Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2564 published victims and 5 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Qilin is tracked by Breach House as a ransomware group with 2564 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
161
- Leaked 120 74.5%
- Pending 33 20.5%
- Deleted 8 5.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 3h ago | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Down checked 3h ago | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
| Leak location 4 | Onion service | Down checked 3h ago | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 2 | Onion service | Down checked 3h ago | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
| Leak location 1 | Onion service | Down checked 3h ago | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
Top Activity Sectors (18)
- Not identified 498
- Communication / Marketing 271
- Manufacturing / Engineering 201
- Services 201
- Finance / Legal / Insurance 171
- Construction / Real Estate 157
- Healthcare / Pharma 139
- IT 121
- Retail / E-commerce 88
- Education 73
- Public Sector 68
- Transportation / Travel / Logistics 53
- Energy 53
- Hospitality / Food & Beverage / Tourism 45
- Agriculture / Food 41
- Telecommunications 28
- NGOs / Associations 23
- Sports 1
Typical Attacks (52)
▼How Qilin typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Qilin.
-
T1190 Exploit Public-Facing Application Initial Access
What they do: Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.
What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
-
T1566.001 Spearphishing Attachment Initial Access
What they do: Qilin has been delivered to victims through malicious email attachments.
What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
-
T1566.002 Spearphishing Link Initial Access
What they do: Qilin has been delivered via malicious links in spearphishing emails.
What that means: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
-
T1047 Windows Management Instrumentation Execution
What they do: Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
What they do: Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.
What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
-
T1059.001 PowerShell Execution
What they do: Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1059.003 Windows Command Shell Execution
What they do: Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1204.001 Malicious Link Execution
What they do: Qilin has been executed by luring victims into clicking links in spearphishing emails.
What that means: An adversary may rely upon a user clicking a malicious link in order to gain execution.
-
T1204.002 Malicious File Execution
What they do: Qilin has been delivered to victims through spearphishing emails with malicious attachments.
What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.
-
What they do: Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
What they do: Qilin can configure a Winlogon registry entry.
What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
-
What they do: Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.
What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.
-
What they do: Qilin can use an embedded Mimikatz module for token manipulation.
What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
-
What they do: Qilin has pushed a scheduled task via a Group Policy Object for payload execution.
What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
-
T1548.002 Bypass User Account Control Privilege Escalation
What they do: Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.
What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1036.004 Masquerade Task or Service Stealth
What they do: Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.
What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1070.004 File Deletion Stealth
What they do: Qilin can delete itself from infected hosts after execution.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1480 Execution Guardrails Stealth
What they do: Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1480.002 Mutual Exclusion Stealth
What they do: Qilin can create a mutex to ensure only one instance is running.
What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
-
T1678 Delay Execution Stealth
What they do: Qilin has the ability to delay execution.
What that means: Adversaries may employ various time-based methods to evade detection and analysis.
-
T1222 File and Directory Permissions Modification Defense Impairment
What they do: Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.
What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Qilin can terminate antivirus-related processes and services.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1685.005 Clear Windows Event Logs Defense Impairment
What they do: Qilin has the ability to clear Windows Event Logs.
What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
-
T1688 Safe Mode Boot Defense Impairment
What they do: Qilin can reboot targeted systems in safe mode to avoid detection.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1003.001 LSASS Memory Credential Access
What they do: Qilin can employ an embedded Mimikatz module to dump LSASS memory.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1007 System Service Discovery Discovery
What they do: Qilin can identify specific services for termination or to be left running at execution.
What that means: Adversaries may try to gather information about registered local system services.
-
T1012 Query Registry Discovery
What they do: Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.
What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
-
T1016 System Network Configuration Discovery Discovery
What they do: Qilin can accept a command line argument identifying specific IPs.
What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
-
T1018 Remote System Discovery Discovery
What they do: Qilin can enumerate domain-connected hosts during its discovery phase.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1057 Process Discovery Discovery
What they do: Qilin can define specific processes to be terminated or left alone at execution.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1069.002 Domain Groups Discovery
What they do: Qilin can run PowerShell cmdlets to discover domain groups.
What that means: Adversaries may attempt to find domain-level groups and permission settings.
-
T1082 System Information Discovery Discovery
What they do: Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: Qilin can exclude specific directories and files from encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1087.001 Local Account Discovery
What they do: Qilin can list all local users found on a targeted system.
What that means: Adversaries may attempt to get a listing of local system accounts.
-
T1087.002 Domain Account Discovery
What they do: Qilin can use PowerShell cmdlets to enumerate domain users.
What that means: Adversaries may attempt to get a listing of domain accounts.
-
T1135 Network Share Discovery Discovery
What they do: Qilin has the ability to list network drives.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1673 Virtual Machine Discovery Discovery
What they do: Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.
What that means: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.
-
T1680 Local Storage Discovery Discovery
What they do: Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1021.004 SSH Lateral Movement
What they do: Qilin can enable SSH access on ESXi hosts.
What that means: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).
-
T1570 Lateral Tool Transfer Lateral Movement
What they do: Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.
What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
-
T1071.002 File Transfer Protocols Command and Control
What they do: Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.
What that means: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
-
T1219.002 Remote Desktop Software Command and Control
What they do: Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.
What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
-
T1486 Data Encrypted for Impact Impact
What they do: Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Qilin can terminate specific services on compromised hosts.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
-
T1529 System Shutdown/Reboot Impact
What they do: Qilin can initiate a reboot of the backup server to hinder recovery.
