Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2209 published victims and 5 known leak locations in a single intelligence view.
Overview
Qilin is tracked by Breach House as a ransomware group with 2209 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
| Leak location 2 | Onion service | Unknown | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
| Leak location 3 | Onion service | Unknown | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 4 | Onion service | Unknown | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Unknown | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (2209)
Search, filter and paginate the victim timeline for Qilin. Showing 1–100 of 2209.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Hoc id31020 View details | United Kingdom | Manufacturing / Engineering | ||
|
HOC Ltd is a company based in the United Kingdom, operating in the manufacturing and engineering sector. The company provides various services and products related to its sector. HOC Ltd was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Hoc id31020 View details | United Kingdom | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Gran valle negocios id31006 View details | Argentina | Retail / E-commerce | ||
|
Granvallenegocios.com.ar operates in the retail and e-commerce sector in Argentina, providing various products and services to its customers. As an e-commerce platform, it likely offers online shopping experiences, allowing users to browse and purchase products remotely. Granvallenegocios.com.ar was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Gran valle negocios id31006 View details | Argentina | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Groupe Fenwick id30987 View details | France | Retail / E-commerce | ||
|
Fenwick.fr is a French company operating in the retail and e-commerce sector, offering various products and services to its customers. Located in France, the company caters to the needs of its clients through its online platform. Fenwick.fr is listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Groupe Fenwick id30987 View details | France | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Savills France id30970 View details | France | Construction / Real Estate | ||
|
Savills is a global real estate company with operations in France, providing services such as property development, investment, and management. The company operates in the construction and real estate sector, offering a range of services to clients in France. Savills France was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Savills France id30970 View details | France | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | Wilbert's id30971 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Wilberts.com is a US-based company operating in the hospitality and food and beverage sector, likely providing services to the tourism industry. As a business in this sector, Wilberts.com may offer various amenities and experiences to its customers. Wilberts.com was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Wilbert's id30971 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
N/A |
|||||
| Ransomware | Contacto Garantido id30881 View details | Mexico | Retail / E-commerce | ||
|
Contactogarantido.com is a Mexican company operating in the retail and e-commerce sector, providing various online services to its customers. Based in Mexico, the company likely offers a range of products and services to cater to the local market. Contactogarantido.com was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Contacto Garantido id30881 View details | Mexico | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Universitatea de Vest „Vasile Goldiș” din Arad id30882 View details | Romania | NGOs / Associations | ||
|
UVVG RO is a Romanian non-governmental organization operating in the country. The entity is involved in various activities related to NGOs and associations in Romania. UVVG RO was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Universitatea de Vest „Vasile Goldiș” din Arad id30882 View details | Romania | NGOs / Associations | ||
|
N/A |
|||||
| Ransomware | Jubilee Jobs id30843 View details | Nigeria | NGOs / Associations | ||
|
Jubileejobs.org is a non-governmental organization based in Nigeria, focused on providing job opportunities and related services. The organization operates in the NGOs and associations sector, catering to the needs of the local community. Jubileejobs.org was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Jubilee Jobs id30843 View details | Nigeria | NGOs / Associations | ||
|
N/A |
|||||
| Ransomware | Plitvička Jezera Nacionalni Park id30844 View details | Croatia | Transportation / Travel / Logistics | ||
|
NP Plitvicka Jezera is a national park located in Croatia, known for its natural beauty and tourism offerings. As a prominent destination in the country's travel and logistics sector, it provides various services to visitors. The national park is situated in the Plitvice Lakes area, attracting numerous tourists each year. It was listed as a ransomware victim associated with Qilin. |
|||||
| Ransomware | Plitvička Jezera Nacionalni Park id30844 View details | Croatia | Transportation / Travel / Logistics | ||
|
N/A |
|||||
| Ransomware | The Myers Y Cooper id30845 View details | United States | Manufacturing / Engineering | ||
|
Cooper Co is a US-based company operating in the manufacturing and engineering sector, providing various products and services. The company is involved in the design, development, and production of engineered products. Cooper Co has a presence in the US market, serving customers across the country. It was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | The Myers Y Cooper id30845 View details | United States | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Guntert & Zimmerman id30841 View details | Switzerland | Manufacturing / Engineering | ||
|
Guntert is a company based in Switzerland, operating in the manufacturing and engineering sector. The company likely provides various products and services related to its sector. Guntert was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Guntert & Zimmerman id30841 View details | Switzerland | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Principle Diagnostics Laboratory id30842 View details | India | Healthcare / Pharma | ||
