Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2672 published victims and 5 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Qilin is tracked by Dark Eye as a ransomware group with 2672 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
2672
- Leaked 440 16.5%
- Pending 2222 83.2%
- Deleted 10 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 32m ago | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Down checked 31m ago | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
| Leak location 2 | Onion service | Down checked 32m ago | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
| Leak location 4 | Onion service | Down checked 32m ago | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 1 | Onion service | Down checked 32m ago | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
Top Activity Sectors (18)
- Not identified 512
- Services 310
- Communication / Marketing 276
- Manufacturing / Engineering 258
- Finance / Legal / Insurance 206
- IT 180
- Construction / Real Estate 173
- Healthcare / Pharma 147
- Retail / E-commerce 113
- Education 84
- Public Sector 79
- Transportation / Travel / Logistics 68
- Energy 57
- Hospitality / Food & Beverage / Tourism 51
- Agriculture / Food 46
- Telecommunications 34
- NGOs / Associations 28
- Sports 1
Typical Attacks (52)
▼How Qilin typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Qilin.
-
T1190 Exploit Public-Facing Application Initial Access
What they do: Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.
What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
-
T1566.001 Spearphishing Attachment Initial Access
What they do: Qilin has been delivered to victims through malicious email attachments.
What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
-
T1566.002 Spearphishing Link Initial Access
What they do: Qilin has been delivered via malicious links in spearphishing emails.
What that means: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
-
T1047 Windows Management Instrumentation Execution
What they do: Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
What they do: Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.
What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
-
T1059.001 PowerShell Execution
What they do: Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1059.003 Windows Command Shell Execution
What they do: Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1204.001 Malicious Link Execution
What they do: Qilin has been executed by luring victims into clicking links in spearphishing emails.
What that means: An adversary may rely upon a user clicking a malicious link in order to gain execution.
-
T1204.002 Malicious File Execution
What they do: Qilin has been delivered to victims through spearphishing emails with malicious attachments.
What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.
-
What they do: Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
What they do: Qilin can configure a Winlogon registry entry.
What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
-
What they do: Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.
What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.
-
What they do: Qilin can use an embedded Mimikatz module for token manipulation.
What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
-
What they do: Qilin has pushed a scheduled task via a Group Policy Object for payload execution.
What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
-
T1548.002 Bypass User Account Control Privilege Escalation
What they do: Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.
What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1036.004 Masquerade Task or Service Stealth
What they do: Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.
What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1070.004 File Deletion Stealth
What they do: Qilin can delete itself from infected hosts after execution.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1480 Execution Guardrails Stealth
What they do: Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1480.002 Mutual Exclusion Stealth
What they do: Qilin can create a mutex to ensure only one instance is running.
What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
-
T1678 Delay Execution Stealth
What they do: Qilin has the ability to delay execution.
What that means: Adversaries may employ various time-based methods to evade detection and analysis.
-
T1222 File and Directory Permissions Modification Defense Impairment
What they do: Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.
What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Qilin can terminate antivirus-related processes and services.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1685.005 Clear Windows Event Logs Defense Impairment
What they do: Qilin has the ability to clear Windows Event Logs.
What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
-
T1688 Safe Mode Boot Defense Impairment
What they do: Qilin can reboot targeted systems in safe mode to avoid detection.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1003.001 LSASS Memory Credential Access
What they do: Qilin can employ an embedded Mimikatz module to dump LSASS memory.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1007 System Service Discovery Discovery
What they do: Qilin can identify specific services for termination or to be left running at execution.
What that means: Adversaries may try to gather information about registered local system services.
-
T1012 Query Registry Discovery
What they do: Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.
What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
-
T1016 System Network Configuration Discovery Discovery
What they do: Qilin can accept a command line argument identifying specific IPs.
What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
-
T1018 Remote System Discovery Discovery
What they do: Qilin can enumerate domain-connected hosts during its discovery phase.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1057 Process Discovery Discovery
What they do: Qilin can define specific processes to be terminated or left alone at execution.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1069.002 Domain Groups Discovery
What they do: Qilin can run PowerShell cmdlets to discover domain groups.
What that means: Adversaries may attempt to find domain-level groups and permission settings.
-
T1082 System Information Discovery Discovery
What they do: Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: Qilin can exclude specific directories and files from encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1087.001 Local Account Discovery
What they do: Qilin can list all local users found on a targeted system.
What that means: Adversaries may attempt to get a listing of local system accounts.
-
T1087.002 Domain Account Discovery
What they do: Qilin can use PowerShell cmdlets to enumerate domain users.