What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Tools Observed (27)
▼Software Qilin has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
Mimikatz
Defense evasion
EDRSandBlast
PCHunter
PowerTool
Toshiba power management driver (BYOVD)
Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
YDArk
Zemana Anti-Rootkit driver
Discovery
Nmap
Nping
Discovery & enumeration
Nmap
Nping
Exfiltration
EasyUpload.io
EasyUpload
LOLBAS (living-off-the-land binaries)
fsutil
PsExec
WinRM
Networking & tunnelling
Proxychains
OffSec
Cobalt Strike
Evilginx
NetExec
Offensive security tooling
Cobalt Strike
Evilginx
NetExec
RMM Tools
ScreenConnect
Remote monitoring & management
NetSupport
ScreenConnect
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README-RECOVER-[rand]_2.txt
-- Qilin We have 3.4TB of your data stored on our servers. Contact us or we will publish this data on our blog, in the media and pass it on to the relevant authorities. We are ready to offer you a discount in case of payment within a week. Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: 2ir53sQQAU Domain: [snip] login: [snip] password:[snip]
README-RECOVER-[rand].txt
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: [snip] Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion login: [snip] password:[snip]
DtMXQFOCos-RECOVER-README.txt
-- Agenda
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
- Employees personal dataCVsDLSSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients databillsbudgetsannual reportsbank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials
-- Credentials
Extension: DtMXQFOCos
Domain: wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion
login: [snip]
password: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (2564)
Search, filter and paginate the victim timeline for Qilin. Showing 1–100 of 2564.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Imperial Healthcare Solutions id32764 View details | United States | Healthcare / Pharma | pending | ||
|
Imperial Healthcare Solutions operates within the US healthcare and medicine sector, providing healthcare-related solutions and services to patients and providers. As a ransomware victim, the entity appears in the threat-intelligence index associated with the threat actor qilin. This listing type indicates a cybersecurity incident involving unauthorized access or encryption activity within the healthcare domain. The record reflects the entity's classification and the specific threat actor linkage without disclosing unverified incident details. Contextual understanding of qilin activity within healthcare environments supports risk assessment and defensive prioritization. |
||||||
| Ransomware | Imperial Healthcare Solutions id32764 View details | United States | Healthcare / Pharma | pending | ||
|
N/A |
||||||
| Ransomware | Mitsuwa Trading Co., Ltd id32722 View details | Japan | IT | pending | ||
|
e-mitsuwa.com operates within the IT sector and is identified in the threat-intelligence index as a ransomware victim entity. The domain name suggests a technology or service-oriented organization located in Japan, though specific operational details remain limited to its classification within the index. This listing reflects its association with threat actor qilin, a known adversary group linked to ransomware activity in cybersecurity intelligence records. The description avoids speculative claims regarding breach details, data exfiltration, or financial impact. e-mitsuwa.com was listed as a ransomware victim associated with qilin. |
||||||
| Ransomware | Mitsuwa Trading Co., Ltd id32722 View details | Japan | IT | pending | ||
|
N/A |
||||||
| Ransomware | Jet Specialty id32712 View details | United States | Manufacturing / Engineering | pending | ||
|
www.jetspecialty.com operates within the United States manufacturing and engineering sector, providing specialized commercial services and operational solutions. The entity is cataloged in this threat-intelligence index as a ransomware victim linked to the qilin threat actor. This listing reflects the assessed cybersecurity context surrounding the organization and the associated threat profile without disclosing unverified incident details. The entry supports security professionals, compliance teams, and threat analysts monitoring ransomware activity across critical industrial sectors. |
||||||
| Ransomware | Jet Specialty id32712 View details | United States | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | Alaska Electrical Apprenticeship id32681 View details | United States | Services | leaked | ||
|
www.alaskaelectricalapprenticeship.org operates within the United States Services sector, providing educational and apprenticeship pathways for electrical trades. The entity supports workforce development initiatives aligned with regional electrical industry needs. According to the threat-intelligence index, this organization was listed as a ransomware victim associated with the threat actor qilin. This listing reflects its inclusion in the ransomware victim catalog without disclosing specific incident details. The record serves to inform stakeholders about potential security exposures within this sector and geographic context. |
||||||
| Ransomware | Alaska Electrical Apprenticeship id32681 View details | United States | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Partners Group SK id32670 View details | Slovakia | Services | pending | ||
|
www.partnersgroup.sk is a Slovak services-sector organization operating within the business services domain, with operational presence indicated by its domain and sector classification. The entity is cataloged within the threat-intelligence index under the listing type ransomware victim, linked to the threat actor qilin. This designation reflects inclusion in intelligence records documenting cybersecurity incidents involving this actor and affected entities. The description avoids speculation regarding specific breach details, data compromises, or operational impacts, maintaining a neutral and factual perspective consistent with threat-intelligence reporting standards. The listing underscores ongoing monitoring of service-sector organizations in Slovakia against ransomware threats from identified actors. |
||||||
| Ransomware | Partners Group SK id32670 View details | Slovakia | Services | pending | ||
|
N/A |
||||||
| Ransomware | Jbc id32629 View details | Spain | Manufacturing / Engineering | pending | ||
|
