Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2594 published victims and 5 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Qilin is tracked by Breach House as a ransomware group with 2594 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
2306
- Leaked 130 5.6%
- Pending 2167 94.0%
- Deleted 9 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Up checked 5h ago | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Down checked 5h ago | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
| Leak location 4 | Onion service | Down checked 5h ago | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 1 | Onion service | Down checked 5h ago | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
| Leak location 2 | Onion service | Down checked 5h ago | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
Top Activity Sectors (18)
- Not identified 500
- Communication / Marketing 271
- Services 210
- Manufacturing / Engineering 205
- Finance / Legal / Insurance 172
- Construction / Real Estate 159
- Healthcare / Pharma 139
- IT 125
- Retail / E-commerce 90
- Education 73
- Public Sector 68
- Transportation / Travel / Logistics 57
- Energy 53
- Hospitality / Food & Beverage / Tourism 46
- Agriculture / Food 41
- Telecommunications 28
- NGOs / Associations 23
- Sports 1
Typical Attacks (52)
▼How Qilin typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Qilin.
-
T1190 Exploit Public-Facing Application Initial Access
What they do: Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.
What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
-
T1566.001 Spearphishing Attachment Initial Access
What they do: Qilin has been delivered to victims through malicious email attachments.
What that means: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
-
T1566.002 Spearphishing Link Initial Access
What they do: Qilin has been delivered via malicious links in spearphishing emails.
What that means: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
-
T1047 Windows Management Instrumentation Execution
What they do: Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
What they do: Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution.
What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
-
T1059.001 PowerShell Execution
What they do: Qilin has been deployed on VMware vCenter and ESXi servers via custom PowerShell script.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1059.003 Windows Command Shell Execution
What they do: Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1204.001 Malicious Link Execution
What they do: Qilin has been executed by luring victims into clicking links in spearphishing emails.
What that means: An adversary may rely upon a user clicking a malicious link in order to gain execution.
-
T1204.002 Malicious File Execution
What they do: Qilin has been delivered to victims through spearphishing emails with malicious attachments.
What that means: An adversary may rely upon a user opening a malicious file in order to gain execution.
-
What they do: Qilin can make Registry modifications to share networked drives between elevated and non-elevated processes and to increase the number of outstanding network requests per client.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
What they do: Qilin can configure a Winlogon registry entry.
What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
-
What they do: Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.
What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.
-
What they do: Qilin can use an embedded Mimikatz module for token manipulation.
What that means: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
-
What they do: Qilin has pushed a scheduled task via a Group Policy Object for payload execution.
What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
-
T1548.002 Bypass User Account Control Privilege Escalation
What they do: Qilin can bypass standard user access controls by using stolen tokens to launch processes at an elevated security context.
What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1036.004 Masquerade Task or Service Stealth
What they do: Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.
What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1070.004 File Deletion Stealth
What they do: Qilin can delete itself from infected hosts after execution.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1480 Execution Guardrails Stealth
What they do: Qilin can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1480.002 Mutual Exclusion Stealth
What they do: Qilin can create a mutex to ensure only one instance is running.
What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
-
T1678 Delay Execution Stealth
What they do: Qilin has the ability to delay execution.
What that means: Adversaries may employ various time-based methods to evade detection and analysis.
-
T1222 File and Directory Permissions Modification Defense Impairment
What they do: Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.
What that means: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Qilin can terminate antivirus-related processes and services.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1685.005 Clear Windows Event Logs Defense Impairment
What they do: Qilin has the ability to clear Windows Event Logs.
What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
-
T1688 Safe Mode Boot Defense Impairment
What they do: Qilin can reboot targeted systems in safe mode to avoid detection.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1003.001 LSASS Memory Credential Access
What they do: Qilin can employ an embedded Mimikatz module to dump LSASS memory.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1007 System Service Discovery Discovery
What they do: Qilin can identify specific services for termination or to be left running at execution.
What that means: Adversaries may try to gather information about registered local system services.
-
T1012 Query Registry Discovery
What they do: Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.
What that means: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
-
T1016 System Network Configuration Discovery Discovery
What they do: Qilin can accept a command line argument identifying specific IPs.
What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
-
T1018 Remote System Discovery Discovery
What they do: Qilin can enumerate domain-connected hosts during its discovery phase.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1057 Process Discovery Discovery
What they do: Qilin can define specific processes to be terminated or left alone at execution.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1069.002 Domain Groups Discovery
What they do: Qilin can run PowerShell cmdlets to discover domain groups.
What that means: Adversaries may attempt to find domain-level groups and permission settings.
