Ransomware Group: QILIN

VICTIM NAME: www[.]balkankalip[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to Balkan Kalıp, a manufacturing company established in Istanbul in 1998. The company specializes in producing molds and components for the automotive industry, emphasizing sustainable development and innovative solutions. The breach was detected on July 23, 2025, and the attack reportedly occurred on July 17, 2025. The leak indicates that sensitive data belonging to the company has been compromised, including internal documents and possibly operational information. The page includes a screenshot depicting what appears to be internal data or documents, though no explicit PII or proprietary information is publicly disclosed. The leak is associated with a cybercriminal group known as “qilin,” and the incident is part of ransomware activity targeting industrial manufacturing firms globally.

The leak page mentions the availability of stolen data for download or viewing through a secured link, though specific files or details are not prominently displayed. The incident appears to be part of a targeted cyberattack, aiming to leverage sensitive information for extortion or other malicious purposes. The company’s location in Turkey and its focus on automotive manufacturing provide context for the industry-specific risks involved. Visual evidence includes a screenshot that indicates an attempt to showcase the compromised data, though no graphic or sensitive content is explicitly described. Overall, this incident highlights the ongoing threat of ransomware to manufacturing organizations in the region and the importance of cybersecurity measures to prevent such breaches.