www.jbctools.com is an entity operating within the Manufacturing and Engineering sector, associated with the country ES. Its profile within this threat-intelligence index identifies it as a ransomware victim linked to the threat actor qilin. The entity provides tools and services relevant to industrial operations and engineering workflows, making it a subject of monitoring for cyber threats targeting critical manufacturing infrastructure. This listing reflects the association between JBCTools and the qilin threat actor without disclosing specific incident details, data impacts, or confirmed breach evidence. The record serves to document the relationship for cybersecurity professionals analyzing ransomware activity across industrial sectors. |
||||||
| Ransomware | Jbc id32629 View details | Spain | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | Philippine Ports Authority id32602 View details | Philippines | Retail / E-commerce | leaked | ||
|
www.ppa.com.ph operates within the Philippines retail and e-commerce sector, providing online commerce and retail-related services to customers and business partners. As part of a threat-intelligence index, this entity is cataloged as a ransomware victim associated with the threat actor qilin. The listing reflects observed cybersecurity intelligence linking the organization to ransomware activity within its geographic and industry context. This description focuses on the entity's sector profile and its classification within the ransomware victim index, without asserting unverified breach details. Stakeholders monitor such entries to understand sector-specific exposure and evolving threat patterns. |
||||||
| Ransomware | Philippine Ports Authority id32602 View details | Philippines | Retail / E-commerce | leaked | ||
|
N/A |
||||||
| Ransomware | Bauman Law Group id32603 View details | United States | Finance / Legal / Insurance | leaked | ||
|
www.baumanlawgroup.com operates within the Finance, Legal, and Insurance sectors and serves clients in the United States, providing specialized legal and professional services relevant to regulated industries. The entity is documented in this threat-intelligence index under the listing type ransomware victim, specifically associated with the threat actor qilin. This classification reflects the cybersecurity context in which the organization was identified within the index's dataset. No specific incident details, such as data stolen or ransom demands, are included here to maintain factual neutrality and avoid speculation beyond the verified association. The listing serves to inform defenders and analysts about potential exposure within this sector and geographic region. |
||||||
| Ransomware | Bauman Law Group id32603 View details | United States | Finance / Legal / Insurance | leaked | ||
|
N/A |
||||||
| Ransomware | Jouvet SAS id32597 View details | France | Manufacturing / Engineering | pending | ||
|
www.jouvet-sas.fr is a French enterprise operating within the manufacturing and engineering sector, identified in this threat-intelligence index as a ransomware victim. The entity reflects cybersecurity exposure within industrial and technical supply chains, where ransomware incidents can disrupt operations and critical engineering workflows. Its association with the threat actor qilin is cataloged neutrally within the index to support threat-tracking and risk assessment. No specific incident details, such as stolen data, ransom terms, or confirmed breach evidence, are included here, consistent with strict factual reporting standards. This listing serves as a structured reference point for analysts monitoring ransomware activity across European manufacturing environments. |
||||||
| Ransomware | Jouvet SAS id32597 View details | France | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | G&S Technologies id32598 View details | United States | IT | leaked | ||
|
www.gstechnologies.com operates within the information technology sector and serves clients requiring technology solutions and services. The entity is geographically associated with the United States. According to the threat-intelligence index, this organization is cataloged as a ransomware victim linked to the threat actor qilin. The listing reflects the cybersecurity event classification without disclosing unverified incident details such as data stolen, ransom demands, or specific breach timelines. This entry provides context for threat actors, defenders, and security analysts monitoring ransomware activity across IT sectors. |
||||||
| Ransomware | G&S Technologies id32598 View details | United States | IT | leaked | ||
|
N/A |
||||||
| Ransomware | Nolan Consulting Group id32599 View details | United States | IT | pending | ||
|
www.nolancg.com operates within the IT sector and is headquartered in the United States. The entity is cataloged as a ransomware victim within the threat-intelligence index, specifically linked to the threat actor qilin. This listing reflects the cybersecurity community's documented association between the organization and the identified threat actor's activity. The catalog entry provides neutral context for researchers and defenders analyzing ransomware incidents across IT environments. No specific incident details, data breach specifics, or confirmed outcomes are included per strict factual constraints. |
||||||
| Ransomware | Nolan Consulting Group id32599 View details | United States | IT | pending | ||
|
N/A |
||||||
| Ransomware | Colonial Hyundai id32600 View details | United States | Manufacturing / Engineering | leaked | ||
|
www.colonialhyundai.com represents Colonial Hyundai, a United States-based enterprise operating within the manufacturing and engineering sectors. The entity provides vehicle design, production support, and engineering solutions as part of its industrial operations and customer offerings. Within the threat-intelligence index, this listing type identifies Colonial Hyundai as a ransomware victim associated with the threat actor qilin. This designation reflects the cybersecurity event documented in the index without disclosing unverified details regarding data handling, breach scope, or remediation specifics. The entry serves as a reference point for monitoring threats within critical manufacturing and engineering organizations. |
||||||
| Ransomware | Colonial Hyundai id32600 View details | United States | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | The Big Table id32601 View details | United Kingdom | IT | pending | ||
|
www.bigtablegroup.com operates within the IT sector and is headquartered in the United Kingdom. The entity provides technology-focused services and solutions relevant to enterprise and digital infrastructure needs. According to the threat-intelligence index, this organization was listed as a ransomware victim linked to the threat actor qilin. This classification reflects the cybersecurity event documented within the index without disclosing unverified technical details or confirmed breach specifics. The entry serves catalog and analytical purposes for monitoring ransomware activity across sectors and geographies. |