-
T1082 System Information Discovery Discovery
What they do: Qilin can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: Qilin can exclude specific directories and files from encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1087.001 Local Account Discovery
What they do: Qilin can list all local users found on a targeted system.
What that means: Adversaries may attempt to get a listing of local system accounts.
-
T1087.002 Domain Account Discovery
What they do: Qilin can use PowerShell cmdlets to enumerate domain users.
What that means: Adversaries may attempt to get a listing of domain accounts.
-
T1135 Network Share Discovery Discovery
What they do: Qilin has the ability to list network drives.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1673 Virtual Machine Discovery Discovery
What they do: Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.
What that means: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.
-
T1680 Local Storage Discovery Discovery
What they do: Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1021.004 SSH Lateral Movement
What they do: Qilin can enable SSH access on ESXi hosts.
What that means: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).
-
T1570 Lateral Tool Transfer Lateral Movement
What they do: Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.
What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
-
T1071.002 File Transfer Protocols Command and Control
What they do: Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.
What that means: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
-
T1219.002 Remote Desktop Software Command and Control
What they do: Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.
What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
-
T1486 Data Encrypted for Impact Impact
What they do: Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Qilin can terminate specific services on compromised hosts.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
-
T1529 System Shutdown/Reboot Impact
What they do: Qilin can initiate a reboot of the backup server to hinder recovery.
What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Tools Observed (27)
▼Software Qilin has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
Mimikatz
Defense evasion
EDRSandBlast
PCHunter
PowerTool
Toshiba power management driver (BYOVD)
Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
YDArk
Zemana Anti-Rootkit driver
Discovery
Nmap
Nping
Discovery & enumeration
Nmap
Nping
Exfiltration
EasyUpload.io
EasyUpload
LOLBAS (living-off-the-land binaries)
fsutil
PsExec
WinRM
Networking & tunnelling
Proxychains
OffSec
Cobalt Strike
Evilginx
NetExec
Offensive security tooling
Cobalt Strike
Evilginx
NetExec
RMM Tools
ScreenConnect
Remote monitoring & management
NetSupport
ScreenConnect
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README-RECOVER-[rand]_2.txt
-- Qilin We have 3.4TB of your data stored on our servers. Contact us or we will publish this data on our blog, in the media and pass it on to the relevant authorities. We are ready to offer you a discount in case of payment within a week. Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: 2ir53sQQAU Domain: [snip] login: [snip] password:[snip]
README-RECOVER-[rand].txt
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: [snip] Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion login: [snip] password:[snip]
DtMXQFOCos-RECOVER-README.txt
-- Agenda
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from you system/network
If you refuse to communicate with us and we do not come to an agreementyour data will be published.
Data includes:
- Employees personal dataCVsDLSSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients databillsbudgetsannual reportsbank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials
-- Credentials
Extension: DtMXQFOCos
Domain: wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion
login: [snip]
password: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (2594)
Search, filter and paginate the victim timeline for Qilin. Showing 1601–1700 of 2594.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | echolakefoods.com id23471 View details | United States | Agriculture / Food | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Altimedia id23470 View details | Korea, Republic of | Communication / Marketing | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Enessance Holdings Co., Ltd id23469 View details | Japan | Services | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Malibu Boats Australia id23468 View details | Australia | Other | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Lorber, Greenfield & Polito, LLP id23450 View details | United States | Finance / Legal / Insurance | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Microbix Biosystems id23434 View details | Canada | Services | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Productive Tool Products id23426 View details | United States | Communication / Marketing | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | MedImpact Healthcare id23409 View details | United States | Healthcare / Pharma | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Double Oak Construction id23403 View details | United States | Construction / Real Estate | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Mainetti UK - Data breach id23400 View details | United Kingdom | Other | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Micke Stridh Maskin id23399 View details | Sweden | Other | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Henrietta Ezeoke Law Firm id23398 View details | Nigeria | Finance / Legal / Insurance | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Izaki Group Investments id23397 View details | Israel | Finance / Legal / Insurance | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Domy id23395 View details | Japan | Other | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Malgor id23365 View details | Puerto Rico | Communication / Marketing | pending | ||