|
Principlediagnostics.com is a healthcare and pharma company based in India, offering various medical services. The company operates in the healthcare sector, providing diagnostic services. Principlediagnostics.com was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Principle Diagnostics Laboratory id30842 View details | India | Healthcare / Pharma | ||
|
N/A |
|||||
| Ransomware | GURR Abdichtungstechnik GmbH id30839 View details | Germany | Manufacturing / Engineering | ||
|
Gurr Abdichtungstechnik is a German-based company operating in the manufacturing and engineering sector, providing sealing technology solutions. The company is located in Germany and offers various products and services related to sealing technology. Gurr Abdichtungstechnik is listed as a ransomware victim associated with qilin |
|||||
| Ransomware | GURR Abdichtungstechnik GmbH id30839 View details | Germany | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | GOP id30833 View details | United Kingdom | Transportation / Travel / Logistics | ||
|
Go Ltd is a company operating in the transportation sector in Great Britain, providing logistics and travel services. The company is based in the United Kingdom and offers various services to its clients. Go Ltd was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | GOP id30833 View details | United Kingdom | Transportation / Travel / Logistics | ||
|
N/A |
|||||
| Ransomware | Stryker id30825 View details | United States | Manufacturing / Engineering | ||
|
Stryker is a leading American manufacturer of medical and surgical equipment, operating in the manufacturing and engineering sector. The company, headquartered in the US, offers a wide range of products and services. Stryker was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Stryker id30825 View details | United States | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Ejército Argentino id30820 View details | Argentina | Public Sector | ||
|
The www.argentina.gob.ar/defensa/ejercito website is the official online presence of the Argentine Army, a branch of the Argentine Armed Forces, operating under the Ministry of Defense in Argentina. The Argentine Army is responsible for land-based military operations, and its website provides information on its structure, operations, and activities. The website is part of the public sector in Argentina, offering various services and information to citizens. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Ejército Argentino id30820 View details | Argentina | Public Sector | ||
|
N/A |
|||||
| Ransomware | Kean University id30821 View details | United States | Education | ||
|
Kean University is a public university located in New Jersey, United States, offering a range of undergraduate and graduate degree programs in various fields. As an institution in the education sector, it provides academic and research opportunities to students. Kean University was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Kean University id30821 View details | United States | Education | ||
|
N/A |
|||||
| Ransomware | Highline Community College id30822 View details | United States | Education | ||
|
Highline College, located in the United States, is a public college that offers various academic programs and services to students. As an educational institution, it provides opportunities for students to pursue higher education in different fields. Highline College was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Highline Community College id30822 View details | United States | Education | ||
|
N/A |
|||||
| Ransomware | Machinerie P&W id30777 View details | Canada | Manufacturing / Engineering | ||
|
Machinerie PW is a company based in Canada, operating in the manufacturing and engineering sector. The company likely provides machinery and equipment to various industries. Machinerie PW was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Machinerie P&W id30777 View details | Canada | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | ABM Enviro id30778 View details | Canada | Services | ||
|
ABM Environnement, a services company based in Canada, provides environmental solutions. The company operates in the services sector, offering various services to its clients. ABM Environnement was listed as a ransomware victim associated with Qilin. |
|||||
| Ransomware | ABM Enviro id30778 View details | Canada | Services | ||
|
N/A |
|||||
| Ransomware | WellPerf id30771 View details | United Kingdom | Healthcare / Pharma | ||
|
Wellperf is a UK-based company operating in the healthcare and pharmaceutical sector, providing various services and offerings. The company is likely involved in the development, distribution, or research of pharmaceutical products. Wellperf was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | WellPerf id30771 View details | United Kingdom | Healthcare / Pharma | ||
|
N/A |
|||||
| Ransomware | Corporate 360 Business Solutions id30766 View details | Canada | IT | ||
|
Corporate360.ca is a Canadian company operating in the IT sector, providing various services to its clients. As an IT company, Corporate360.ca likely offers a range of services including software development, consulting, and technology solutions. Corporate360.ca was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Corporate 360 Business Solutions id30766 View details | Canada | IT | ||
|
N/A |
|||||
| Ransomware | Assos Pharmaceuticals id30767 View details | Türkiye | Healthcare / Pharma | ||
|
Assos Pharma is a Turkish company operating in the healthcare and pharmaceutical sector, providing various products and services. The company is based in Turkey and serves the local market with its offerings. Assos Pharma was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Assos Pharmaceuticals id30767 View details | Türkiye | Healthcare / Pharma | ||
|
N/A |
|||||
| Ransomware | Cano Industrial id30768 View details | Mexico | Manufacturing / Engineering | ||
|
Cano Industrial is a company based in Mexico, operating in the manufacturing and engineering sector, providing various industrial services and products. The company's offerings cater to the needs of its clients in the region. Cano Industrial was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Cano Industrial id30768 View details | Mexico | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Triton Trading id30769 View details | Peru | Manufacturing / Engineering | ||