What that means: Adversaries may attempt to get a listing of domain accounts.
-
T1135 Network Share Discovery Discovery
What they do: Qilin has the ability to list network drives.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1673 Virtual Machine Discovery Discovery
What they do: Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.
What that means: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.
-
T1680 Local Storage Discovery Discovery
What they do: Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1021.004 SSH Lateral Movement
What they do: Qilin can enable SSH access on ESXi hosts.
What that means: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).
-
T1570 Lateral Tool Transfer Lateral Movement
What they do: Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.
What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
-
T1071.002 File Transfer Protocols Command and Control
What they do: Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.
What that means: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
-
T1219.002 Remote Desktop Software Command and Control
What they do: Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.
What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
-
T1486 Data Encrypted for Impact Impact
What they do: Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Qilin can terminate specific services on compromised hosts.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
-
T1529 System Shutdown/Reboot Impact
What they do: Qilin can initiate a reboot of the backup server to hinder recovery.
What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Tools Observed (27)
▼Software Qilin has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
Mimikatz
Defense evasion
EDRSandBlast
PCHunter
PowerTool
Toshiba power management driver (BYOVD)
Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
YDArk
Zemana Anti-Rootkit driver
Discovery
Nmap
Nping
Discovery & enumeration
Nmap
Nping
Exfiltration
EasyUpload.io
EasyUpload
LOLBAS (living-off-the-land binaries)
fsutil
PsExec
WinRM
Networking & tunnelling
Proxychains
OffSec
Cobalt Strike
Evilginx
NetExec
Offensive security tooling
Cobalt Strike
Evilginx
NetExec
RMM Tools
ScreenConnect
Remote monitoring & management
NetSupport
ScreenConnect
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README-RECOVER-[rand]_2.txt
-- Qilin We have 3.4TB of your data stored on our servers. Contact us or we will publish this data on our blog, in the media and pass it on to the relevant authorities. We are ready to offer you a discount in case of payment within a week. Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: 2ir53sQQAU Domain: [snip] login: [snip] password:[snip]
README-RECOVER-[rand].txt
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: [snip] Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion login: [snip] password:[snip]
DtMXQFOCos-RECOVER-README.txt
-- Agenda
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
- Employees personal dataCVsDLSSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients databillsbudgetsannual reportsbank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials
-- Credentials
Extension: DtMXQFOCos
Domain: wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion
login: [snip]
password: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (2672)
Search, filter and paginate the victim timeline for Qilin. Showing 2001–2100 of 2672.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | camdon.ca id21613 View details | Canada | Construction / Real Estate | pending | ||
|
Camdon Construction is a Red Deer-based construction and commercial company specializing in project management services throughout Alberta.The company offers design-build services, including concept development, site planning, and 3D visualiz ... |
||||||
| Ransomware | lodipd.org id21612 View details | United States | Communication / Marketing | pending | ||
|
The primary duty of the Lodi Police Department is to serve humanity, protect life and property, defend the innocent from fraud, the weak from oppression or intimidation, and the peaceful from violence or disorder, and to respect the constitut ... |
||||||
| Ransomware | csrepair.com id21611 View details | United States | Communication / Marketing | pending | ||
|
CS Truck & Trailer is a comprehensive fleet service provider specializing in mobile repairs, preventive maintenance, and complex diagnostics for trucks and trailers. 1.The document is a notarized affidavit from Mason Jones confirming the acc ... |
||||||
| Ransomware | studebakersubmetering.com id21610 View details | United States | Education | pending | ||
|
The Belle Vernon Area School District (BVASD) is a medium-sized public school district located approximately 40 minutes southeast of Pittsburgh in Westmoreland and Fayette counties, Pennsylvania. Formed in 1965 through the merger of the Belma ... |
||||||
| Ransomware | sotaconstruction.com id21609 View details | United States | Construction / Real Estate | pending | ||
|
Sota Construction Services is a leading provider of comprehensive and cost-effective construction services specializing in commercial and residential construction. The company emphasizes environmentally friendly construction methods and has b ... |