|
Founded in 1926 in San Juan, Puerto Rico, Malgor & Co., Inc. is a leader in supplying proprietary lines of food and miscellaneous items, as well as recognized brands through special distribution agreements. They serve a diverse clientele that ... |
||||||
| Ransomware | InfraCom Group id23351 View details | Sweden | Communication / Marketing | pending | ||
|
InfraCom Group AB (publ) is a leading player in IT infrastructure, offering services like mobile and fixed telephony, cloud PBX, fiber internet, server hosting, and web platforms since 1999. The company serves approximately 20,000 clients, pr ... |
||||||
| Ransomware | South Alabama Regional Planning Commission id23349 View details | United States | Communication / Marketing | pending | ||
|
SARPC is a locally controlled and organized instrument of local government in Southwestern Alabama, serving Mobile, Baldwin, and Escambia counties, along with twenty-nine municipalities. The organization provides programs and services focused ... |
||||||
| Ransomware | Essential Cabinetry Group id23345 View details | United States | Communication / Marketing | pending | ||
|
Simpsonville, SC-based Essential Cabinetry is a manufacturer of custom, semi-custom and stock-plus kitchen and bathroom cabinetry that is sold primarily through the dealer channel. Through its three market-leading brands (Tedd Wood Fine Cabin ... |
||||||
| Ransomware | City of Sugar Land id23342 View details | United States | Public Sector | pending | ||
|
Founded as a sugar plantation in the early mid-20th century and incorporated in 1959, Sugar Land is a city in the state of Texas, in the United States. The city is within the Houston, The Woodlands and Sugar Land metropolitan area and Fort Be ... |
||||||
| Ransomware | Zacho-Lind id23341 View details | Denmark | Construction / Real Estate | pending | ||
|
Zacho-Lind A/S is a construction company based in Copenhagen with over 85 years of experience, specializing in infrastructure, concrete, and utility services. The company undertakes projects for both public and private clients, focusing on ar ... |
||||||
| Ransomware | Kaufman & Stigger id23340 View details | United States | Finance / Legal / Insurance | pending | ||
|
When you call Kaufman & Stigger, PLLC Injury Lawyers, you will talk to a team with decades of experience helping people injured after an accident. Our Louisville-based law firm is focused exclusively on providing counsel to injured clients th ... |
||||||
| Ransomware | Omrin id23339 View details | Netherlands | Services | pending | ||
|
Omrin is a leading waste management company in the Netherlands, dedicated to creating a clean and sustainable world. They provide a range of services including waste collection for over 1.6 million residents and 10,000 businesses, as well as ... |
||||||
| Ransomware | Doha British School id23328 View details | Qatar | Education | pending | ||
|
Doha British School, Qatar - is one of the leading British international schools in Qatar, operating in the country since 1997. After 28 years, DBS has grown into a group of three outstanding campuses offering the English National Curriculum ... |
||||||
| Ransomware | ClearCare Periodontal & Implant Centre id23321 View details | Canada | Other | pending | ||
|
The ClearCare Periodontal & Implant Centre was attacked on 13 of October 2025. At the time of the attack, critical data on customers and their employees was uploaded. The company was informed of the colossal data leak, but ignored demands to ... |
||||||
| Ransomware | IREM companies id23318 View details | United States | Construction / Real Estate | pending | ||
|
IREM companies, USA - is an international institute for real estate and asset managers, promoting management through education and information exchange. IREM conducts real estate management training courses, organizes national meetings of rea ... |
||||||
| Ransomware | Gericke AG id23315 View details | Switzerland | Communication / Marketing | pending | ||
|
The Swiss Gericke Group has been designing and manufacturing equipment and systems for modern bulk material processes, as well as providing design and consultation services, for more than 125 years. Gericke bulk materials processing technolog ... |
||||||
| Ransomware | NurseSpring id23297 View details | United States | Communication / Marketing | pending | ||
|
NurseSpring specializes in home health care, health care staffing, and nurse recruitment services. They prioritize compassion, dignity, and respect while delivering care, ensuring clients receive the right care at the right time. Their intend ... |