|
Triton Peru, located in Peru, operates in the manufacturing and engineering sector, providing various services and products. The company is involved in the production and distribution of goods, serving as a key player in the Peruvian industry. www.triton.com.pe was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Triton Trading id30769 View details | Peru | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | AppleOne Properties id30770 View details | Philippines | Manufacturing / Engineering | ||
|
API.com.ph is a Philippine-based company operating in the manufacturing and engineering sector, providing various services to its clients. The company is involved in different aspects of manufacturing and engineering, catering to the needs of its customers in the Philippines. API.com.ph was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | AppleOne Properties id30770 View details | Philippines | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Sunway Berhad id30762 View details | Malaysia | Construction / Real Estate | ||
|
Sunway is a prominent construction and real estate company based in Malaysia, offering a range of services including property development, construction, and hospitality. The company operates in various sectors, providing innovative solutions to meet the needs of its customers. Sunway was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Sunway Berhad id30762 View details | Malaysia | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | P & A Construction id30758 View details | United States | Construction / Real Estate | ||
|
Paconst is a construction and real estate company based in the United States, providing various services to the sector. The company operates within the construction industry, offering services related to construction and real estate development. Paconst was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | P & A Construction id30758 View details | United States | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | Primeline Logistics id30750 View details | Ireland | Transportation / Travel / Logistics | ||
|
Primeline ie is an Irish company operating in the transportation travel and logistics sector. The company provides various services to its clients in Ireland. Primeline ie was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Primeline Logistics id30750 View details | Ireland | Transportation / Travel / Logistics | ||
|
N/A |
|||||
| Ransomware | Recsa id30751 View details | Costa Rica | Manufacturing / Engineering | ||
|
RECSA is a company based in Costa Rica, operating in the manufacturing and engineering sector. The company likely provides various products and services related to its sector, although specific details are not available. RECSA was listed as a ransomware victim associated with Qilin. |
|||||
| Ransomware | Recsa id30751 View details | Costa Rica | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Salida Union School District id30752 View details | United States | Education | ||
|
The Salida Union Elementary School District, located in the United States, serves the educational needs of students in the area, providing various academic programs and services. As an educational institution, it plays a vital role in the community, offering a range of curriculum and extracurricular activities. The district is part of the larger California education system, adhering to state and federal guidelines. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Salida Union School District id30752 View details | United States | Education | ||
|
N/A |
|||||
| Ransomware | Cpcg id30754 View details | Brazil | Construction / Real Estate | ||
|
CPCGR is a company operating in the construction and real estate sector in Brazil. The company likely provides services related to construction, property development, and real estate management. CPCGR was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Cpcg id30754 View details | Brazil | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | EFU Life Assurance id30755 View details | Pakistan | Healthcare / Pharma | ||
|
Efulife operates in the healthcare and pharmaceutical sector in Pakistan, providing various services and offerings to its customers. As a key player in the country's healthcare industry, Efulife is committed to delivering quality products and services. Efulife was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | EFU Life Assurance id30755 View details | Pakistan | Healthcare / Pharma | ||
|
N/A |
|||||
| Ransomware | Infina Health id30756 View details | United States | Healthcare / Medicine | ||
|
Infina Health is a US-based company operating in the healthcare sector, providing medical services and solutions. The company is focused on delivering innovative healthcare technologies to improve patient outcomes. Infina Health was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Infina Health id30756 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Evergreen Title id30738 View details | United States | Finance / Legal / Insurance | ||
|
Evergreen Title Company is a US-based title insurance company operating in the finance and legal sector, providing title insurance and escrow services to clients. As a key player in the US title insurance market, the company facilitates real estate transactions and ensures property ownership legitimacy. Evergreen Title Company was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Evergreen Title id30738 View details | United States | Finance / Legal / Insurance | ||
|
N/A |
|||||
| Ransomware | RehaVital Gesundheitsservice GmbH id30731 View details | Germany | Healthcare / Medicine | ||
|
Rehavital.de is a healthcare services provider based in Germany, offering medical services to patients. As a part of the healthcare sector in Germany, Rehavital.de plays a crucial role in providing medical care. Rehavital.de was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | RehaVital Gesundheitsservice GmbH id30731 View details | Germany | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Postres Reina id30719 View details | Spain | Hospitality / Food & Beverage / Tourism | ||
