Ransomware Group: QILIN

VICTIM NAME: www[.]mpmimports[.]com[.]cy

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the QILIN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak page identifies www[.]mpmimports[.]com[.]cy as a victim in the Cyprus-based Consumer Services sector. The page describes the entity as a local supplier of cosmetics, tires, and other consumer goods, and frames the incident as a ransomware intrusion accompanied by data exfiltration. The post is dated September 24, 2025, which serves as the primary temporal marker since the provided data does not include a distinct compromise date. A claim URL is indicated on the page, consistent with leak-site patterns used to publicly attribute breaches and to verify the leak. The page also presents three screenshots as part of the evidence accompanying the claim.

The post includes three images hosted on Tor onion addresses, which are defanged in this summary. The accompanying metadata shows a redacted Jabber contact, and a hashed token (TOX) is referenced as part of the leak’s identifiers. Additionally, there is an FTP-style reference to a data-share endpoint, with login credentials redacted and the server IP shown as 64[.]176[.]162[.]76. These elements—image attachments, a claim URL, and contact/credential mentions—align