||||||
| Ransomware | The Big Table id32601 View details | United Kingdom | IT | pending | ||
|
N/A |
||||||
| Ransomware | AP CAPITAL PARTNERS LIMITED id32575 View details | United States | Finance / Legal / Insurance | leaked | ||
|
www.apcapitalpartners.com operates within the Finance, Legal, and Insurance sectors from the United States, providing professional investment partnership and advisory services. The entity is cataloged in this threat-intelligence index under the listing type ransomware victim, specifically linked to the threat actor qilin. This designation reflects its inclusion within threat-actor attribution records without disclosing unverified incident details. The description adheres to neutral, authoritative standards, focusing on entity context, sector alignment, geographic origin, and the verified association with the qilin threat actor. No specifics regarding breach confirmation, data exposure, ransom demands, or operational impact are stated per strict factual reporting guidelines. |
||||||
| Ransomware | AP CAPITAL PARTNERS LIMITED id32575 View details | United States | Finance / Legal / Insurance | leaked | ||
|
N/A |
||||||
| Ransomware | Commission de la construction du Quebec (CCQ) id32571 View details | Canada | NGOs / Associations | leaked | ||
|
www.ccq.org operates within the NGO and associations sector and is situated in Canada. The entity provides organizational services aligned with non-profit and association frameworks, serving community and advocacy purposes. Within the threat-intelligence index, www.ccq.org is cataloged as a ransomware victim linked to the threat actor qilin. This listing reflects the entity's association with this specific cyber threat actor in the context of ransomware activity targeting organizational sectors. The description remains factual and neutral, documenting the indexed relationship without speculating on unverified incident details. |
||||||
| Ransomware | Commission de la construction du Quebec (CCQ) id32571 View details | Canada | NGOs / Associations | leaked | ||
|
N/A |
||||||
| Ransomware | Complete Packaging Solutions id32564 View details | India | Manufacturing / Engineering | deleted | ||
|
www.completepackaginggroup.com operates within the manufacturing and engineering sector, based in India. The entity provides packaging-related solutions and services aligned with industrial production and engineering workflows. In threat-intelligence indexing, it is cataloged as a ransomware victim associated with the threat actor qilin. This listing reflects the entity's inclusion in cybersecurity monitoring records tied to this adversary group, without confirming specific technical details of any incident. The description remains neutral and focuses on the verified association and sector context. |
||||||
| Ransomware | Complete Packaging Solutions id32564 View details | India | Manufacturing / Engineering | deleted | ||
|
N/A |
||||||
| Ransomware | Tanner id32565 View details | Chile | Manufacturing / Engineering | pending | ||
|
www.tanner.cl is an entity operating within the Chilean manufacturing and engineering sector, providing industrial and technical solutions relevant to production and design workflows. It is cataloged within this threat-intelligence index as a ransomware victim linked to the qilin threat actor. The listing reflects the entity's association with this specific cyber threat profile and its position within the monitored industrial sectors. This entry supports security teams analyzing ransomware patterns affecting manufacturing and engineering organizations in Central America. The record remains neutral regarding confirmed breach details, focusing solely on the verified association and sector context. |
||||||
| Ransomware | Tanner id32565 View details | Chile | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | Uak University id32420 View details | Türkiye | Education | pending | ||
|
www.usak.edu.tr is an educational institution located in Turkey within the education sector, providing academic and institutional services. It is cataloged in this threat-intelligence index as a ransomware victim linked to the threat actor qilin. The listing reflects the entity's association with this specific cyber threat actor within the ransomware incident context. This entry documents the relationship without disclosing unverified technical details or confirmed breach specifics. The record serves to inform stakeholders about the entity's exposure profile within the indexed threat landscape. |
||||||
| Ransomware | Uak University id32420 View details | Türkiye | Education | pending | ||
|
N/A |
||||||
| Ransomware | Grayson Rural Electric Cooperative id32410 View details | United States | Services | leaked | ||
|
www.graysonrecc.com operates within the Services sector and is headquartered in the United States. The entity provides professional services aligned with its sector classification, though specific operational details remain outside verified incident documentation. This listing identifies www.graysonrecc.com as a ransomware victim within the threat-intelligence index, explicitly linked to the qilin threat actor. The designation reflects observed threat-intelligence correlation rather than confirmed breach evidence. Neutral documentation ensures transparency regarding the association while maintaining factual boundaries. |
||||||
| Ransomware | Grayson Rural Electric Cooperative id32410 View details | United States | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Commission de la construction du Quebec id32374 View details | Canada | NGOs / Associations | leaked | ||
|
www.ccq.org functions as an organization within the NGO and associations sector, operating from Canada. Its role within this threat-intelligence index is specifically categorized as a ransomware victim, with the associated threat actor identified as qilin. The entity represents a real-world target profile where cyber threats have manifested in organizational contexts, highlighting vulnerabilities within non-profit and association infrastructures. This listing contributes contextual data to the broader analysis of ransomware campaigns targeting specific sectors and geographic regions. It was listed as a ransomware victim associated with qilin. |
||||||
| Ransomware | Commission de la construction du Quebec id32374 View details | Canada | NGOs / Associations | leaked | ||
|
N/A |
||||||
| Ransomware | Inmac id32366 View details | Argentina | Manufacturing / Engineering | pending | ||
|
