight tran ... |
||||||
| Ransomware | LaRosa's id23068 View details | United States | Transportation / Travel / Logistics | pending | ||
|
LaRosa's, Inc. operates and franchises Italian restaurants and family pizzerias. The company offers pizzas and other Italian favorites for dine-in, delivery, and carrying out. It serves guests and neighborhoods throughout Greater Cincinnati, ... |
||||||
| Ransomware | McGeorge Architecture Interiors id23067 View details | United States | Construction / Real Estate | pending | ||
|
McGeorge Architecture Interiors (MAI) is a full service architecture and interior design firm specializing in corporate office, retail projects of all varying scopes and sizes, and single family residential properties. MAI was founded by Matt ... |
||||||
| Ransomware | Typology id23066 View details | France | Communication / Marketing | pending | ||
|
Typology offers natural vegan skincare products made in France, focusing on studying the right ingredients for each skin typology. Their skincare is naturally active, sustainable, and vegan. From face care to body and hair care, Typology prov ... |
||||||
| Ransomware | Sistema Odontológico Privado id23064 View details | Argentina | Communication / Marketing | pending | ||
|
Sistema Odontológico Privado Srl is a company that operates in the Dental Offices industry. It employs 50to99 people and has 10Mto25M of revenue. The company is headquartered in Cordoba, Cordoba Province, Argentina. The amount of downloaded ... |
||||||
| Ransomware | American Journal of Managed Care id23063 View details | United States | Communication / Marketing | pending | ||
|
Founded in 1995, The American Journal of Managed Care is a multimedia peer-reviewed, Medline-indexed journal that keeps industry leaders on the forefront of various different policies. This company is headquartered in Cranbury, New Jersey. T ... |
||||||
| Ransomware | Catawba County Government id23062 View details | United States | Public Sector | pending | ||
|
Catawba County, NC provides an online directory to services around the area including Human Resources, Libraries, Sheriff's Office and more. Created for Catawba County and located in North Carolina. |
||||||
| Ransomware | HMP Global id23061 View details | United States | Healthcare / Pharma | pending | ||
|
For 40 years, the company has built trusted brands including Psych Congress, the premier source for mental health education, and the Symposium on Advanced Wound Care (SAWC), the largest wound care meeting in the world. HMP Global partners wit ... |
||||||
| Ransomware | Morris-Sockle id23060 View details | United States | Communication / Marketing | pending | ||
|
Morris-Sockle, PLLC is a premier law firm specializing in Family Law and Divorce, with over 40 years of experience in protecting clients' rights during and after divorce. They offer a comprehensive range of services including divorce processe ... |
||||||
| Ransomware | Capitol Construction Services id23059 View details | United States | Construction / Real Estate | pending | ||
|
For over 25 years, Capitol Construction Services, Inc. has been one of the most professional general contractors in the Indianapolis market and has followed many clients all over the United States. CCSI has become experts in the areas of tena ... |
||||||
| Ransomware | Polar-studio id23058 View details | Sweden | Manufacturing / Engineering | pending | ||
|
In 1994, the company became a major energy company, marking the beginning of its rapid development in the electrical installation industry. A change of ownership in 2023 will undoubtedly ensure future growth and expansion. Our production fac ... |
||||||
| Ransomware | H. Gascon id23057 View details | France | Energy | pending | ||
|
Assisted by her colleagues, who are authorized to represent her during hearings and interviews at the firm or in companies, Maître Gascon successfully carries out the various tasks entrusted to her:Judicial mandates for safeguard proceedings ... |
||||||
| Ransomware | Clifford Paper id23053 View details | United States | Communication / Marketing | pending | ||
|
Clifford Paper is a family-owned business with a deep legacy in the forest products industry, operating since 1985. They specialize in providing paper products and value-added services, focusing on production management and packaging solution ... |
||||||
| Ransomware | MPM Imports id23052 View details | Cyprus | Communication / Marketing | pending | ||
|
MPM IMPORTS LTD is a family owned business which has been established in September 2013 as a spin off from the MPM GROUP of companies. MPM Imports specializes in importing and distributing a diverse range of products in Cyprus, including cos ... |
||||||
| Ransomware | Radiant Beauty Supplies id23051 View details | Canada | Communication / Marketing | pending | ||
