Ransomware Group intelligence
Qilin
ActiveTrack Qilin with 2263 published victims and 5 known leak locations in a single intelligence view.
Overview
Qilin is tracked by Breach House as a ransomware group with 2263 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion |
| Leak location 2 | Onion service | Unknown | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion |
| Leak location 3 | Onion service | Unknown | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 4 | Onion service | Unknown | b4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion |
| Leak location 5 | Onion service | Unknown | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (2263)
Search, filter and paginate the victim timeline for Qilin. Showing 101–200 of 2263.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Cano Industrial id30768 View details | Mexico | Manufacturing / Engineering | ||
|
Cano Industrial is a company based in Mexico, operating in the manufacturing and engineering sector, providing various industrial services and products. The company's offerings cater to the needs of its clients in the region. Cano Industrial was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Cano Industrial id30768 View details | Mexico | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Triton Trading id30769 View details | Peru | Manufacturing / Engineering | ||
|
Triton Peru, located in Peru, operates in the manufacturing and engineering sector, providing various services and products. The company is involved in the production and distribution of goods, serving as a key player in the Peruvian industry. www.triton.com.pe was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Triton Trading id30769 View details | Peru | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | AppleOne Properties id30770 View details | Philippines | Manufacturing / Engineering | ||
|
API.com.ph is a Philippine-based company operating in the manufacturing and engineering sector, providing various services to its clients. The company is involved in different aspects of manufacturing and engineering, catering to the needs of its customers in the Philippines. API.com.ph was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | AppleOne Properties id30770 View details | Philippines | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Sunway Berhad id30762 View details | Malaysia | Construction / Real Estate | ||
|
Sunway is a prominent construction and real estate company based in Malaysia, offering a range of services including property development, construction, and hospitality. The company operates in various sectors, providing innovative solutions to meet the needs of its customers. Sunway was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Sunway Berhad id30762 View details | Malaysia | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | P & A Construction id30758 View details | United States | Construction / Real Estate | ||
|
Paconst is a construction and real estate company based in the United States, providing various services to the sector. The company operates within the construction industry, offering services related to construction and real estate development. Paconst was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | P & A Construction id30758 View details | United States | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | Primeline Logistics id30750 View details | Ireland | Transportation / Travel / Logistics | ||
|
Primeline ie is an Irish company operating in the transportation travel and logistics sector. The company provides various services to its clients in Ireland. Primeline ie was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Primeline Logistics id30750 View details | Ireland | Transportation / Travel / Logistics | ||
|
N/A |
|||||
| Ransomware | Recsa id30751 View details | Costa Rica | Manufacturing / Engineering | ||
|
RECSA is a company based in Costa Rica, operating in the manufacturing and engineering sector. The company likely provides various products and services related to its sector, although specific details are not available. RECSA was listed as a ransomware victim associated with Qilin. |
|||||
| Ransomware | Recsa id30751 View details | Costa Rica | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Salida Union School District id30752 View details | United States | Education | ||
|
The Salida Union Elementary School District, located in the United States, serves the educational needs of students in the area, providing various academic programs and services. As an educational institution, it plays a vital role in the community, offering a range of curriculum and extracurricular activities. The district is part of the larger California education system, adhering to state and federal guidelines. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Salida Union School District id30752 View details | United States | Education | ||
|
N/A |
|||||
| Ransomware | Cpcg id30754 View details | Brazil | Construction / Real Estate | ||
|
CPCGR is a company operating in the construction and real estate sector in Brazil. The company likely provides services related to construction, property development, and real estate management. CPCGR was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Cpcg id30754 View details | Brazil | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | EFU Life Assurance id30755 View details | Pakistan | Healthcare / Pharma | ||
|
Efulife operates in the healthcare and pharmaceutical sector in Pakistan, providing various services and offerings to its customers. As a key player in the country's healthcare industry, Efulife is committed to delivering quality products and services. Efulife was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | EFU Life Assurance id30755 View details | Pakistan | Healthcare / Pharma | ||
|
N/A |
|||||
| Ransomware | Infina Health id30756 View details | United States | Healthcare / Medicine | ||
|