www.inmac.com.ar is an entity operating within the Manufacturing and Engineering sector, based in Argentina (AR). The organization provides engineering and manufacturing-related services, with its digital infrastructure potentially targeted by cyber threats. This listing identifies www.inmac.com.ar as a ransomware victim associated with the threat actor qilin. The entry reflects the threat-intelligence index classification without disclosing specific incident details. This catalog description remains neutral and factual, adhering to the requirements of a premium threat-intelligence index for catalog copy. |
||||||
| Ransomware | Inmac id32366 View details | Argentina | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | Allied Recycling id32338 View details | Ireland | Manufacturing / Engineering | pending | ||
|
www.alliedrecycling.ie operates within the Manufacturing and Engineering sector and is situated in Ireland. The entity is cataloged in this threat-intelligence index as a ransomware victim associated with the threat actor qilin. The listing reflects the cybersecurity incident classification without disclosing unverified details regarding data exfiltration, ransom demands, or specific technical attack vectors. This description serves to document the entity's sector profile, geographic context, and its recognized affiliation with qilin within the ransomware victim index. All information is presented neutrally based on available intelligence. |
||||||
| Ransomware | Allied Recycling id32338 View details | Ireland | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | AFSARD id32318 View details | North Macedonia | Public Sector | leaked | ||
|
ipardpa.gov.mk is a government domain operating within the Public Sector of the Republic of Macedonia (country code MK). The domain represents an official public administration entity, likely providing public services, governance functions, or administrative offerings aligned with national public sector infrastructure. Within this threat-intelligence index, the entity is cataloged specifically as a ransomware victim linked to the threat actor qilin. This listing type indicates documented association with ransomware activity targeting public sector environments, reflecting ongoing cyber risk exposure for government-related digital assets. The description remains neutral and factual, focusing solely on the entity's classification and verified threat context without elaborating on unconfirmed incident details, data impacts, or operational specifics. |
||||||
| Ransomware | AFSARD id32318 View details | North Macedonia | Public Sector | leaked | ||
|
N/A |
||||||
| Ransomware | Crystalpharmatech id32309 View details | United States | Healthcare / Pharma | leaked | ||
|
CrystalBioSolutions.com operates within the United States healthcare and pharmaceutical sectors, providing specialized solutions aligned with clinical and operational requirements. The entity was formally cataloged as a ransomware victim within this threat-intelligence index, with the associated threat actor identified as qilin. This listing type denotes the cybersecurity event classification observed in the index, reflecting the organization's status during the threat activity. The description adheres to neutral, authoritative standards for cataloging security incidents without disclosing unverified technical or operational details. Healthcare and pharma sectors remain critically vulnerable to ransomware campaigns, underscoring the importance of such threat-intelligence indexing for risk awareness and defensive planning. |
||||||
| Ransomware | Crystalpharmatech id32309 View details | United States | Healthcare / Pharma | leaked | ||
|
N/A |
||||||
| Ransomware | Absolute Consultancy Services id32310 View details | United Kingdom | Services | leaked | ||
|
www.absolutecs.co.uk operates within the Services sector and is located in the United Kingdom. The entity represents a business organization whose security posture and operational environment were documented within a threat-intelligence index. This listing identifies the organization as a ransomware victim linked to the threat actor qilin. The description remains factual and neutral, reflecting the index classification without asserting unverified incident details such as data stolen, ransom demands, or confirmed breach scope. The inclusion underscores cybersecurity risk awareness for service-sector organizations in the GB region. |
||||||
| Ransomware | Absolute Consultancy Services id32310 View details | United Kingdom | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Black Cat Engineering Construction Wll id32311 View details | Qatar | IT | deleted | ||
|
www.blackcat.com.qa operates within the IT sector and is situated in Qatar. The entity is cataloged in the threat-intelligence index under the ransomware victim listing type, linked to the qilin threat actor or source. This designation reflects its inclusion within cybersecurity intelligence records documenting potential ransomware-related activity or impact. The description avoids speculative claims regarding specific attack details, data exposure, or operational consequences. It neutrally records the association with qilin as the attributed threat actor for this entity in the index. |
||||||
| Ransomware | Black Cat Engineering Construction Wll id32311 View details | Qatar | IT | deleted | ||
|
N/A |
||||||
| Ransomware | Bandit Industries id32271 View details | United States | IT | pending | ||
|
www.banditchippers.com operates within the IT sector and is situated in the United States. The entity is cataloged in this threat-intelligence index as a ransomware victim linked to the threat actor qilin. This listing reflects the cybersecurity assessment connecting the organization to this specific adversary activity within the monitored dataset. The description remains factual and neutral, focusing solely on the entity's classification and associated threat context without elaborating on unverified incident details. The inclusion underscores the importance of tracking ransomware victim profiles and their connections to identified threat actors for risk intelligence purposes. |
||||||
| Ransomware | Bandit Industries id32271 View details | United States | IT | pending | ||
|
N/A |
||||||
| Ransomware | LAPoco Architects id32270 View details | United States | Manufacturing / Engineering | pending | ||
|
www.laparchitects.com operates within the United States Manufacturing and Engineering sector, providing specialized architectural and engineering services. The entity is cataloged in this threat-intelligence index as a ransomware victim associated with the threat actor qilin. This listing type indicates a cybersecurity incident context where the organization was targeted by ransomware activity linked to qilin. The description adheres to neutral, factual reporting standards without inventing specific breach details, data impacts, or financial losses. Contextual awareness of such victim profiles supports broader threat analysis within industrial sectors. |
