[QILIN] – Ransomware Victim: WebCut Converting

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

Ransomware group:
QILIN
Victim name:
WEBCUT CONVERTING

AI Generated Summary of the Ransomware Leak Page

On October 14, 2025, a ransomware leak post attributed to the threat actor group qilin profiles WebCut Converting, Inc. as the victim. The US-based manufacturer specializes in contract slitting, laminating, and sheeting for printing, converting, medical, and industrial markets. The leak page characterizes the incident as a data exfiltration event, noting that data has been downloaded from WebCut Converting’s network but that the total volume remains undisclosed at the time of posting. A claim URL is indicated on the leak page, suggesting a conduit for additional information or ransom-related communications, but no ransom amount or terms are provided in the accessible content. The post date is 2025-10-14, and there is no independently verified compromise date supplied in the data; thus the post date is treated as the release date for this summary.

The post includes three images accompanying the entry, described in general terms as internal document visuals. The exact contents of these images are not detailed in the excerpt, and there are no additional downloadable assets confirmed beyond these visuals. The excerpt notes that the amount of downloaded data is unknown and will be updated later. Contact-style identifiers referenced in the text (such as messaging handles and transfer credentials) are present but have been redacted for privacy, along with other PII, while the victim_name remains WebCut Converting. Overall, the page presents a ransomware data-exfiltration claim against a United States manufacturing entity, with no explicit encryption-only impact or ransom figure disclosed in the available material.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features