Infina Health is a US-based company operating in the healthcare sector, providing medical services and solutions. The company is focused on delivering innovative healthcare technologies to improve patient outcomes. Infina Health was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Infina Health id30756 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Evergreen Title id30738 View details | United States | Finance / Legal / Insurance | ||
|
Evergreen Title Company is a US-based title insurance company operating in the finance and legal sector, providing title insurance and escrow services to clients. As a key player in the US title insurance market, the company facilitates real estate transactions and ensures property ownership legitimacy. Evergreen Title Company was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Evergreen Title id30738 View details | United States | Finance / Legal / Insurance | ||
|
N/A |
|||||
| Ransomware | RehaVital Gesundheitsservice GmbH id30731 View details | Germany | Healthcare / Medicine | ||
|
Rehavital.de is a healthcare services provider based in Germany, offering medical services to patients. As a part of the healthcare sector in Germany, Rehavital.de plays a crucial role in providing medical care. Rehavital.de was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | RehaVital Gesundheitsservice GmbH id30731 View details | Germany | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Postres Reina id30719 View details | Spain | Hospitality / Food & Beverage / Tourism | ||
|
Postres Reina is a Spanish company operating in the hospitality and food and beverage sector, specifically in the production and distribution of pastries and other sweet treats. Located in Spain, the company caters to the tourism industry, providing its offerings to various establishments. Postres Reina was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Postres Reina id30719 View details | Spain | Hospitality / Food & Beverage / Tourism | ||
|
N/A |
|||||
| Ransomware | Bolt & Nut Manufacturing id30695 View details | United Kingdom | Manufacturing / Engineering | ||
|
BNML operates in the manufacturing and engineering sector, providing services in the United Kingdom. The company is involved in various engineering activities. BNML was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Bolt & Nut Manufacturing id30695 View details | United Kingdom | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | PP+K id30686 View details | Brazil | Education | ||
|
Uniteppk operates in the education sector in Brazil, providing educational services and resources. As an educational institution, it plays a crucial role in the country's education system. Uniteppk was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | PP+K id30686 View details | Brazil | Education | ||
|
N/A |
|||||
| Ransomware | Eana id30687 View details | Argentina | Other | ||
|
Eana is an entity based in Argentina, operating in the other sector. The company provides various offerings, but specific details about its services are not publicly available. Eana was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Eana id30687 View details | Argentina | Other | ||
|
N/A |
|||||
| Ransomware | Synergy Products id30688 View details | Türkiye | Healthcare / Medicine | ||
|
Synergy TRT is a company operating in the healthcare and medicine sector in Turkey, providing various services to its clients. The company's offerings cater to the needs of the healthcare industry, focusing on medical solutions. Synergy TRT was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Synergy Products id30688 View details | Türkiye | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Don Tortaco Mexican Grill id30683 View details | United States | Retail / E-commerce | ||
|
Dontortaco.com operates in the retail and e-commerce sector in the United States, offering various products and services to its customers. As an e-commerce company, it provides online shopping experiences, likely including food and beverage items. Dontortaco.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Don Tortaco Mexican Grill id30683 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Associated Theatrical Contractors id30684 View details | United States | Construction / Real Estate | ||
|
Associated Theatrical is a company operating in the construction and real estate sector in the United States. The company's offerings are likely related to theatrical services, given its name. However, specific details about its operations are not readily available. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Associated Theatrical Contractors id30684 View details | United States | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | City Ambulance Service id30670 View details | United States | Healthcare / Medicine | ||
|
Cityambu is a US-based healthcare and medicine entity. It provides medical services and support. Cityambu was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | City Ambulance Service id30670 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | Famesa id30671 View details | Peru | Manufacturing / Engineering | ||
|
Famesa is a Peruvian company operating in the manufacturing and engineering sector. The company is involved in various industrial activities, providing products and services to its customers. Famesa was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Famesa id30671 View details | Peru | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Heartland Catfish id30664 View details | United States | Agriculture / Food | ||
|
Heartland Catfish is an American company operating in the agriculture and food sector, specifically in catfish farming. The company is based in the United States and is involved in the production and distribution of catfish products. Heartland Catfish was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Heartland Catfish id30664 View details | United States | Agriculture / Food | ||
|
N/A |
|||||
| Ransomware | Salina Supply id30665 View details | United States | Retail / E-commerce | ||
|
Salinasupply is a retail e-commerce company based in the United States, offering various products to customers online. As an e-commerce platform, it provides a range of goods, catering to different customer needs. Salinasupply was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Salina Supply id30665 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | St Martha Catholic Church id30666 View details | United States | Healthcare / Medicine | ||