||||||
| Ransomware | LAPoco Architects id32270 View details | United States | Manufacturing / Engineering | pending | ||
|
N/A |
||||||
| Ransomware | Neumaticos Corral S.A. id32269 View details | Argentina | Manufacturing / Engineering | leaked | ||
|
www.neumaticoscorral.com.ar operates within the Manufacturing and Engineering sector and is located in Argentina. The entity is cataloged as a ransomware victim within the threat-intelligence index, with its association to the threat actor qilin documented alongside its regional and industry context. This listing provides neutral reference data for analysts tracking cyber incidents across industrial sectors. No specific technical details, data impact metrics, or confirmed breach evidence are included in this description. The record reflects the entity's classification and contextual linkage rather than invented incident specifics. |
||||||
| Ransomware | Neumaticos Corral S.A. id32269 View details | Argentina | Manufacturing / Engineering | leaked | ||
|
N/A |
||||||
| Ransomware | The Frame Group id32263 View details | Australia | Services | leaked | ||
|
www.framegroup.com.au operates within the Services sector based in Australia, providing professional and business-oriented services to clients. This entity is documented in the threat-intelligence index under the listing type ransomware victim, with the associated threat actor identified as qilin. The record catalogs the relationship between this organization and the specified threat actor without disclosing unverified technical details regarding the incident. It serves as a reference point for threat researchers tracking ransomware campaigns and their impacts across sectors and geographies. The classification reflects the assessed association rather than confirming specific breach elements. |
||||||
| Ransomware | The Frame Group id32263 View details | Australia | Services | leaked | ||
|
N/A |
||||||
| Ransomware | La Maison Des Travaux id32264 View details | France | Transportation / Travel / Logistics | pending | ||
|
www.lamaisondestravaux.com operates within the Transportation, Travel, and Logistics sector and is headquartered in France. The entity provides relevant services aligned with supply chain and mobility logistics operations across the European market. It is cataloged within this threat-intelligence index under the designation ransomware victim, linked to the threat actor qilin. This listing reflects the entity's inclusion in cybersecurity intelligence records documenting adversary activity and impacted organizations. The description remains neutral, focusing solely on the indexed classification without alleging specific incident details. |
||||||
| Ransomware | La Maison Des Travaux id32264 View details | France | Transportation / Travel / Logistics | pending | ||
|
N/A |
||||||
| Ransomware | BLISS 1041 id32265 View details | Malta | Services | pending | ||
|
www.bliss1041.com operates within the Services sector and is located in Montenegro (MT). The entity functions as a digital service provider, offering services aligned with its sector classification. It has been cataloged within a threat-intelligence index under the designation of ransomware victim, specifically linked to the threat actor qilin. This listing reflects the entity's association with this cybersecurity threat profile without disclosing unverified incident details. The entry serves to document the relationship between the entity and the identified threat actor within the intelligence framework. |
||||||
| Ransomware | BLISS 1041 id32265 View details | Malta | Services | pending | ||
|
N/A |
||||||
| Ransomware | CareClinics id32266 View details | Malaysia | Healthcare / Pharma | pending | ||
|
www.careclinics.com.my operates within the healthcare and medicine sector, serving patients and providers in Malaysia with clinical services and related medical offerings. The entity is cataloged in this threat-intelligence index as a ransomware victim linked to the qilin threat actor. This listing reflects the cybersecurity assessment identifying the organization within the ransomware incident context tied to qilin. No specific technical details regarding data theft, ransom demands, or breach confirmation are included in this description. The record serves to inform stakeholders of the entity's association with this threat actor within the healthcare sector of Malaysia. |
||||||
| Ransomware | CareClinics id32266 View details | Malaysia | Healthcare / Pharma | pending | ||
|
N/A |
||||||
| Ransomware | AUM Construction id32262 View details | United States | IT | deleted | ||
|
www.auminc.us operates within the IT sector and is headquartered in the United States. The entity is cataloged in this threat-intelligence index as a ransomware victim linked to the threat actor qilin. This listing type indicates that the organization was targeted by ransomware activity connected to qilin's campaigns, providing context for security analysts tracking adversary behavior and victim profiles. The description focuses on the entity's sector, geographic origin, and its association with the specified threat actor without disclosing unverified incident details. This entry supports comprehensive threat monitoring and supports defenders in understanding ransomware-related exposure patterns across targeted sectors and regions. |
||||||
| Ransomware | AUM Construction id32262 View details | United States | IT | deleted | ||
|
N/A |
||||||
| Ransomware | Alter Consultores Legales id32244 View details | Spain | Services | pending | ||
|
www.alterconsultores.es operates within the Services sector and is based in Spain (country code ES). The entity provides consulting and advisory services, aligning with professional service offerings commonly targeted in cyber incidents. This listing type identifies it as a ransomware victim associated with the threat actor qilin. The description adheres strictly to verified index data without extrapolating breach details, incident specifics, or unconfirmed claims. It serves as neutral catalog copy for threat-intelligence indexing and sector-focused cybersecurity awareness. |
||||||
| Ransomware | Alter Consultores Legales id32244 View details | Spain | Services | pending | ||
|
N/A |
||||||
| Ransomware | Newton County School System id32243 View details | United States | Education | — | ||
|