|
Postres Reina is a Spanish company operating in the hospitality and food and beverage sector, specifically in the production and distribution of pastries and other sweet treats. Located in Spain, the company caters to the tourism industry, providing its offerings to various establishments. Postres Reina was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Postres Reina id30719 View details | Spain | Hospitality / Food & Beverage / Tourism | ||
|
N/A |
|||||
| Ransomware | Bolt & Nut Manufacturing id30695 View details | United Kingdom | Manufacturing / Engineering | ||
|
BNML operates in the manufacturing and engineering sector, providing services in the United Kingdom. The company is involved in various engineering activities. BNML was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Bolt & Nut Manufacturing id30695 View details | United Kingdom | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | PP+K id30686 View details | Brazil | Education | ||
|
Uniteppk operates in the education sector in Brazil, providing educational services and resources. As an educational institution, it plays a crucial role in the country's education system. Uniteppk was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | PP+K id30686 View details | Brazil | Education | ||
|
N/A |
|||||
| Ransomware | Eana id30687 View details | Argentina | Other | ||
|
Eana is an entity based in Argentina, operating in the other sector. The company provides various offerings, but specific details about its services are not publicly available. Eana was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Eana id30687 View details | Argentina | Other | ||
|
N/A |
|||||
| Ransomware | Synergy Products id30688 View details | Türkiye | Healthcare / Medicine | ||
|
Synergy TRT is a company operating in the healthcare and medicine sector in Turkey, providing various services to its clients. The company's offerings cater to the needs of the healthcare industry, focusing on medical solutions. Synergy TRT was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Synergy Products id30688 View details | Türkiye | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Don Tortaco Mexican Grill id30683 View details | United States | Retail / E-commerce | ||
|
Dontortaco.com operates in the retail and e-commerce sector in the United States, offering various products and services to its customers. As an e-commerce company, it provides online shopping experiences, likely including food and beverage items. Dontortaco.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Don Tortaco Mexican Grill id30683 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Associated Theatrical Contractors id30684 View details | United States | Construction / Real Estate | ||
|
Associated Theatrical is a company operating in the construction and real estate sector in the United States. The company's offerings are likely related to theatrical services, given its name. However, specific details about its operations are not readily available. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Associated Theatrical Contractors id30684 View details | United States | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | City Ambulance Service id30670 View details | United States | Healthcare / Medicine | ||
|
Cityambu is a US-based healthcare and medicine entity. It provides medical services and support. Cityambu was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | City Ambulance Service id30670 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Famesa id30671 View details | Peru | Manufacturing / Engineering | ||
|
Famesa is a Peruvian company operating in the manufacturing and engineering sector. The company is involved in various industrial activities, providing products and services to its customers. Famesa was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Famesa id30671 View details | Peru | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Heartland Catfish id30664 View details | United States | Agriculture / Food | ||
|
Heartland Catfish is an American company operating in the agriculture and food sector, specifically in catfish farming. The company is based in the United States and is involved in the production and distribution of catfish products. Heartland Catfish was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Heartland Catfish id30664 View details | United States | Agriculture / Food | ||
|
N/A |
|||||
| Ransomware | Salina Supply id30665 View details | United States | Retail / E-commerce | ||
|
Salinasupply is a retail e-commerce company based in the United States, offering various products to customers online. As an e-commerce platform, it provides a range of goods, catering to different customer needs. Salinasupply was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Salina Supply id30665 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | St Martha Catholic Church id30666 View details | United States | Healthcare / Medicine | ||
|
St. Martha's is a healthcare organization based in the United States, providing medical services to patients. As a healthcare provider, it offers various medical treatments and care options. Stmartha.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | St Martha Catholic Church id30666 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | The Nueva School id30667 View details | United States | Education | ||
|
Nueva School is a private school in the United States, specifically in the San Francisco Bay Area of California, offering education to students. The school provides a range of academic programs and extracurricular activities. Nueva School operates in the education sector, serving the local community. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | The Nueva School id30667 View details | United States | Education | ||
|
N/A |
|||||
| Ransomware | Sicc id30661 View details | Italy | Manufacturing / Engineering | ||
|
Sicc-srl.com is an Italian company operating in the manufacturing and engineering sector, providing various services and products to its clients. The company is based in Italy and focuses on delivering high-quality solutions to its customers. Sicc-srl.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Sicc id30661 View details | Italy | Manufacturing / Engineering | ||
|
N/A |
|||||