||||||
| Ransomware | azurewave.com id21600 View details | Taiwan, Province of China | Communication / Marketing | pending | ||
|
AzureWave Technologies is a worldwide leading provider of wireless connectivity and image processing solutions. Our products lines include Bluetooth, Wi-Fi, 3G, GPS, DTV and Digital Camera modules, which could be extensively applied in person ... |
||||||
| Ransomware | Lawrence Paper id35607 View details | United States | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Lodi Police Department id35608 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | CS Repair Services id35609 View details | United States | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Studebaker Submetering id35610 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Kengen id21584 View details | Kenya | Public Sector | pending | ||
|
Kenya Electricity Generating Company abbreviated to KenGen, is a government enterprise in the Republic of Kenya charged with the production of electricity for the country and around East Africa. KenGen is the largest electric power producer ... |
||||||
| Ransomware | ferrocortes id21583 View details | Colombia | Manufacturing / Engineering | pending | ||
|
Ferrocortes S.A.S is a leader in high-quality steel solutions for heavy machinery and hardware from Colombia. The company provides customized steel products such as sheets and profiles, catering to various industrial sectors including mining, ... |
||||||
| Ransomware | Moniz Silva international id35595 View details | Angola | Other | leaked | ||
|
N/A |
||||||
| Ransomware | Tape Ruvicha id35606 View details | Peru | Services | leaked | ||
|
N/A |
||||||
| Ransomware | alpresor.se id21525 View details | Sweden | Communication / Marketing | pending | ||
|
Have you traveled to the Alps? Your personal data is in this archive. The full archive of STS Alpresor company is publicly available. The largest tour operator in the Nordic region, operating in Sweden, Norway and Finland. The company has bee ... |
||||||
| Ransomware | easternadjustment.com id21520 View details | United States | Communication / Marketing | pending | ||
|
Eastern Adjustment Company, Inc., is a locally owned Independent Adjusting firm designed to assist insurers primarily in the adjustment of losses and claims in fire, allied lines, marine and casualty. We specialize in personal and commercial ... |
||||||
| Ransomware | Bricotech id35594 View details | France | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | Aggressive Air Compressor & co id21511 View details | United States | Communication / Marketing | pending | ||
|
We have full control of your systems, including: ✅ All invoices ✅ Customer databases (names, addresses, contact details) ✅ Scanned documents (IDs, driver’s licenses, confidential files) ✅ Financial records & other sensitive data ... |
||||||
| Ransomware | cadex.com id21491 View details | Canada | Manufacturing / Engineering | pending | ||
|
Cadex Electronics specializes in the design and manufacturing of diagnostic chargers, battery analyzers, and rapid testers aimed at optimizing battery performance and longevity. Their products serve a variety of sectors including military, me ... |
||||||
| Ransomware | envac.es id21490 View details | Spain | Hospitality / Food & Beverage / Tourism | pending | ||
|
Envac Iberia SA is a company that operates in the Waste Treatment, Environmental Services & Recycling industry. It employs 20to49 people and has 5Mto10M of revenue. The company is headquartered in Barcelona, Catalonia, Spain. |
||||||
| Ransomware | fortsmithschools.org id21489 View details | United States | Education | pending | ||
|
The Fort Smith Public School district is a destination district built on relationships, collaboration, and a culture of excellence. With over 2,000 employees, FSPS is one of the largest employers in Fort Smith, Arkansas. Our qualified educato ... |
||||||
| Ransomware | www.afmco.jo id21455 View details | Jordan | Public Sector | pending | ||
|
ABOUT THE AQABA SPECIAL ECONOMIC ZONE AUTHORITY (ASEZA) The Aqaba Special Economic Zone Authority plays a leading role at the administrative and governmental level in the Hashemite Kingdom of Jordan and applies the principle of good governanc ... |
||||||
| Ransomware | PDC www.cobranzasbeta.com.co id21451 View details | Colombia | Finance / Legal / Insurance | pending | ||
|
Promociones y Cobranzas Beta was created in 1987 as a collection unit of the then Banco Superior, which was acquired by Davivienda in 2006. Since then, it has established itself as the subsidiary specialized in the collection and financial a ... |
||||||
| Ransomware | tissot.com id21419 View details | Switzerland | Manufacturing / Engineering | pending | ||
|
TISSOT Industrie is an internationally recognized French company, expert in heavy boilermaking and in the realization of tailor-made industrial projects. Since 1942, the TISSOT company has studied, manufactured, transported and assembl ... |
||||||