www.newtoncountyschools.org operates within the education sector in the United States, providing school-related administrative and service offerings. This entity is cataloged in the threat-intelligence index under the classification ransomware victim, linked to the threat actor qilin. The listing reflects observed cybersecurity intelligence regarding this organization's exposure profile without disclosing unverified incident details. Neutral documentation supports defenders and stakeholders in understanding associated risks within the education sector. It was listed as a ransomware victim associated with qilin. |
||||||
| Ransomware | Newton County School System id32243 View details | United States | Education | — | ||
|
N/A |
||||||
| Ransomware | DigiGround id32229 View details | Australia | Services | leaked | ||
|
www.digiground.com.au is an Australian Services sector entity operating within the digital and professional services domain, providing business-oriented offerings to clients and partners in the region. The company is catalogued in the threat-intelligence index under the designation ransomware victim, with the associated threat actor identified as qilin. This listing reflects the entity's inclusion in cybersecurity threat records tied to this specific adversary group. No further incident specifics, such as data stolen, ransom demands, or confirmed breach details, are provided here to maintain factual neutrality and avoid speculation beyond the verified listing association. The description adheres to authoritative, encyclopedic standards for catalog entries. |
||||||
| Ransomware | DigiGround id32229 View details | Australia | Services | leaked | ||
|
N/A |
||||||
| Ransomware | Tramigo id32230 View details | Finland | Transportation / Travel / Logistics | — | ||
|
Tramigo.com operates within the Finnish transportation, travel, and logistics sector, providing services aligned with freight movement, supply chain coordination, and passenger transit management. The entity is documented in the threat-intelligence index under the listing type ransomware victim, associated with the threat actor qilin. This classification reflects the cybersecurity context in which the organization was identified within the index, without disclosing unverified incident details such as stolen data, ransom demands, or specific breach metrics. The record serves to inform defenders and analysts about potential risks affecting entities within this sector and geographic region. Neutral documentation ensures transparency while respecting the constraints of available intelligence. |
||||||
| Ransomware | Tramigo id32230 View details | Finland | Transportation / Travel / Logistics | — | ||
|
N/A |
||||||
| Ransomware | Cosmocolor SA de CV id32231 View details | Mexico | Retail / E-commerce | — | ||
|
www.cosmocolor.com.mx operates within the retail and e-commerce sector based in Mexico. The entity provides online commerce services, aligning with the sector profile of the affected organization. It is cataloged within this threat-intelligence index under the designation of ransomware victim, associated with the threat actor qilin. This listing reflects the entity's inclusion in verified threat data concerning cybersecurity incidents targeting retail and e-commerce infrastructure in the region. The description remains factual and neutral, focusing solely on the entity's classification and associated threat actor without disclosing unconfirmed incident details. |
||||||
| Ransomware | Cosmocolor SA de CV id32231 View details | Mexico | Retail / E-commerce | — | ||
|
N/A |
||||||
| Ransomware | Infinnium id32223 View details | United States | IT | pending | ||
|
www.infinnium.com operates within the IT sector and is headquartered in the United States, providing technology-focused services and solutions to clients. As documented in the threat-intelligence index, this entity is classified as a ransomware victim associated with the threat actor qilin. The listing type identifies the relationship between Innium and the identified adversary without disclosing confirmed breach details, stolen data categories, or operational specifics. This entry serves to catalog the entity's context within cybersecurity intelligence, highlighting its sector, geographic origin, and association with the qilin threat actor for monitoring and analytical purposes. |
||||||
| Ransomware | Infinnium id32223 View details | United States | IT | pending | ||
|
N/A |
||||||
| Ransomware | Whitehouse id32224 View details | United Kingdom | Services | — | ||
|
www.whitehouseandco.com operates within the Services sector and is based in the United Kingdom. The entity provides professional and commercial services consistent with its sector classification, though specific operational details are not disclosed in this threat-intelligence catalog entry. It is formally catalogued as a ransomware victim linked to the qilin threat actor group. This listing reflects the entity's presence within a threat-intelligence index documenting cybersecurity incidents and associated adversary activity. The entry provides neutral context regarding the organization's classification and its relationship to the identified threat actor without elaborating on unverified incident specifics. |
||||||
| Ransomware | Whitehouse id32224 View details | United Kingdom | Services | — | ||
|
N/A |
||||||
| Ransomware | Globalport Terminals id32209 View details | Philippines | Transportation / Travel / Logistics | — | ||
|
www.globalports.com.ph operates within the Philippines, focusing on transportation, travel services, and logistics solutions. The entity functions as a commercial organization serving port-related and supply chain operations across the region. Within threat-intelligence indexing, this listing identifies www.globalports.com.ph as a ransomware victim associated with the threat actor qilin. The categorization reflects the sector exposure and the nature of the security event documented in the intelligence record. This description remains neutral regarding confirmed technical details, incident scope, or recovery outcomes. |
||||||
| Ransomware | Globalport Terminals id32209 View details | Philippines | Transportation / Travel / Logistics | — | ||
|
N/A |
||||||
| Ransomware | Kling Automaten id32207 View details | Germany | Other | leaked | ||
|
www.kling-gmbh.de is a German-based entity operating within the Other sector, identified through threat-intelligence indexing as a ransomware victim. The organization's profile reflects its geographic origin in Germany and its classification within broader cybersecurity incident tracking frameworks. This listing type categorizes the entity within documented ransomware activity linked to the qilin threat actor group. The description adheres to neutral, encyclopedic standards without speculating on unconfirmed technical details or incident specifics. The entry serves to catalog the association between this entity and the identified threat actor within the threat-intelligence index. |