||||||
| Ransomware | Integral Networks id23296 View details | United States | Telecommunications | pending | ||
|
Integral Networks, Inc. is a leading IT services provider in Sacramento, specializing in responsive IT support tailored to the needs of legal firms and various other industries including construction, manufacturing, and finance. They offer a ... |
||||||
| Ransomware | Signet Armorlite, Inc. id23295 View details | United States | Communication / Marketing | pending | ||
|
Founded in 1947, Signet Armorlite, Inc., an optical company, designs and manufactures glass ophthalmic lenses and molds. It also distributes lenses worldwide and adhesive optical supply products in the United States. Signet Armorlite is headq ... |
||||||
| Ransomware | All Truck Transportation id23294 View details | United States | Transportation / Travel / Logistics | pending | ||
|
All Truck Transportation Co., Inc. is an asset-based carrier offering local and regional truckload transportation solutions. We are headquartered in Chicago, Illinois with a vast network of terminals throughout the Midwest. We operate within ... |
||||||
| Ransomware | Grupo Promasa id23293 View details | Mexico | Communication / Marketing | pending | ||
|
Grupo Promasa is a company that operates in the Building Materials industry. It employs 250to499 people and has 10Mto25M of revenue. The company is headquartered in San Pedro Sula, Cortes, Honduras. The amount of downloaded data is unknown at ... |
||||||
| Ransomware | KHL Printing id23292 View details | Singapore | Communication / Marketing | pending | ||
|
KHL Printing, Singapore - one of the largest printing companies in Southeast Asia with the most comprehensive range of services. KHL Printing offers end-to-end solutions from conceptualization to delivery of print products and other platform ... |
||||||
| Ransomware | Real Estate Specialists id23291 View details | United States | Construction / Real Estate | pending | ||
|
Real Estate Specialists is dedicated to managing and maintaining rental properties in southeast Wisconsin, focusing on enhancing their performance since 1982. They offer a comprehensive range of property management services, catering to prope ... |
||||||
| Ransomware | Samera Health id23290 View details | United States | Healthcare / Pharma | pending | ||
|
Samera Health is a Third Party Administrator (TPA) that provides Health, Dental, and Vision benefits for employer groups. The company focuses on delivering innovative and cost-saving solutions while ensuring a positive customer experience thr ... |
||||||
| Ransomware | CHDFS id23289 View details | United States | Services | pending | ||
|
CHDFS Inc is dedicated to providing social services and support for individuals, families, and communities in need. They offer a range of programs including OPWDD, OMH, Early Intervention, and Health Home Care Management. Their mission focuse ... |
||||||
| Ransomware | More Than Gourmet id23286 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
More Than Gourmet, USA - is a food company based on classic French culinary traditions. MTG products are used in gourmet restaurants, resorts and sold in specialty gourmet food stores. Privately held since 1993, MTG has been financially soun ... |
||||||
| Ransomware | Magna Hospitality Group id23284 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Magna Hospitality Group, USA - a private equity firm dedicated to the investment, development and management of hotel properties. Magna employs more than 100 professionals specializing in all areas including investment, finance, legal, hotel ... |
||||||
| Ransomware | KIS Asset Evaluation id23282 View details | United States | Finance / Legal / Insurance | pending | ||
|
KIS Asset Evaluation, Korea - company operating in the financial market, strives to become the No. 1 company in the field of financial asset valuation. KIS Pricing offers a wide range of services and solutions required in the financial indust ... |
||||||
| Ransomware | Applied Technology Resources id23280 View details | United States | IT | pending | ||
|
Applied Technology Resources, Inc. is an international leader in Title Search Exams throughout the United States, offering unmatched accuracy and turnaround times through their proprietary information system. The company specializes in custom ... |
||||||
| Ransomware | Northern Light Technologies id23279 View details | Canada | IT | pending | ||
|
Founded in 1984, Northern Light Technologies (NLT) designs and manufactures underground lighting and networking solutions for the mining and tunnelling industries with manufacturing/assembly locations in Canada, Australia and Chile. Northern ... |
||||||
| Ransomware | Tri City Foods id23273 View details | United States | Agriculture / Food | pending | ||
|
Founded in 2003 and headquartered in Downers Grove, Illinois, Tri City Foods is a franchisee of the Burger King restaurant chain. The company owns and operates locations in and around Chicago, Illinois. A group of companies was attacked: lmc ... |
||||||
| Ransomware | JA Jennings id23218 View details | United Kingdom | Construction / Real Estate | pending | ||
|
Founded in 1917, J.A. Jennings is a mid-size full-service construction company which constructs private sector commercial interiors projects as well as full-scale building renovations and infrastructure programs throughout the New York City m ... |
