Ransomware Group: QILIN

VICTIM NAME: Cacspmec

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to CACSPMEC, a financial cooperative based in Ecuador that has been operational since 1978. The organization provides a variety of financial services primarily to public sector employees. The attack was discovered on May 22, 2025, and the threat group responsible for the breach is identified as “qilin.” The leak page indicates that sensitive data from CACSPMEC may have been compromised and made available on the dark web. A screenshot of the leaked data appears to show internal documents or information that could potentially expose organizational details. The page includes download links or references to leaked data, suggesting that the attackers have exfiltrated files intended for public release.

The incident involves multiple infostealers, including well-known variants such as Raccoon, RedLine, Lumma, and Vidar, which collectively indicate significant malware activity aimed at harvesting organizational data. The leak page provides a URL for further information but maintains a neutral stance in public communication. No personally identifiable information or sensitive financial data is explicitly described in the publicly available summaries, but the leak suggests that internal organizational information could be at risk. The option for viewing or downloading materials is presented, implying that the attacker might have exfiltrated files or documents related to the organization. The incident highlights ongoing cybersecurity risks faced by financial institutions, especially those serving public sector employees in Ecuador.