|
St. Martha's is a healthcare organization based in the United States, providing medical services to patients. As a healthcare provider, it offers various medical treatments and care options. Stmartha.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | St Martha Catholic Church id30666 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | The Nueva School id30667 View details | United States | Education | ||
|
Nueva School is a private school in the United States, specifically in the San Francisco Bay Area of California, offering education to students. The school provides a range of academic programs and extracurricular activities. Nueva School operates in the education sector, serving the local community. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | The Nueva School id30667 View details | United States | Education | ||
|
N/A |
|||||
| Ransomware | Sicc id30661 View details | Italy | Manufacturing / Engineering | ||
|
Sicc-srl.com is an Italian company operating in the manufacturing and engineering sector, providing various services and products to its clients. The company is based in Italy and focuses on delivering high-quality solutions to its customers. Sicc-srl.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Sicc id30661 View details | Italy | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | KLD Labs id30662 View details | United States | IT | ||
|
KLD Labs is an IT company based in the United States, providing various services and solutions within the IT sector. The company operates in a competitive market, offering its expertise to clients. KLD Labs was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | KLD Labs id30662 View details | United States | IT | ||
|
N/A |
|||||
| Ransomware | Armara id30663 View details | France | Retail / E-commerce | ||
|
Armara.fr operates in the retail and e-commerce sector, offering various products and services to customers in France. As an e-commerce company, it provides online shopping experiences, catering to the needs of its customers. Armara.fr was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Armara id30663 View details | France | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | AK Preparedness id30659 View details | United States | Retail / E-commerce | ||
|
Akpreparedness.com is an e-commerce website based in the United States, operating in the retail sector. The site likely offers various products for sale online, catering to customers across the country. As a retail e-commerce site, it provides a platform for customers to browse and purchase products. Akpreparedness.com was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | AK Preparedness id30659 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Powder River Heating & Air Conditioning id30649 View details | United States | Construction / Real Estate | ||
|
Powderriverheating.com is a company operating in the construction and real estate sector in the United States. The company likely provides heating services, given its name. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Powder River Heating & Air Conditioning id30649 View details | United States | Construction / Real Estate | ||
|
N/A |
|||||
| Ransomware | Droguería Martorani id30650 View details | Argentina | Retail / E-commerce | ||
|
Martorani is an Argentine company operating in the retail and e-commerce sector, offering various products and services to its customers. The company is based in Argentina and caters to the local market with its online presence at www.martorani.com. Martorani is listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Droguería Martorani id30650 View details | Argentina | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Cafar id30645 View details | Argentina | NGOs / Associations | ||
|
CAFAR, or Camara Argentina de Fertilizantes y Agroquimicos Responsables, is an Argentine association that represents the fertilizer and agrochemical industry in Argentina. The organization provides various services and resources to its members, including training, advocacy, and networking opportunities. CAFAR operates in the non-governmental organization sector, focusing on promoting responsible practices in the agrochemical industry. It was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Cafar id30645 View details | Argentina | NGOs / Associations | ||
|
N/A |
|||||
| Ransomware | Acosol id30642 View details | Spain | Energy | ||
|
Acosol es is a Spanish company operating in the energy sector, providing various services to its customers. Located in Spain, the company is involved in energy-related activities. Acosol es was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Acosol id30642 View details | Spain | Energy | ||
|
N/A |
|||||
| Ransomware | International Delights id30585 View details | United States | Retail / E-commerce | ||
|
Intdelights.com operates in the retail and e-commerce sector, offering various products to customers in the United States. As an online retailer, intdelights.com provides a platform for customers to browse and purchase products. Intdelights.com was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | International Delights id30585 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | Feliubadaló id30571 View details | Spain | Other | ||
|
Feliubadalo is an entity based in Spain, operating in the other sector. The entity's offerings and services are not well-documented. Feliubadalo was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Feliubadaló id30571 View details | Spain | Other | ||
|
N/A |
|||||
| Ransomware | Levin Furniture id30570 View details | United States | Retail / E-commerce | ||
|
Levin Furniture is a US-based retail and e-commerce company that offers a range of furniture products. The company operates in the retail and e-commerce sector, providing customers with various furniture options. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Levin Furniture id30570 View details | United States | Retail / E-commerce | ||
|
N/A |
|||||