||||||
| Ransomware | BIOPHARMEX, SA de CV id23217 View details | Mexico | Communication / Marketing | pending | ||
|
BIOPHARMEX specializes in transforming scientific innovations into health solutions, providing over 30 medical products in Mexico from 10 different countries. The company serves more than 2,000 physicians who use and prescribe their products ... |
||||||
| Ransomware | Stephenson's Rental Services id23216 View details | Canada | Services | pending | ||
|
Stephenson's Rental Services is a Canadian construction equipment and tool rental company that has been operating for over 70 years. The company provides a wide range of rentals, including construction equipment, scaffolding, and small tools, ... |
||||||
| Ransomware | London Women's Clinic id23215 View details | United Kingdom | Healthcare / Pharma | pending | ||
|
London Women's Clinic is a leading fertility clinic established in 1985, offering a wide range of fertility treatments and services across fourteen locations in the UK. Their offerings include IVF, ICSI, IUI, egg donation, and surrogacy, cate ... |
||||||
| Ransomware | Scales Sales & Service id23214 View details | United States | Retail / E-commerce | pending | ||
|
Scales Sales & Service LLC was originally founded in 2004 in Omaha, Nebraska. A full-service scale company with locations in Greeley, CO, Colorado Springs, CO, Denver, CO, Omaha, NE, Kearney, NE, Scottsbluff, NE and Atlantic, IA, in addition ... |
||||||
| Ransomware | Laloma id23213 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
La Loma Tamales is a Mexican restaurant chain in the Minneapolis-St. Paul area known for its traditional, handmade tamales made from fresh ingredients, including a unique process of cooking and grinding their own corn. They offer both savory ... |
||||||
| Ransomware | Khatami Law id23212 View details | United States | Finance / Legal / Insurance | pending | ||
|
Hoss Law is a law firm specializing in personal injury and family law services, dedicated to helping clients in Sacramento and surrounding areas. They focus on maximizing compensation for accident victims and offer a no-win, no-fee guarantee, ... |
||||||
| Ransomware | SANgel id23211 View details | Gabon | Communication / Marketing | pending | ||
|
SANgel est une entreprise gabonaise de production et de distribution alimentaire basée à Libreville, dans la province de l'Estuaire. Fondée en 1994, l'entreprise est spécialisée dans les produits surgelés, qu'elle importe, transforme et ... |
||||||
| Ransomware | Kudela & Weinheimer id23210 View details | United States | Construction / Real Estate | pending | ||
|
KW Landscape Architects is a landscape architecture firm that specializes in creating exceptional built environments by balancing innovation with functionality. With over 30 years of experience, they offer services across various markets incl ... |
||||||
| Ransomware | Distribuciones Camba id23209 View details | Spain | Hospitality / Food & Beverage / Tourism | pending | ||
|
Distribuciones Camba is a wholesale distributor of snacks and candies throughout Galicia. They offer a wide range of products including beverages, chocolates, gummies, and toys, catering primarily to the hospitality sector. Their distribution ... |
||||||
| Ransomware | Klima-Therm id23208 View details | Poland | Services | pending | ||
|
The Company provides innovative air-conditioning, ventilation, cooling and heating solutions and is rapidly growing its business in the Renewable Energy Sources (RES) segment. The flagship brands distributed by Klima-Therm include: Fujitsu, K ... |
||||||
| Ransomware | The Blood and Marrow Transplant Group of Georgia id23207 View details | United States | Healthcare / Pharma | pending | ||
|
The Blood and Marrow Transplant Group of Georgia (BMTGA) specializes in providing advanced care for patients undergoing blood and marrow stem cell transplantation, acute leukemia treatment, and CAR T-cell immunotherapy. They are recognized fo ... |
||||||
| Ransomware | Platinum Wines & Spirits id23206 View details | Singapore | Other | pending | ||
|
Platinum is one of the leading wines and spirits distributors in Singapore, having been in the industry for over a decade. Being the appointed wholesaler for many major wines and spirits companies like Beam Suntory Asia, Bacardi-Martini Singa ... |
||||||
| Ransomware | Sports Medicine and Orthopaedics id23205 View details | United States | Healthcare / Pharma | pending | ||
|
Sports Medicine and Orthopedics is committed to providing excellent patient care and education to orthopedic patients across Rhode Island, Massachusetts, and Connecticut. Led by Dr. Jack Goldstein, a Fellowship Trained Orthopaedic specialist, ... |
||||||
| Ransomware | Winholt Equipment Group id23204 View details | United States | Agriculture / Food | pending | ||
|
Winholt Equipment Group, founded in 1946 and headquartered in Woodbury, New York, is a manufacturer of food service, food handling, and material handling equipment. As a multiple-facilities manufacturer, we have the resources to quickly reac ... |
||||||
| Ransomware | All Weather Architectural Aluminum id23203 View details | United States | Communication / Marketing | pending | ||