|
Radiant Beauty Supplies is a Canadian owned and operated business which has been proudly serving the professional beauty industry since 1968. Focusing on the most sought after global brands, we carry only the finest products in the hair, esth ... |
||||||
| Ransomware | Tong Yang Group id23050 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
Tong Yang Group is a manufacturer of automotive plastics, sheet metal, and cooling products, as well as motorcycle plastics products, molds, and paints. The company was founded in 1952 and is headquartered in Tainan, Taiwan. |
||||||
| Ransomware | Club Lleuresport id23049 View details | Spain | Communication / Marketing | pending | ||
|
Club Lleuresport is a versatile organization based in Barcelona dedicated to leisure management, promoting culture, education, and sports for everyone. Since 1992, it has managed various public and private facilities, including civic centers ... |
||||||
| Ransomware | Repeated Signal Solutions id23048 View details | Sweden | Services | pending | ||
|
Repeated Signal Solutions (RSS) specializes in Cellular, Public Safety, and Wireless Coverage Solutions, offering a wide range of services including engineering, construction management, and managed services since 2004. Their expertise spans ... |
||||||
| Ransomware | Atarfil id23047 View details | Spain | Services | pending | ||
|
Atarfil Sl is a company that operates in the Repair Services industry. It employs 50to99 people and has 10Mto25M of revenue. The company is headquartered in Atarfe, Andalusia, Spain |
||||||
| Ransomware | Greenstar Social Marketing id23046 View details | Pakistan | Communication / Marketing | pending | ||
|
Greenstar Social Marketing Pakistan (G) Limited is dedicated to improving health outcomes in Pakistan through various initiatives, including social marketing, social franchising, and health systems strengthening. Their services focus on mater ... |
||||||
| Ransomware | DuVal & Associates id23045 View details | United States | Finance / Legal / Insurance | pending | ||
|
DuVal & Associates specializes in FDA law, assisting clients in navigating complex regulatory requirements for medical devices, drugs, and food products. Their services include advocacy, regulatory support, compliance guidance, and on-site tr ... |
||||||
| Ransomware | Pratt Homes id23044 View details | Canada | Communication / Marketing | pending | ||
|
Pratt Homes was founded in 1973 by Len and Lowell, who, along with their partner Uncle Doug, built their first official Pratt Home in Scandia. They faced student loans but were driven by a passion for quality craftsmanship. Their commitment t ... |
||||||
| Ransomware | Force Marketing id23043 View details | United States | Communication / Marketing | pending | ||
|
Force Marketing, USA - Founded in 2006, Force Marketing is a leading marketing technology provider to the automotive industry, whose Helix Technologies, WeDrive Automotive and DRIVE video technology brands deliver combined synergies to optimi ... |
||||||
| Ransomware | DV Hardwoods id23042 View details | Canada | Agriculture / Food | pending | ||
|
DV Hardwoods, Canada - an undisputed leader in the hardwood lumber sector. In short, the company destroys forests in the country and sells them abroad – to the US and other countries. The company harvests traditional Canadian maple, birch, ... |
||||||
| Ransomware | M&E Global Group id23039 View details | United States | Manufacturing / Engineering | pending | ||
|
M&E Global Group, Inc. USA - specializes in point of purchase display and store fixture manufacturing, offering comprehensive services from design to production and fulfillment. Another part of this business is the production of parts such a ... |
||||||
| Ransomware | Karnes Electric Cooperative id23022 View details | United States | Energy | pending | ||
|
Karnes Electric Cooperative, USA is a not-for-profit electric distribution utility that serves 12 counties in South Texas and the Coastal Bend region. Headquartered in Karnes City, Texas, it offers competitive rates and innovative solutions t ... |
||||||
| Ransomware | Bank3 id23020 View details | — | Finance / Legal / Insurance | pending | ||
|
Bank3, USA - it's a disaster for the clients. Bank3 is a community-driven banking institution offering personal and business banking services, as well as mortgage lending. The bank serves clients in various locations including Memphis, Nashvi ... |
||||||
| Ransomware | San Bernard Electric Cooperative id23019 View details | United States | Services | pending | ||
|
San Bernard Electric Cooperative, USA - offers a range of services including outage reporting, generator installation, and energy efficiency programs. Its intended clients are members of the community who utilize electric services, as well as ... |
