[QILIN] – Ransomware Victim: IREM companies

AI Generated Summary of the Ransomware Leak Page

On 2025-10-23, a leak page associated with the Qilin ransomware operation asserts that IREM companies, a United States–based organization described as an international institute for real estate and asset managers, has been compromised. The page portrays IREM as a body that promotes management through education and information exchange, detailing activities such as real estate management training courses, national meetings of real estate managers, and the development and publication of textbooks, reports, magazines, and related teaching materials. The post frames the incident as a data leak rather than an encryption event and claims that all of IREM’s data has been made publicly available or is in the process of publication. It further states that financial information, contracts with authors and scientists, and information about possible fraud in the organization’s operations are among the data being prepared for publication, and that personal information about everyone who has ever collaborated with or worked at IREM will also be released. The attackers claim possession of more than 2 terabytes of data and provide a claim URL to support their assertions. The leak page includes three images that appear to be screenshots of internal materials; the post does not describe their exact contents. An FTP access point is referenced in the leak content, though authentication details are redacted, and the images are hosted on a Tor onion–based domain.

From a threat intelligence perspective, the page identifies IREM companies as the victim, locating the incident within the United States and characterizing the organization as a real estate and asset management institution. The described impact is a data-leak scenario rather than encrypted data, with the post date serving as the published date for the leak since no explicit compromise date is given. Notably, the post does not specify any ransom amount; instead, it emphasizes that sensitive data and personal information could be publicly released. The presence of three screenshots plus an onion-hosted image set and a referenced FTP link with redacted credentials suggests a multi-faceted exfiltration and disclosure operation typical of ransomware leak sites. This event underscores ongoing risks to organizations in the real estate and asset-management space and highlights the importance of safeguarding confidential contracts, financial data, and personal information to mitigate exfiltration threats.