|
All Weather Architectural Aluminum specializes in custom windows and doors, providing innovative solutions for both residential and commercial projects. Their extensive range includes sliding, folding, and pivot designs, catering to the uniqu ... |
||||||
| Ransomware | Wassa, SRO id23202 View details | Czechia | Communication / Marketing | pending | ||
|
In 2012, we established a sheltered workshop and we provide more than 100 protected work positions and offer new and new jobs. We can offer so called facultative compensation to our customers and reduce the penalties given by the law for not ... |
||||||
| Ransomware | SIGN Fracture Care International id23201 View details | United States | Education | pending | ||
|
SIGN Fracture Care International is a humanitarian organization dedicated to creating equality in fracture care globally by building sustainable orthopedic capacity in developing countries. They provide education to surgeons and donate the ne ... |
||||||
| Ransomware | Indian Spring Country Club id23200 View details | United States | Communication / Marketing | pending | ||
|
Located in beautiful Boynton Beach, Florida, Indian Spring Country Club is a gated, private country club that has the total package ...championship golf, tennis, fitness, casual and formal dining. The Indian Spring Country Club experience is ... |
||||||
| Ransomware | Grande Prairie Public Library id23199 View details | United States | Communication / Marketing | pending | ||
|
The Grande Prairie Public Library District is located at 3479 West 183rd Street, in Hazel Crest, Illinois. We serve the communities of Hazel Crest and Country Club Hills. We provide service to all residents living within our district boundari ... |
||||||
| Ransomware | BARCO Rent-A-Truck id23198 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Barco Rent-A-Truck is a leading provider of corporate 4x4 pickup truck rentals in the United States, offering a comprehensive fleet of brand new trucks, including 1/2, 3/4, and 1-ton models. Their services cater to a wide range of clients, fr ... |
||||||
| Ransomware | Octomeca OY id23197 View details | Finland | Communication / Marketing | pending | ||
|
Octomeca Oy specializes in load protection solutions for transportation and warehousing, offering a range of stretch film wrapping machines designed to meet demanding packaging challenges. Their products include various series of wrapping mac ... |
||||||
| Ransomware | Gas Generator Solutions id23196 View details | United Kingdom | Energy | pending | ||
|
Gas Generator Solutions (GGS) is a privately owned, independent organization established to provide Lab Managers with single point of contact for the Servicing and Repair of ANY Laboratory Gas Generator within their facility, independent of b ... |
||||||
| Ransomware | Cellini Design Center id23195 View details | Singapore | Retail / E-commerce | pending | ||
|
Cellini is a Singapore-based online furniture shop offering a wide selection of designer home furniture that embodies comfort, luxury, and quality. The company specializes in various furniture categories, including living room, dining room, a ... |
||||||
| Ransomware | Stowaway Storage id23194 View details | United States | Communication / Marketing | pending | ||
|
Opened in the fall of 1998, Stowaway Storage has long been part of the North Haven community. The business has always been family owned and operated since it's beginning. Owner Raymond V Iannucci started the company on land previously utilize ... |
||||||
| Ransomware | Long Island Weight Loss Institute id23192 View details | United States | Healthcare / Pharma | pending | ||
|
Long Island Weight Loss Institute is a medical weight loss clinic that offers physician-supervised weight loss programs designed to treat the whole person. The clinic provides individualized support tailored to each patient's unique needs wit ... |
||||||
| Ransomware | pandarose.ca id23155 View details | Canada | IT | pending | ||
|
A full range of technology consulting services—from infrastructure and specialized software to digital strategy and support. 1.This is a Non-Disclosure Agreement (NDA) between Fuels Inc. (the client) and Panda Rose Consulting Studios Inc. ... |
||||||
| Ransomware | montship.ca id23154 View details | Canada | Communication / Marketing | pending | ||
|
Montship is Canada's largest shipping agency, providing comprehensive agency services for liner vessels and ports across the country. 1.The document is an internal financial report of Trealship Services Inc. (TSI), prepared by the Allied Mar ... |
||||||
| Ransomware | dalton.com id23153 View details | United States | Healthcare / Pharma | pending | ||
|
Founded in 1986, Dalton Pharma Services is a contract pharmaceutical company providing a full range of development and manufacturing services to pharmaceutical and research companies worldwide. 1.The document is a bank statement from MUFG Ba ... |
||||||
| Ransomware | bmcinnovation.com id23152 View details | United States | Communication / Marketing | pending | ||
|
BMC Strategic Innovation is a company specializing in strategic marketing that collaborates with partners to develop unique solutions to complex problems. They use a modular approach to tailor their services to individual client needs, drawin ... |