||||||
| Ransomware | BHI Co., Ltd. id23018 View details | Korea, Republic of | Energy | pending | ||
|
BHI Co., Ltd. engages in the manufacturing and supplying of power plant equipment worldwide. It offers pulverized coal fired boilers, heat recovery steam generators, circulating fluidized bed combustion boilers, oil and gas boilers, industria ... |
||||||
| Ransomware | SourceOne Corporation id23015 View details | United States | Communication / Marketing | pending | ||
|
SourceOne Corporation, USA - specializes in managing all phases of Outside Plant (OSP) and Inside Plant (ISP) projects, offering comprehensive solutions including fiber design, permitting, construction, and final inspection. The company provi ... |
||||||
| Ransomware | hautsdefrance.fr id23014 View details | France | Education | pending | ||
|
The Regional Council manages regional programs (economy, transport, education, vocational training, culture/sports, ecology). 1.passports 2.Personal data 3.School incident report |
||||||
| Ransomware | Imperial Glazing Concepts id35613 View details | United States | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | Frisquet id22993 View details | France | Energy | pending | ||
|
Frisquet, France - is a manufacturer specializing in gas boilers and renewable energy solutions, offering a range of products including heat pumps, hot water tanks, and hybrid systems. Their offerings are aimed at both residential and collect ... |
||||||
| Ransomware | Dynamic Precision Sverige id22992 View details | Sweden | Communication / Marketing | pending | ||
|
Dynamic Precision Sverige, Norway - is a company that operates in the Electronics industry. The company designs and builds complex microelectronics, starting from an idea, through prototyping and production line development to a mass producti ... |
||||||
| Ransomware | Valtorta id22988 View details | Italy | Manufacturing / Engineering | pending | ||
|
Valtorta, Italy - develops and manufactures industrial cranes. Valtorta is the natural evolution of TRASMEC srl that has been especially operating in the sector of the bridge cranes since 1969. Its highly skilled staff includes a lot of tech ... |
||||||
| Ransomware | Team Schierl Companies id22986 View details | United States | Construction / Real Estate | pending | ||
|
Team Schierl Companies is an organization of retail businesses and real estate development. TSC was founded in 1956 and is currently headquartered in Stevens Point, Wisconsin. Today, the family owned and operated Team Schierl Companies passed ... |
||||||
| Ransomware | Artan Holding id22947 View details | Qatar | Construction / Real Estate | pending | ||
|
Artan Holding is a Qatari family-owned holding company with a diverse portfolio of leading businesses in the Education, Real Estate, and Industrial sectors operating primarily in Qatar. Since its founding more than 25 years ago Artan Holding ... |
||||||
| Ransomware | grupocaparros.com id22946 View details | Spain | Agriculture / Food | pending | ||
|
Caparrós, Spain - One of the leading companies at the national level for the sale of agricultural products abroad. The company sells local products: tomatoes, peppers, cucumbers, eggplants, zucchini and watermelons. The main sales market is ... |
||||||
| Ransomware | www.ucisd.net id22924 View details | United States | Education | pending | ||
|
Uvalde Consolidated Independent School District, USA - is a public school district based in Uvalde, Texas, US. Located in Uvalde County, the district extends into portions of Zavala and Real counties. It is a progressive, rural school distri ... |
||||||
| Ransomware | Midsun Group id22920 View details | United States | Communication / Marketing | pending | ||
|
Midsun Group, USA specializes in extending the life of power utility equipment through premium silicone covers and coatings. Their innovative products provide solutions for wildlife intrusion and environmental contamination, enhancing reliabi ... |
||||||
| Ransomware | MBS Secure id22916 View details | United States | IT | pending | ||
|
MBS Secure, Ntiva - Ignore your teeth and they'll go away. The same goes for customers. If you leak their confidential data online, they'll leave. That's what happened to MBS Secure, a cybersecurity company. It has many customers, including i ... |
||||||
| Ransomware | ePayData id35727 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | cameronhodges.com id22904 View details | United States | Finance / Legal / Insurance | pending | ||
|
Cameron, Hodges, Coleman, LaPointe & Wright, USA - No matter where you are in Florida, we are here to leak your data. law firm specializing in insurance defense with over 35 years of experience. They provide legal services to clients across F ... |