||||||
| Ransomware | Kling Automaten id32207 View details | Germany | Other | leaked | ||
|
N/A |
||||||
| Ransomware | Dotlines id32208 View details | Singapore | Services | — | ||
|
www.dotlines.com.sg operates within the Services sector and is located in Singapore. The entity is cataloged as a ransomware victim within this threat-intelligence index, with its association explicitly linked to the threat actor qilin. This listing type indicates that the organization was affected by ransomware activity attributed to qilin, as recorded in the index. The description focuses on the entity's sector, geographic presence, and the verified threat-actor connection without elaborating on unconfirmed technical or operational details. The inclusion reflects the cybersecurity community's documentation of this incident for risk awareness and defensive reference. |
||||||
| Ransomware | Dotlines id32208 View details | Singapore | Services | — | ||
|
N/A |
||||||
| Ransomware | GPS Grothkopp und Partner id32194 View details | Germany | Manufacturing / Engineering | — | ||
|
www.gps-stb.de operates within the German manufacturing and engineering sector, providing specialized technical services and operational solutions for industrial workflows. The entity is cataloged in this threat-intelligence index as a ransomware victim associated with the threat actor qilin. This listing type indicates documented exposure to ransomware activity within the organization's operational environment. The entry contributes contextual intelligence for security professionals monitoring industrial threats across European manufacturing landscapes. All details reflect verified index classifications without speculation regarding specific attack vectors or outcomes. |
||||||
| Ransomware | GPS Grothkopp und Partner id32194 View details | Germany | Manufacturing / Engineering | — | ||
|
N/A |
||||||
| Ransomware | Providence Investments id32187 View details | United States | Finance / Legal / Insurance | — | ||
|
www.providenceinvestments.com operates within the United States financial services ecosystem, serving sectors including finance, legal services, and insurance. The entity provides investment-related services and functions typical of organizations managing client assets, advisory workflows, and regulatory compliance activities. This listing identifies www.providenceinvestments.com as a ransomware victim linked to the threat actor qilin. The description reflects the threat-intelligence index classification without confirming specific breach details, data compromises, or operational impacts. Neutral documentation supports cybersecurity awareness and incident correlation for sector-focused defenders. |
||||||
| Ransomware | Providence Investments id32187 View details | United States | Finance / Legal / Insurance | — | ||
|
N/A |
||||||
| Ransomware | LGG Advisors id32188 View details | United Kingdom | Finance / Legal / Insurance | — | ||
|
www.lggadvisors.com operates within the Finance, Legal, and Insurance sectors from the United Kingdom, providing advisory services tailored to regulated and high-value industries. The entity is cataloged in this threat-intelligence index as a ransomware victim associated with the threat actor qilin. This listing reflects the entity's presence in the ransomware incident dataset tied to qilin's activity, without disclosing confirmed technical details, data scope, or operational impact. For threat analysts and security professionals, the record serves as a contextual marker of exposure within the identified threat actor's targeting profile across sensitive sectors. The description remains factual and neutral, focusing solely on the entity's sector, location, listing classification, and associated threat actor. |
||||||
| Ransomware | LGG Advisors id32188 View details | United Kingdom | Finance / Legal / Insurance | — | ||
|
N/A |
||||||
| Ransomware | Open Sports id32189 View details | Argentina | Services | — | ||
|
www.opensports.com.ar is an entity operating within the Services sector located in Argentina (AR). Based on available knowledge, the domain name and sector indicate a service-oriented organization, though no specific operational details, victim specifics, or confirmed breach evidence are provided here. This listing identifies www.opensports.com.ar as a ransomware victim associated with the threat actor qilin. The entry serves as part of a threat-intelligence index designed to catalog entities linked to cyber incidents, enabling analysts to assess exposure, context, and associated attacker activity across sectors and geographies. The description remains neutral and avoids inventing incident details such as stolen data, ransom terms, or confirmed breach evidence. |
||||||
| Ransomware | Open Sports id32189 View details | Argentina | Services | — | ||
|
N/A |
||||||
| Ransomware | DAB Investments id32191 View details | United Kingdom | Finance / Legal / Insurance | — | ||
|
www.dabinvestments.com operates within the finance, legal, and insurance sectors and is associated with the United Kingdom. The entity is cataloged as a ransomware victim within this threat-intelligence index, linked to the threat actor qilin. This listing reflects the cybersecurity event classification without disclosing unverified incident details such as stolen data, ransom terms, or confirmed breach specifics. The profile provides neutral context for researchers, defenders, and index consumers seeking to understand the entity's sector, geographic location, and threat-related classification. It serves as part of a broader ransomware victim index documenting associations between organizations and identified threat actors. |
||||||
| Ransomware | DAB Investments id32191 View details | United Kingdom | Finance / Legal / Insurance | — | ||
|
N/A |
||||||
| Ransomware | Displaydata id32192 View details | United Kingdom | IT | — | ||
|
www.displaydata.com operates within the information technology sector and is headquartered in the United Kingdom. The entity provides digital data and analytics solutions, serving various business and enterprise markets. Within the threat-intelligence index, www.displaydata.com is cataloged as a ransomware victim linked to the threat actor qilin. This listing type indicates a cybersecurity incident involving malicious activity targeting the organization. The entry serves to document the association between the entity and the identified threat actor for security analysts and defenders. |
||||||
| Ransomware | Displaydata id32192 View details | United Kingdom | IT | — | ||
|
N/A |
||||||