||||||
| Ransomware | gslong.com id23151 View details | United States | Agriculture / Food | pending | ||
|
GS Long provides specialized services in plant nutrition, plant protection, and field consulting for the agricultural industry. The company specializes in developing customized solutions to increase crop yields and safety. Committed to buil ... |
||||||
| Ransomware | arpis.com id23150 View details | United States | Communication / Marketing | pending | ||
|
For fifty years, Arpi's has maintained this traditional approach to providing the highest quality service to our Calgary customers in the heating and cooling industry.Arpis Industries is proud to be recognized for its services and commitment ... |
||||||
| Ransomware | pcdpackaging.com id23149 View details | United States | Finance / Legal / Insurance | pending | ||
|
Development of customized industrial packaging. Single-use racks, export packaging, packaging for power units, specialized packaging, packaging for sea containers. 1.The document is an official bank statement from PCD Packaging de México S. ... |
||||||
| Ransomware | coppage.net id23146 View details | United States | Construction / Real Estate | pending | ||
|
At Coppage Construction, we design and build homes. 1.The document is a statement of income for Coppage Construction Company, Inc. for the period ending April 30, 2025. 2.The document is a report entitled “Work in Process” by Coppage Co ... |
||||||
| Ransomware | arizonafireplaces.com id23145 View details | United States | Construction / Real Estate | pending | ||
|
Arizona Fireplaces offers its customers top-notch quality and service for fireplaces and accessories from leading global brands. 1.Arizona Department of Revenue — Contractor’s Certificate (Form 5005) “Contractor's Certificate for Prime ... |
||||||
| Ransomware | Beta Dyne id23139 View details | United States | Energy | pending | ||
|
Beta Dyne, USA - develops and manufactures electrical equipment for the industrial plants, communications и medical. With over 20 years in the power industry, Beta Dyne, Inc. has developed a wide range of unique and high performance power pr ... |
||||||
| Ransomware | Middlesex Appraisal Associates id23138 View details | United States | Communication / Marketing | pending | ||
|
Middlesex Appraisal Associates, USA - provides appraisal services in Eastern Massachusetts in Middlesex, Essex, Suffolk, Norfolk, Worcester, and Plymouth counties. Founded in 1992, the company provides appraisal and consulting services utiliz ... |
||||||
| Ransomware | Sprague & Jackson id23137 View details | United States | Communication / Marketing | pending | ||
|
Sprague & Jackson, USA - Sprague & Jackson is a tax services firm that offers a range of client services including secure document submission and payment options. They provide personalized assistance through scheduled meetings to help clients ... |
||||||
| Ransomware | Rasi Laboratories id23136 View details | India | Agriculture / Food | pending | ||
|
Rasi Laboratories, USA - a manufacturer and developer of nutraceuticals, specializing in dietary supplements like capsules, tablets, probiotics, and functional foods. Their facility in Cranbury, New Jersey, spans 198,500 square feet and is ... |
||||||
| Ransomware | Agencia Tributaria id23134 View details | Spain | Communication / Marketing | pending | ||
|
The Spanish Tax Administration Agency (Agencia Tributaria) - is the revenue service of the Kingdom of Spain. The agency is responsible for the effective application of the national tax and customs systems and for those resources of other Publ ... |
||||||
| Ransomware | Richmond Behavioral Health Authority id23133 View details | United States | Public Sector | pending | ||
|
Richmond Behavioral Health Authority (RBHA) is a statewide organization dedicated to providing comprehensive mental health, mental retardation, substance abuse and prevention services to the residents of the City of Richmond. The organization ... |
||||||
| Ransomware | Centurion Family Office Services LLC id23121 View details | United States | Services | pending | ||
|
Centurion originated as an idea to bring the high-value, high-impact services, traditionally reserved for only the wealthiest of individuals, to a broader network of families and entrepreneurs. Our Family Office Services address the needs of ... |
||||||
| Ransomware | Turnkey Africa id23119 View details | Kenya | IT | pending | ||
|
Turnkey Africa is a leading provider of technology solutions for the insurance industry across Africa, specializing in modernizing operations for traditional digital insurers, bancassurers, and pension administrators. They offer a comprehensi ... |
||||||
| Ransomware | Superior Linen Service id23118 View details | United States | Communication / Marketing | pending | ||
|
The Superior Linen Supply Company is designed to serve as an extension of our customers' business. By providing timely delivery of quality merchandise, outstanding service and affordable prices for over a century, customers have come to know ... |
||||||
| Ransomware | Buanderie Blanchelle id23117 View details | Canada | Communication / Marketing | pending | ||
|