| Ransomware | Custom Food Ingredients id21418 View details | Malaysia | Agriculture / Food | pending | ||
|
Custom Food Group specializes in providing tailored food solutions for a diverse range of clients. With a focus on customization, they offer a variety of food products designed to meet the unique needs of businesses in the food service and re ... |
||||||
| Ransomware | www.barobinson.com id21401 View details | Canada | Hospitality / Food & Beverage / Tourism | pending | ||
|
Founded in 1936 and headquartered in Winnipeg, Manitoba, B. A. Robinson Co. Ltd. is a fully diversified distributor of plumbing, lighting and electrical products. B. A. Robinson distributes to the construction industry and retail home improve ... |
||||||
| Ransomware | Yapi Teknik Proje id21400 View details | Türkiye | Communication / Marketing | pending | ||
|
Yapı Teknik was established in Istanbul in 1988 to operate in the static design & project planning and implementation of reinforced concrete, steel and timber structures in all national and international fields. Yapı Teknik, with its qua ... |
||||||
| Ransomware | Astro Industries Inc. id21365 View details | United States | Manufacturing / Engineering | leaked | ||
|
Astro Industries, Inc. is engaged in the manufacturing and distribution of Military and Commercial wire, cable, cable assemblies, shrink tubing, and value-added products and services. We also stock a variety of military and commercial knobs, ... |
||||||
| Ransomware | morgan911.org id21354 View details | United States | Public Sector | pending | ||
|
Morgan County 911 provides emergency and non-emergency call dispatching services for the residents of Morgan County, Alabama. The organization is dedicated to ensuring public safety and operates a countywide radio system as well as an ambulan ... |
||||||
| Ransomware | foiegrasespinet id21353 View details | France | Hospitality / Food & Beverage / Tourism | pending | ||
|
Maison Espinet specializes in traditional foie gras products, offering a variety of options including fresh, frozen, semi-cooked, and canned goods. Their offerings cater particularly to caterers and the restaurant industry, with a specific fo ... |
||||||
| Ransomware | BALNEARIO DE MONDARIZ id21352 View details | Spain | Hospitality / Food & Beverage / Tourism | leaked | ||
|
El Balneario de Mondariz, complejo hotelero y termal de Galicia. Hotel con 194 habitaciones; moderno balneario con aplicación de aguas mineromedicinales; el Palacio del Agua, spa de 3000m2; campo de golf de 18 hoyos y mucho ms |
||||||
| Ransomware | moonsafari id21351 View details | — | IT | pending | ||
|
Moon Safari is an architecture and urban planning agency based in Bordeaux, France, with additional offices in Lyon, Anglet, and Paris. The studio offers eclectically designed projects across education, healthcare, sports, and tertiary sectors, mixing diverse styles and approaches. Founded in 2002 by Jean-Luc Baldelli and Arnaud Guirao, the agency is now led by six associates and operates as a SAS architecture company. Moon Safari was listed as a ransomware victim associated with the threat actor Qilin, impacting its operations in the Construction and Real Estate sector. |
||||||
| Ransomware | [Redacted] id21367 View details | France | Other | pending | ||
|
Removed by company request of 25 July 2025 - Request #1330 |
||||||
| Ransomware | jaegerndorfer.at id21349 View details | Austria | Transportation / Travel / Logistics | pending | ||
|
Dear lovers of railways and cable car models! If something breaks down, do not worry, we will be happy to help. |
||||||
| Ransomware | Metricon Homes id21344 View details | Australia | Communication / Marketing | pending | ||
|
Founded in 1976, Metricon Homes is one of Australia's largest and most reputable residential home builders. With nearly five decades of experience, the company has established a strong presence across the country, offering a diverse portfolio ... |
||||||
| Ransomware | moonsafari id35593 View details | Andorra | IT | leaked | ||
|
N/A |
||||||
| Ransomware | DelCampo id21332 View details | El Salvador | Public Sector | pending | ||
|
el Campo is a third-generation, family-owned business dedicated to growing the best tasting fruits and vegetables year round. We are a vertically integrated operation with state of the art greenhouses in Sinaloa and Jalisco, Mexico; which are ... |
||||||
| Ransomware | www.balkankalip.com id21327 View details | Türkiye | Communication / Marketing | pending | ||
|
Founded in Istanbul in 1998, Balkan Kalıp is a company that produces molds and mass-produces parts to meet the needs of the automotive industry. With a solution-oriented approach and a vision of sustainable and continuous development, Balkan ... |
||||||
| Ransomware | Windsor Door id21309 View details | United States | Energy | pending | ||
|
Windsor Door, Inc., founded in 1976 and based in Little Rock, Arkansas, is a recognized manufacturer specializing in garage door solutions for both residential and commercial applications. The company’s offerings include embossed steel pane ... |
||||||
| Ransomware | http://www.balkankalip.com id21306 View details | Türkiye | Communication / Marketing | pending | ||