||||||
| Ransomware | Spectra Logic+DATA id22886 View details | United States | Communication / Marketing | pending | ||
|
ALL THE DATE IS AVAILABLE FOR DOWNLOAD Spectra Logic, USA - data protection and storage company LMAOOOAHHAHA I'm dead!!! Sorry, but this is really really funny. PROTECTION! STORAGE! DATA!!!! On our blog, yes. So, Spectra Logic helps organiz ... |
||||||
| Ransomware | www.datamaxx.com id35728 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | www.auto-bernhard.at id22864 View details | Austria | Retail / E-commerce | pending | ||
|
Autohaus Bernhard, Germany - The naked truth about “reliable” European cars. The company sells, services, and rents well-known European cars such as Citroën and Opel. The company owns its own dealerships, auto repair shops, and a 2,200 m ... |
||||||
| Ransomware | BCR Recouvrement id22863 View details | France | Services | pending | ||
|
BCR Recouvrement, located at 129 Rue Servient in Lyon, France, is a company specializing in debt recovery and credit management services. Their mission is to help businesses recover unpaid debts from clients, ensuring that companies can maint ... |
||||||
| Ransomware | California Golf Club of San Francisco id22862 View details | United States | Communication / Marketing | pending | ||
|
California Golf Club of San Francisco, commonly known as Cal Club, is a private golf club established in 1918, originally located in Ingleside before moving to its current 425-acre site in 1924. The club features a world-class golf course des ... |
||||||
| Ransomware | Asahi Group Holdings, Ltd. id22860 View details | Japan | Hospitality / Food & Beverage / Tourism | pending | ||
|
Asahi Group Holdings, Japan - a leading manufacturer of beer and non-alcoholic beverages in Japan. Asahi is headquartered in Sumida, Tokyo. It ranked 593rd on the Forbes Global 2000 list of the world's largest companies in 2023. The company's ... |
||||||
| Ransomware | Massachusetts Bay Community College id22859 View details | United States | Education | pending | ||
|
Massachusetts Bay Community College is a comprehensive, open-access community college, offering associate degrees and certificate programs. We gave MassBay every opportunity to prevent this publication. We engaged their leadership. Their re ... |
||||||
| Ransomware | Property Tax Consultants id35729 View details | United States | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Clifford Paper Inc id22850 View details | United States | Communication / Marketing | pending | ||
|
Clifford Paper Inc, USA - is a family-owned business with a deep legacy in the forest products industry, operating since 1985. They specialize in providing paper products and value-added services. Clifford Paper maintains strong relationships ... |
||||||
| Ransomware | kanzlei-schramm.com id22845 View details | Germany | Finance / Legal / Insurance | pending | ||
|
Markus Schramm, Rechtsanwalt und Steuerberater, Germany - A lawyer you shouldn't trust with your secrets. As you might guess, its founder, Markus Schramm, is not one for false modesty. He wants his name to be remembered. Well, he has achieved ... |
||||||
| Ransomware | Development Services Group, Inc. id22843 View details | United States | IT | pending | ||
|
Development Services Group, Inc., USA - The most high-profile terrorist attacks and crimes against the public that are being planned. All of this is contained in the reports of Development Services Group, Inc. You have to admit, it's interes ... |
||||||
| Ransomware | www.landmarkmgtinc.com id22842 View details | United States | Construction / Real Estate | pending | ||
|
Landmark Management, Inc., manages 90 projects, consisting of 2,462 units across 5 states. Whether you are searching for an apartment to rent or a reliable company to manage your rural development property, let us put our thirty-six years of ... |
||||||
| Ransomware | ville-saintclaude.fr id22841 View details | France | Public Sector | pending | ||
|
Mairie de Saint-Claude, France - life on a volcano. Saint-Claude is a commune in the Jura department, in the Burgundy-Franche-Comté region. It is the administrative center of the arrondissement of Saint-Claude and the canton of Saint-Claude. ... |
||||||
| Ransomware | Mecklenburg County Public Schools id22837 View details | United States | Public Sector | pending | ||
|
Charlotte-Mecklenburg School District, USA - Do you keep your children's secrets? They are the most precious thing you have. They must not be betrayed. And that is exactly what the Charlotte-Mecklenburg School District (CMS) specializes in. T ... |
||||||
| Ransomware | mcgeorgeai.com id22836 View details | United States | Construction / Real Estate | pending | ||
|
