Captured Sep 14, 2026

Alicotrans

qilin

Ransomware leak-site victim intelligence

Files

Views

230

Posted

Sep 14, 2026

Country

Industry

Freight & Logistics Services

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reporting

The group claims 17 files were taken from Alicotrans Freight & Logistics Services, with sample PNG files published on the leak page. The victim is Alicotrans Freight & Logistics Services (domain www.alicotrans.com) in the Freight & Logistics sector. The leak page lists publication status as listed and provides an onion link and WikileaksV2 reference. ThreatCluster’s news reporting notes this organization has appeared in ransomware coverage around September 14, 2026.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Alicotrans Freight & Logistics Services

File types seen

png × 17

Sample files (17)

f202535f74474a562d4556424aed3d26.png

4fb16255c58457788dc4f574b9098528.png

4286d59d81c7d800acabd02cab5ebe84.png

c0138bf8cc02cbbf1ab06c505ec633a3.png

f607a11aabdfb8afd7cfe3d9eafaa1e7.png

98ea43f84708c5bc850a59a1380e690b.png

60835549fc2a3438cf4ee18e0d2bee94.png

c7cea6952f1c47ac397fb8eb3954ce77.png

496b8ced91654abede5c4705b004849c.png

9c6b073481494821bb512d8c5586e897.png

f40a4dfe52a8c247ad5fe7cd4458b734.png

34f7c45da581fd6773a688733a4820e7.png

e900014da5fd2a84e3e0bebc4a15d082.png

7041bf7b57fc30e7e926c5a81fd23a05.png

bb047263a526d8810f8ab6a1d9a033f8.png

cf26463c6cf52d2f55dc8bc7161aa701.png

360aff8b182d9ae2f5d83875df9724ee.png

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX: 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
onion_link: http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
WikileaksV2: https://wikileaks2.com/

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Screenshot of an invoice with sections for quantity, price, total, and company details.

onion leak page130 KB

Screenshot of a spreadsheet containing data related to transport logistics, including columns for destinations, costs, and other numerical values.

onion leak page673 KB

Document titled "ACTA REFERENCIA" with a reference number, detailing a legal agreement involving individuals and a transportation agency in Zaragoza.

onion leak page192 KB

Screenshot of a spreadsheet containing data with columns for names, numerical values, and various metrics.

onion leak page668 KB

Document titled "ACTA REFERENCIA" with a reference number and date, issued by a notary named Simón-Alfonso Pobes Layunta.

onion leak page122 KB

Screenshot of a financial balance sheet with columns for descriptions, and figures for the years 2022 and 2023.

onion leak page357 KB

Document with official letterhead, detailing participation and authorization related to social contributions, dated 2023, with references to previous documents and signatures.

onion leak page207 KB

Screenshot of a spreadsheet containing various columns with data, including names, numerical values, and other unspecified information.

onion leak page657 KB

Screenshot of an Excel spreadsheet listing various items with columns for item codes, descriptions, and prices.

onion leak page389 KB

Document titled "Contrato de confidencialidad" with legal text regarding data protection and confidentiality obligations.

onion leak page191 KB