|
Founded in Istanbul in 1998, Balkan Kalıp is a company that produces molds and mass-produces parts to meet the needs of the automotive industry. With a solution-oriented approach and a vision of sustainable and continuous development, Balkan ... |
||||||
| Ransomware | ARCTICGROUP id21296 View details | United States | Retail / E-commerce | pending | ||
|
Arctic Glacier is North America’s leading manufacturer and direct-to-store distributor (DSD) of premium quality packaged ice, ice equipment and related services. Since its start in 1882, Arctic Glacier has grown significantly through strate ... |
||||||
| Ransomware | WIBAIE id21287 View details | Ireland | Construction / Real Estate | pending | ||
|
WIBAIE, a joinery specialist for over 50 years. Based in Cholet (Maine-et-Loire), WIBAIE is a key player in the French window and door market. Our business is 100% dedicated to Building & Housing distribution, and our industrial expertise has ... |
||||||
| Ransomware | danielslawgroupllc.com id21279 View details | United States | Finance / Legal / Insurance | pending | ||
|
Daniels Law Group LLC is a results-oriented law firm located in Grand Junction, Colorado, specializing in civil law with an emphasis on domestic relations, including complex divorces and family law matters. The firm serves clients across the ... |
||||||
| Ransomware | Bronze Craft id21278 View details | United States | Other | pending | ||
|
The company has failed to negotiate with us. New files will be published every 12 hours. File directory: http://securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion/BronzeCraft/ -- Files of interest -- |
||||||
| Ransomware | chainstoreguide.com id21276 View details | United States | Retail / E-commerce | pending | ||
|
Chain Store Guide is the leader in Retail Foodservice sales leads, market research, and geocoded locational data, offering a 7-day free trial access to company profiles and contact information. With 97.6% data accuracy and 15 years of histori ... |
||||||
| Ransomware | Krusell id21254 View details | Thailand | Communication / Marketing | pending | ||
|
Adiantes is a Thailand-based manufacturer specializing in premium quality sustainable leather goods, including handmade handbags, belts, and various accessories. The company focuses on bespoke product design, blending traditional craftsmanshi ... |
||||||
| Ransomware | Tiger Communications id21238 View details | United Kingdom | Communication / Marketing | pending | ||
|
If the company does not contact us by 25/07/2025, their files will be published Full file directory: [coming soon] -- Files of interest -- List of customers and their contracts: tiger/E$/Sha ... |
||||||
| Ransomware | Ritenour School District id21230 View details | United States | Education | pending | ||
|
The Ritenour School District, located in Northwest St. Louis County, is one of the oldest districts in the metropolitan area. They have grown from that one room cabin into 10 schools, an early childhood center and a large adult community prog ... |
||||||
| Ransomware | KEP Credit Union KEP id21224 View details | Curaçao | Finance / Legal / Insurance | pending | ||
|
KEP Credit Union offers professional and personal financial services tailored to the needs of its members, focusing on saving, investment, and lending. The organization aims to provide flexible loan options and facilitate investment opportuni ... |
||||||
| Ransomware | lawforpersonalinjury.com id21209 View details | United States | Finance / Legal / Insurance | pending | ||
|
Prince & Schmidt Personal Injury Lawyers specializes in personal injury law, representing clients in cases such as medical malpractice, vehicle accidents, civil rights violations, and premises liability. Based in Santa Fe, NM, the firm serves ... |
||||||
| Ransomware | Media Broadcast Satellite id21208 View details | Germany | Communication / Marketing | pending | ||
|
Media Broadcast Satellite GmbH is a trusted service integrator and managed gateway operator that specializes in satellite and data network communications. The company offers a variety of solutions, including SATCOM as a Service, Infrastructur ... |
||||||
| Ransomware | joseantoniorodriguez.com id21196 View details | Spain | Services | pending | ||
|
For over 40 years, we have provided tax and accounting consulting , labor consulting , management , legal consulting , insurance brokerage , and real estate agency services . We have offices in Santander, Cabezón de la Sal, San Vicente de l ... |
||||||
| Ransomware | Specialty Components id21177 View details | United States | Manufacturing / Engineering | pending | ||
|
Specialty Components incorporated has over 30 years experience in designing and manufacturing precision air bearings for semiconductor manufacturing, machine components and metal optics. Our standard product lines include linear, spherical a ... |
||||||
| Ransomware | ResourceEnergy id21176 View details | United States | Energy | pending | ||
|