McGeorge Architecture Interiors (MAI), USA - свободный доступ в любой дом. MAI is a full service architecture and interior design firm specializing in corporate office, retail projects of all varying scopes and sizes, ... |
||||||
| Ransomware | kecymetals.com id22835 View details | United States | Manufacturing / Engineering | pending | ||
|
Kecy Metal Technologies, USA - Terrible management, outdated equipment, uncompetitive salaries. This is how employees describe working conditions at Kecy Metal Technologies on condition of anonymity. The company was founded in 1988 in Michiga ... |
||||||
| Ransomware | Lipapromet id22834 View details | Croatia | Communication / Marketing | pending | ||
|
Lipapromet, Croatia - is there light at the end of the tunnel? This Croatian company was founded in Zagreb in 1990. It specializes in LED lighting solutions. According to financial reports, Lipapromet's annual revenue in 2024 was €31,728,95 ... |
||||||
| Ransomware | Uvalde Consolidated Independent School District id35730 View details | United States | Education | leaked | ||
|
Back Uvalde Consolidated Independent School District |
||||||
| Ransomware | bms.bsd-ri.net id35731 View details | Brazil | IT | pending | ||
|
N/A |
||||||
| Ransomware | Rihatec.de id22811 View details | Germany | Communication / Marketing | pending | ||
|
Rihatec Systemlösungen, Germany - Automation of control systems, innovative solutions, cooperation with large corporations. Sounds impressive, doesn't it? However, there is one caveat. Rihatec Systemlösungen GmbH was founded in 1995 near Mu ... |
||||||
| Ransomware | uhlcompany.com id22810 View details | United States | Construction / Real Estate | pending | ||
|
Imagine that the building where you live or work has gone haywire. You can't turn the lights on or off, the heating and air conditioning systems are out of order, and the video cameras have stopped focusing on the right areas. Do you think th ... |
||||||
| Ransomware | AIP Asset Management id22808 View details | Canada | Services | leaked | ||
|
AIP Asset Management, KoreanLeak3 - is a global financial error. A company with a market-leading specialization in alternative investment strategies. AIP provides institutional and retail clients with access to customized investments that gi ... |
||||||
| Ransomware | Corban OneSource id22794 View details | United States | Services | pending | ||
|
Corban OneSource, USA - maximize risks to compliance. Company provides comprehensive HR outsourcing services, including payroll administration, employee benefits management, and HR support, aimed at reducing risks and improving organizational ... |
||||||
| Ransomware | IONODES id22793 View details | Canada | Communication / Marketing | pending | ||
|
IONODES, Canada - Privacy? No, we don't know about that. The company supplies and configures solutions for IP video storage, management, and display. Its products include smart devices such as IP video encoders and decoders, NVR servers, reco ... |
||||||
| Ransomware | Uhl id35732 View details | Germany | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | sagchip.org id22734 View details | United States | Retail / E-commerce | pending | ||
|
the Saginaw Chippewa Indian Tribe of Michigan, USA - It's impossible to keep a poker face now. This small community of about 3,000 people is located in Isabella County, near Mount Pleasant. The tribe owns gas stations, a water park, a hotel, ... |
||||||
| Ransomware | Mitchell Industries id22733 View details | United States | Energy | pending | ||
|
Mitchell Industries, USA - like sand through one's fingers. The company manufactures Accu-Weld¢ wedge wire screens for applications in both the petroleum and refining industries. The family-owned company has been in business for many years a ... |
||||||
| Ransomware | Shamir Medical Center id22728 View details | Israel | Healthcare / Pharma | pending | ||
|
We have successfully infiltrated and gained full access to your systems at Shamir Hospital, the largest medical facility in Israel. Over the course of our operation, we have exfiltrated approximately 8 terabytes of sensitive and confidential ... |
||||||
| Ransomware | Corporate Services id35627 View details | Germany | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Saginaw Chippewa Indian Tribe id35628 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Cooptech.hu id35629 View details | Hungary | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Mitrani Rynor Adamsky & Toland id22705 View details | United States | Other | pending | ||
|
The company has failed to contact us. Full file directory: http://securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion/data/12/ -- Files of interest -- Trial list including discovery and perso ... |
||||||
| Ransomware | pratthomes.com id35626 View details | United States | Retail / E-commerce | leaked | ||