Buanderie Blanchelle specializes in the provision and maintenance of hospital textile products, offering a comprehensive turnkey service that includes product supply, post-use recovery, and distribution at a single per-kilogram rate. They pro ... |
||||||
| Ransomware | Pangea id23116 View details | Chile | Retail / E-commerce | pending | ||
|
PANGEA The Travel Store is a boutique travel agency that designs bespoke, full-service trips tailored to individual tastes. It blends an online platform with physical flagship stores so customers can get face-to-face consultations as well as ... |
||||||
| Ransomware | Victory Christian Center id23115 View details | United States | Communication / Marketing | pending | ||
|
Victory Church is a community-focused church located in Tulsa, OK, dedicated to fostering a space where individuals can love God and love people. The church offers a variety of ministries, including programs for children, youth, and young adu ... |
||||||
| Ransomware | Bay West id23114 View details | United States | Services | pending | ||
|
Bay West LLC provides environmental consulting and remediation services for government and commercial enterprises. The company offers services in the areas of industrial storm water permitting and consulting; brownfield site assessment, clean ... |
||||||
| Ransomware | Florida Marking Products id23113 View details | United States | Communication / Marketing | pending | ||
|
The Kennedy Group, an Inovar company, specializes in providing innovative labeling and packaging solutions that enhance brand visibility. They offer a wide range of high-performance products, including pressure-sensitive labels, warehouse loc ... |
||||||
| Ransomware | TF LE TOIT FOREZIEN id23112 View details | France | Construction / Real Estate | pending | ||
|
Real estate - build and manage, possibly acquire and develop for the benefit of its members with a view to accessing property through rental with promise of allocation as defined in articles 15 and following of these statutes, collective and ... |
||||||
| Ransomware | Wheale Law Firm id23111 View details | United States | Finance / Legal / Insurance | pending | ||
|
It's Wheale Law Firm's vision that justice is achieved, tailored to each client's case. Most injury lawyers define success in one way: money. Not surprisingly, these attorneys also treat each case and each client the same. You deserve mor ... |
||||||
| Ransomware | ville-elne id23110 View details | France | Communication / Marketing | pending | ||
|
Elne is a commune in the Pyrénées-Orientales department in southern France. It lies in the former province of Roussillon, of which it was the first capital, being later replaced by Perpignan. Its inhabitants are still called Illibériens i ... |
||||||
| Ransomware | Asahi Group Holdings id23109 View details | Japan | Hospitality / Food & Beverage / Tourism | pending | ||
|
Asahi Group Holdings, founded in 1889 and headquartered in Tokyo, Japan, is a global food and beverage manufacturer specializing in both alcoholic and non-alcoholic beverages as well as snack products. The company operates across multiple int ... |
||||||
| Ransomware | Commune De Saint Claude id23108 View details | France | Services | pending | ||
|
The Mairie de Saint-Claude provides a range of municipal services to the residents of Saint-Claude, a town located in Guadeloupe. Their offerings include administrative services, community support, and urban planning initiatives aimed at enha ... |
||||||
| Ransomware | LEYHAUSEN Research id23107 View details | Germany | Communication / Marketing | pending | ||
|
Leyhausen Research GmbH is a leading provider of global field services since 1996, headquartered in Leverkusen, Germany. The company operates state-of-the-art facilities and call centers across Europe, the Middle East, India, and Africa, offe ... |
||||||
| Ransomware | All Truck Transportation Co., Inc. id23101 View details | United States | Transportation / Travel / Logistics | pending | ||
|
All Truck Transportation Co., Inc. is an asset-based carrier offering local and regional truckload transportation solutions. We are headquartered in Chicago, Illinois with a vast network of terminals throughout the Midwest. We operate within ... |
||||||
| Ransomware | Charles River Properties id23100 View details | United States | Communication / Marketing | pending | ||
|
Charles River Properties, USA - a real estate brokerage based in Waltham, Massachusetts, that handles residential and commercial sales and rentals. The company works only with very large properties. In its portfolio you will not find real es ... |
||||||
| Ransomware | Landmark Management id23098 View details | United States | Services | pending | ||
|
Landmark Management, Inc., manages 90 projects, consisting of 2,462 units across 5 states. Whether you are searching for an apartment to rent or a reliable company to manage your rural development property, let us put our thirty-six years of ... |
||||||
| Ransomware | New Jersey Property-Liability Insurance Guaranty Association id23097 View details | United States | Communication / Marketing | pending | ||
|
The New Jersey Property-Liability Insurance Guaranty Association provides essential claims services to claimants and policyholders affected by the insolvency of insurance companies. It operates as a safety net to protect individuals who find ... |
||||||