All of data will be available to download on July 15th. Resource Energy was founded in 2007 with the mission of assisting commercial real estate owners with their energy needs. Principals Scott Reinstein, Steven Schlussel, and Richard Plutze ... |
||||||
| Ransomware | Halvorsen Family Law Group id21174 View details | United States | Finance / Legal / Insurance | pending | ||
|
At Halvorsen Family Law, we understand that family is everything. When legal issues arise, you need someone who cares about your family as much as you do. We value our clients as we passionately represent them before, during, and even after ... |
||||||
| Ransomware | WH Rogers Sheet Metal id21171 View details | United States | Manufacturing / Engineering | pending | ||
|
WH Rogers Sheet Metal has specialized in the custom fabrication of metal parts for over 50 years, serving the Carolinas with advanced computerized technologies. They offer services based on client designs or with assistance from their CAD dep ... |
||||||
| Ransomware | City of Green River id21170 View details | United States | Public Sector | leaked | ||
|
The City of Green River, Utah providing information about community, recreation, events and government to visitors, the local community, employees, business, and government |
||||||
| Ransomware | The Paul Wilkinson Law Firm id21167 View details | United States | Finance / Legal / Insurance | pending | ||
|
The Paul Wilkinson Law Firm is a Denver-based personal injury law firm that specializes in helping victims of car, truck, motorcycle, and other motor vehicle accidents. Led by Paul Wilkinson, the firm provides legal representation to clients ... |
||||||
| Ransomware | ProActive Solutions USA id21165 View details | United States | Communication / Marketing | pending | ||
|
Based in Green Bay, Wis. ProActive Solutions USA, LLC is a privately held, ISO 9001 company that is a manufacturer of sanitizers, cleaning chemicals and herd health products for the farm and food industries. They are also a distributor of com ... |
||||||
| Ransomware | VM Racing id21148 View details | Italy | Retail / E-commerce | pending | ||
|
VM Racing, is a retail company specializing in sports merchandise and equipment. The company deals with the sale of sporting goods, mainly related to the motorcycle sector.We hacked VM Racing and managed to obtain 1.041.539 files, worth 83GB. ... |
||||||
| Ransomware | Culver's Lawn & Landscape, Inc. id21145 View details | United States | Finance / Legal / Insurance | pending | ||
|
Culver’s Lawn & Landscape began in 1982, when entrepreneur Todd Culver started a lawn mowing business at the age of 12 in Dallas, Texas. Originally from Iowa, Todd moved back to Cedar Rapids in 1984 where he continued his lawn & landscaping ... |
||||||
| Ransomware | pinnacle Roofing and Exteriors id21124 View details | United States | Manufacturing / Engineering | pending | ||
|
Pinnacle Roofing and Exteriors, Inc. is a roofing and exteriors company located in Charlotte, NC, specializing in a variety of roofing solutions including metal, slate, and traditional shingles, as well as gutter services and custom metal fab ... |
||||||
| Ransomware | fuld.com id21117 View details | United States | Finance / Legal / Insurance | pending | ||
|
Founded in 1978 and headquartered in Boston, Massachusetts, Fuld + Company LLC is in the practice of Financial research, Analytics and Competitive intelligence to support competitive strategyhelping executives understand the intricacies of th ... |
||||||
| Ransomware | www.intereum.com id21116 View details | United States | Healthcare / Pharma | pending | ||
|
Founded in 1980, Intereum is a provider of furniture, audio and visual solutions, and wall systems. Intereum products and services include modular walls, audiovisual integration, and space planning for the corporate, healthcare, education, an ... |
||||||
| Ransomware | nexa.bb id21115 View details | Barbados | Services | pending | ||
|
Nexa is a professional service firm based in Barbados providing client focused accounting, advisory, auditing, consulting, corporate and tax services. At nexa we strive to build strong and long-lasting relationships with our clients. We aim t ... |
||||||
| Ransomware | Darien Telephone id21114 View details | United States | Communication / Marketing | pending | ||
|
Darien Telephone Company is a family-owned independent communications provider that offers high-speed internet, telephone, and cable services. They cater to both residential and business customers with a focus on rural community needs. Their ... |
||||||
| Ransomware | Accu Reference Medical Lab id21092 View details | United States | Healthcare / Pharma | pending | ||
|
About Accu Reference Medical Lab Accu Reference is a state-of-the-art medical testing laboratory service that provides a complete range of tests for diagnosis, screening or evaluation of diseases and health conditions. We are certified under ... |
||||||
| Ransomware | Consorzio di Bonifica Adige Po id35785 View details | Italy | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Microf id21080 View details | United States | Communication / Marketing | pending | ||
|