|
N/A |
||||||
| Ransomware | Foremost Asset Management id22680 View details | United States | Services | pending | ||
|
Foremost Asset Management, KoreanLeak3 - First and foremost, they forgot the rules of survival in the market. Company was established in 2021 in Seoul, South Korea. Young businessman Kim Yong-chol was confident that he could manage investment ... |
||||||
| Ransomware | Rectory School id22678 View details | United States | Education | pending | ||
|
Rectory School, USA - What began as a charitable educational project has, turned into a money-making machine for children. The school, founded by Reverend Frank H. Bigelow in 1920, is now far removed from its philanthropic ideals. Sending you ... |
||||||
| Ransomware | TRAUM Investment Co. id22677 View details | China | Finance / Legal / Insurance | pending | ||
|
TRAUM Investment Co., KoreanLeak3 - We confirm your fears. TRAUM Investment, a major player in the country's stock market, appeared in 2016. The company now has capital of 3.8 billion won ($2.7 million) and an investment portfolio of 119.8 bi ... |
||||||
| Ransomware | Petraville Asset Management id22676 View details | Hong Kong | Services | pending | ||
|
Petraville Asset Management, KoreanLeak3 - a direct path to investment loss. Company was founded in Seoul, Korea, in 2022. The company is young but growing rapidly. Last year, they acquired a logistics center in Ichon (Gyeonggi Province). The ... |
||||||
| Ransomware | Mobidic Asset Management id22658 View details | Korea, Republic of | Services | pending | ||
|
Mobidic Asset Management Co., KoreanLeak3 - another failure. The company has been operating on the country's stock market since 2021 (EX-DK Investment Korea) and currently has capital of 6 billion won ($4.2 million). The company operates as a ... |
||||||
| Ransomware | Vienneau Insurance id35624 View details | Canada | Public Sector | leaked | ||
|
N/A |
||||||
| Ransomware | Auto Bernhard id35625 View details | Austria | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | Pangea Travel Store id22654 View details | Spain | Retail / E-commerce | pending | ||
|
PANGEA The Travel Store is a boutique travel agency that designs bespoke, full-service trips tailored to individual tastes. It blends an online platform with physical flagship stores so customers can get face-to-face consultations as well as ... |
||||||
| Ransomware | lakehaven.org id22636 View details | United States | Communication / Marketing | pending | ||
|
Lakehaven Water District provides essential water and sewer services to residents of South King County, Washington. 1.The document dated January 3, 2025, is a report on GL Distribution for the pay period December 16–31, 2024 (payment on Ja ... |
||||||
| Ransomware | heparks.org id22632 View details | United States | Communication / Marketing | pending | ||
|
The Hoffman Estates Park District strives to provide the local community with exceptional recreational programs, well-maintained parks, and high-quality facilities. Their offerings include a variety of programs for youth, adults, and seniors, ... |
||||||
| Ransomware | PTR Asset Management id22617 View details | Hong Kong | Services | pending | ||
|
PTR Asset Management, KoreanLeak3 - A shell company that jumps from bed to bed. Meet PTR Asset Management. An investment company from South Korea. As they state on their official website, PTR Asset Management engages in value investing, ident ... |
||||||
| Ransomware | Yooshin Engineering Corporation id22606 View details | Korea, Republic of | Manufacturing / Engineering | pending | ||
|
Yooshin Engineering Corporation provides engineering consulting services in South Korea and internationally. It offers various services, including feasibility study, basic and detailed design, construction project management, and post-complet ... |
||||||
| Ransomware | carypeds.com id35623 View details | New Caledonia | Healthcare / Pharma | leaked | ||
|
N/A |
||||||
| Ransomware | thomasmhughes.com id22602 View details | United States | Finance / Legal / Insurance | pending | ||
|
Thomas M. Hughes, Ltd. USA - Calculation error. Company specializes in providing experienced legal counsel focused on employee benefits, ERISA, tax, and pension law. With over 30 years of expertise, they offer clear, practical solutions tailo ... |
||||||
| Ransomware | Thomas M Hughes id35622 View details | United Kingdom | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Podo Asset Management id22590 View details | Korea, Republic of | Services | pending | ||
|
Podo Asset Management, KoreanLeak3 - Don't bite off more than you can chew. Not everyone follows this simple rule. A clear example is Podo Asset Management. It was founded in 2018. It specializes in direct investments and IPOs. Podo Asset Ma ... |
||||||