[QILIN] – Ransomware Victim: Rasi Laboratories

AI Generated Summary of the Ransomware Leak Page

Rasi Laboratories, a nutraceuticals manufacturer and developer of dietary supplements, is identified as the victim in a ransomware leak post attributed to the threat group qilin. The leak page presents the incident as a data-leak event rather than a purely encryption-based breach and asserts that attackers exfiltrated sensitive internal information from the company’s network. The leaked materials are described as including prescription-related records, financial information, and data on partners and employees, implying exposure across clinical, financial, and human resources domains. The page provides a post date of 2025-10-15; since no compromise date is explicitly stated on the leak page, this date is treated as the post (publish) date for the leak. The post notes a claim URL and references contact and credential artifacts, but those sensitive items are redacted in this summary and no ransom amount is disclosed on the page.

The leak page indicates the presence of 28 images or screenshots accompanying the claims. These visuals are described in neutral terms as internal documents and related materials, hosted on onion-style addresses referenced by the post. The exact contents of the images are not detailed in the summary, but their volume suggests an extensive payload intended to corroborate the attackers’ assertions. In line with safety practices, PII such as emails and addresses mentioned on the page are redacted, and any direct URLs in the page’s artifacts are defanged or omitted in this summary.

According to the excerpted description, Rasi Laboratories operates as a United States-based facility in Cranbury, New Jersey, spanning approximately 198,500 square feet and focused on supplement manufacturing. The company is described as having been established in 1984, with a reputation built on product development, regulatory compliance, and supply chain management. The leak post hints at broader impacts across internal domains and notes that data exfiltration has occurred, though no explicit ransom amount is provided. The publish date remains 2025-10-15, and there is no separate compromise date given on the leak page. The page also references a claim URL and contains redacted contact details and credential data, underscoring the public nature of the leak while safeguarding sensitive information from exposure in this summary.