Microf specializes in HVAC and water heater financing solutions with lease-to-own options, particularly catering to homeowners with challenged credit. The company offers a simple application process, quick approvals, and flexible payment plan ... |
||||||
| Ransomware | volpatoindustrie.it id21052 View details | Italy | Communication / Marketing | pending | ||
|
Since 1974, Volpato Industrie has been working with the aim of continuously improving the technical and aesthetic quality of its products. An approach totally oriented towards customer satisfaction that has allowed the company to develop the ... |
||||||
| Ransomware | Ridewill SRL id21009 View details | Italy | Retail / E-commerce | pending | ||
|
Ridewill, is a retail company specializing in sports merchandise and equipment. The company deals with the sale of sporting goods, mainly related to the cycling sector. Our team managed to breach Cenomi Retail network. We hacked Ridewill and ... |
||||||
| Ransomware | knightknox id20963 View details | United Kingdom | Communication / Marketing | pending | ||
|
We are a Manchester-based, proven property investment specialist with a 20-year history in the property investment business. We specialise in identifying and sourcing high-yield property investments for clients across the UK and overseas. Our ... |
||||||
| Ransomware | Punta Del Agua id20958 View details | Argentina | Communication / Marketing | pending | ||
|
Punta del Agua is a family-owned dairy company with over 55 years of experience in producing high-quality dairy products. Their extensive product range includes various cheeses, butter, dulce de leche, and powdered milk, all made from premium ... |
||||||
| Ransomware | Cenomi Retail id20955 View details | Japan | Retail / E-commerce | pending | ||
|
Cenomi Retail, founded in 1990, is a retail company specializing in sports merchandise and equipment. With operations across North America, the Middle East, Africa, and Asia, the company offers both business-to-business and direct-to-consumer ... |
||||||
| Ransomware | vresystems.com id20943 View details | United Kingdom | Services | pending | ||
|
If the company does not contact us by 09.07.2025, the data will be published Full file directory here: [coming soon] -- Files of interest -- Employee information: name, DOB, SSN, address, payroll, fa ... |
||||||
| Ransomware | corpdvs.com id20942 View details | United States | Services | pending | ||
|
Corporate Data Voice Solutions is a leading systems integrator and technology consultant with over two decades of industry leadership experience. The company specializes in providing companies with customized, future-ready IT solutions that i ... |
||||||
| Ransomware | conlonproducts.net id20941 View details | United States | Communication / Marketing | pending | ||
|
We offer a solution. As you know, Conlon Products is a local, family-owned, wholesale distributor of paper products, cleaning supplies, safety products and janitorial equipment serving the Merrimack Valley for over 50 years. We have great pro ... |
||||||
| Ransomware | https://www.injusa.com/ id20940 View details | Spain | Communication / Marketing | pending | ||
|
INJUSA was born as a family business, and we can say today that it still preserves that spirit of unity, teamwork, and continuous improvement. This spirit is evident in the results of the more than 850,000 toys it produces each year, in its d ... |
||||||
| Ransomware | QUINTADAMARINHA.com id20939 View details | Portugal | Hospitality / Food & Beverage / Tourism | pending | ||
|
Onyria Quinta da Marinha Hotel Between the city and nature, the beach and the mountains, the Onyria Quinta da Marinha Hotel - located in the privileged area of Cascais-Sintra, just 25 km from Lisbon - offers you the perfect setting to enjoy ... |
||||||
| Ransomware | atlantissubmarines id20938 View details | Barbados | IT | pending | ||
|
Atlantis Submarines is a pioneering leader in passenger-carrying submarine technology, established in 1985, and known for developing the world's first tourist submarine. The company has safely completed over 580,000 dives, carrying over 18 mi ... |
||||||
| Ransomware | fcsserves.org id20931 View details | United States | Communication / Marketing | pending | ||
|
Family & Community Services, Inc. is a non-profit corporation headquartered in Portage County, Ohio. The agency began in 1941 as the Catholic Charities Bureau of the Ravenna Deanery with just two programs and two staff members. Today, FCS ope ... |
||||||
| Ransomware | Mainetti id20930 View details | Italy | Retail / E-commerce | pending | ||
|
Headquartered in The Scottish Borders, United Kingdom, Mainetti is a manufacture and supplier of packaging for the fashion industry and a provider of smart retail solutions.For over sixty years, Mainetti has been a trusted partner to the worl ... |
||||||
| Ransomware | villagecoin.com id20925 View details | United States | Retail / E-commerce | pending | ||
|
Village Coin Shop specializes in providing a wide variety of numismatic products.The store is also recognized as a dealer of US Mint bullion and Royal Canadian Mint bullion. 1.Client lists 2.File is an invoice from SilverTowne (STLP) to Vil ... |