| Ransomware | THL id30556 View details | Finland | Finance / Legal / Insurance | ||
|
THL is a Finnish organization operating in the finance, legal, and insurance sectors. The entity provides various services to its clients in Finland. THL was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | THL id30556 View details | Finland | Finance / Legal / Insurance | ||
|
N/A |
|||||
| Ransomware | Sedemi id30538 View details | Mexico | IT | ||
|
Sedemi is an IT company based in Mexico, providing various services to its clients. The company operates in the IT sector, offering solutions to businesses in Mexico. Sedemi is listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | Sedemi id30538 View details | Mexico | IT | ||
|
N/A |
|||||
| Ransomware | Counts & Dobyns id30532 View details | United States | Finance / Legal / Insurance | ||
|
Counts and Dobyins is a financial services company based in the United States, operating within the finance, legal, and insurance sector. The company provides various financial services to its clients. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Counts & Dobyns id30532 View details | United States | Finance / Legal / Insurance | ||
|
N/A |
|||||
| Ransomware | Centro Científico e Cultural de Macau id30533 View details | Portugal | Public Sector | ||
|
The Comissão de Coordenação e Desenvolvimento Regional do Centro (CCCM) is a regional development commission in Portugal, operating in the public sector. CCCM is responsible for promoting regional development, managing European funds, and supporting local authorities in the central region of Portugal. The entity provides various services and support to local communities, businesses, and institutions. It was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Centro Científico e Cultural de Macau id30533 View details | Portugal | Public Sector | ||
|
N/A |
|||||
| Ransomware | Jakub A.S. id30534 View details | Czechia | IT | ||
|
Jakub.cz is a Czech company operating in the IT sector, providing various services to its clients. The company is based in the Czech Republic and offers a range of IT solutions. Jakub.cz was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Jakub A.S. id30534 View details | Czechia | IT | ||
|
N/A |
|||||
| Ransomware | Cemoi id30535 View details | France | Agriculture / Food | ||
|
Cemoi.fr is a French company operating in the agriculture and food sector, offering various products and services. Located in France, the company is involved in the production and distribution of food products. Cemoi.fr was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Cemoi id30535 View details | France | Agriculture / Food | ||
|
N/A |
|||||
| Ransomware | Busscar de Colombia id30536 View details | Colombia | Manufacturing / Engineering | ||
|
Busscar is a Colombian company operating in the manufacturing and engineering sector, specifically in the production of buses and other vehicles. The company is based in Colombia and offers a range of products and services related to transportation and manufacturing. Busscar was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Busscar de Colombia id30536 View details | Colombia | Manufacturing / Engineering | ||
|
N/A |
|||||
| Ransomware | Hillebrand Home Health id30527 View details | United States | Healthcare / Medicine | ||
|
Hillebrand Home Health is a healthcare services provider based in the United States, offering home health care solutions. The company operates in the healthcare sector, providing medical services to patients in their homes. Hillebrand Home Health was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Hillebrand Home Health id30527 View details | United States | Healthcare / Medicine | ||
|
N/A |
|||||
| Ransomware | URH Hoteliers id30528 View details | Spain | Hospitality / Food & Beverage / Tourism | ||
|
URH Hoteliers is a Spanish company operating in the hospitality sector, providing services to the food and beverage, and tourism industries. The company is based in Spain and offers various services to its clients. URH Hoteliers was listed as a ransomware victim associated with Qilin |
|||||
| Ransomware | URH Hoteliers id30528 View details | Spain | Hospitality / Food & Beverage / Tourism | ||
|
N/A |
|||||
| Ransomware | TitanTV, Inc. id30526 View details | United States | Other | ||
|
Titantvinc is a company based in the United States, operating in the Other sector. The company's specific offerings are not well-documented, but it is known to be a part of the diverse US business landscape. Titantvinc was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | TitanTV, Inc. id30526 View details | United States | Other | ||
|
N/A |
|||||
| Ransomware | Century Equities id30495 View details | United States | Finance / Legal / Insurance | ||
|
Century Equities is a financial services company based in the US, operating in the finance, legal, and insurance sector. The company provides various financial services to its clients. Century Equities was listed as a ransomware victim associated with qilin |
|||||
| Ransomware | Century Equities id30495 View details | United States | Finance / Legal / Insurance | ||
|
N/A |
|||||
| Ransomware | Retelit SpA PIVA id30496 View details | Italy | Telecommunications | ||
|
Retelit is an Italian telecommunications company that provides a range of services including data transmission and internet connectivity. The company operates in the telecommunications sector in Italy, offering various solutions to its customers. Retelit was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Retelit SpA PIVA id30496 View details | Italy | Telecommunications | ||
|
N/A |
|||||
| Ransomware | Carolina Agri-Power id30497 View details | United States | Construction / Real Estate | ||
|
Carolinaap is a company operating in the construction and real estate sector in the United States, providing various services to clients. The company's offerings cater to the needs of the construction and real estate industries. Carolinaap was listed as a ransomware victim associated with qilin. |
|||||
| Ransomware | Carolina Agri-Power id30497 View details | United States | Construction / Real Estate | ||
|
N/A |
|||||