||||||
| Ransomware | parsons-peebles.com id20924 View details | United Kingdom | Communication / Marketing | pending | ||
|
Parsons Peebles is a global mechanical and electrical engineering service provider specializing in high, medium and low voltage motors, generators, pumps, gearboxes and compressors. 1.QOS (Quality of Services) and TDC Parsons Peebles Agreeme ... |
||||||
| Ransomware | capmark.org id20923 View details | United States | Communication / Marketing | pending | ||
|
An independent registered municipal advisor dedicated to providing public jurisdictions with comprehensive advice on planning, structuring and issuing bonds, notes and lease debt to meet their capital and cash flow needs. Their prospective ... |
||||||
| Ransomware | Alert Medical Alarms id20921 View details | United States | Healthcare / Pharma | leaked | ||
|
Alert Medical Alarms is a nationwide leader in Personal Emergency Response Systems (PERS), bringing over 25 years of healthcare expertise to deliver innovative, life-enhancing solutions. Our mission is to empower individuals and support manag ... |
||||||
| Ransomware | LP Charpente id20920 View details | France | Construction / Real Estate | pending | ||
|
Charpente in Annecy in the Haute-Savoie region of France, LP Charpente is a builder of timber-frame houses and all types of traditional carpentry work, including zinc work, roofing and building extension renovations. |
||||||
| Ransomware | exhibits-intl.com id20918 View details | United States | Communication / Marketing | pending | ||
|
Founded in 1961, kubik maltbie produces experiences for museums, visitor centers, and exhibition projects. It offers fabrication and installation services, exhibit design and production, and creation of interactive exhibits. The company is he ... |
||||||
| Ransomware | steeplechasetool.com id35617 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | mpark.net id35618 View details | Malaysia | Hospitality / Food & Beverage / Tourism | leaked | ||
|
N/A |
||||||
| Ransomware | simmons-Boardman Publishing, Inc id20904 View details | United States | Communication / Marketing | pending | ||
|
Simmons-Boardman Publishing Corporation is one of the oldest, most well-respected, privately held B2B publishers. Our diverse portfolio of print and digital products includes magazines, books, directories, email newsletters, conferences, webs ... |
||||||
| Ransomware | semco-tech.com id20903 View details | France | IT | pending | ||
|
SEMCO Technologies is a France-based expert in electrostatic chucks (ESCs), essential components in semiconductor device manufacturing. The company focuses on delivering advanced and tailored wafer handling solutions to meet the needs of larg ... |
||||||
| Ransomware | www.nuphoton.com id20902 View details | United States | Communication / Marketing | pending | ||
|
Nuphoton Technologies, Inc. is a pioneer in fiber lasers and fiber amplifiers with applications covering industrial, defense, aerospace, biomedical, telecommunications and research areas. The company is in operation since 1996 using proprieta ... |
||||||
| Ransomware | slyfoxbeer.com id35616 View details | United States | Hospitality / Food & Beverage / Tourism | leaked | ||
|
N/A |
||||||
| Ransomware | elpasoglass.com id20875 View details | United States | Retail / E-commerce | pending | ||
|
We are commited to being one of the best and highest quality commercial contract glazing firms in the rocky mountain region. While specializing in Curtainwall, Storefront and Commercial windows we understand how important scheduling and compl ... |
||||||
| Ransomware | greatcdltraining.com id20874 View details | United States | Education | pending | ||
|
Over more than 30 years, Driver Solutions has specialized in providing affordable driver training and quality trucking job opportunities to new drivers. We do this by offering a company-sponsored CDL training program that allows new drivers ... |
||||||
| Ransomware | broadleafgame.com id20873 View details | Japan | Retail / E-commerce | pending | ||
|
Broadleaf is a family-owned food distribution company supplying high-quality meats and deli meats to distributors and retailers throughout the United States and abroad.Founded in 1988, Broadleaf entered the U.S. market as a major importer and ... |
||||||
| Ransomware | buffalomarine.com id20872 View details | United States | Communication / Marketing | pending | ||
|
Buffalo Marine Service, Inc. founded in 1935, is a bunkering and marine transportation company specializing in inland waterway towing with a focus on the Intracoastal Waterway System. 1.The document is a Professional Services Agreement (Prof ... |
||||||
| Ransomware | artexmanagement.com id20863 View details | United States | Services | pending | ||
|
Artex Management was founded in 2005 to meet the industry's demand for reliable and hassle-free property management.Our mission is to achieve the standard of living you desire for each property. 1.The document is a Payment Agreement (Payment ... |
||||||
| Ransomware | norsk.global id20862 View details | Norway | Services | pending | ||
|
<readacted> |
||||||