Captured Sep 16, 2026

Aarsleff

qilin

Ransomware leak-site victim intelligence

Files

Views

5,878

Posted

Sep 16, 2026

Country

Industry

Construction

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reporting

Qilin states that 13 files were taken from Aarsleff Construction (domain aarsleff.se). ThreatCluster published 12 sample PNG filenames from the leak. The post is published and identifies the victim as Aarsleff Construction in the construction sector, listing TOX, onion, and WikileaksV2 as platforms referenced by the leak.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms: TOX

What was taken

Aarsleff Construction

File types seen

png × 13

Sample files (13)

df07533bedffb3b971a6770b74ef674d.png

f699504499c583e6e0933ddf0245a705.png

ed4ec4f5bae9ae14d050223931b59a26.png

49676e4d2b78d34e609887fa328955d3.png

b4d99aa5f98e4fee232865d64c44bfec.png

9f5e4796a40e732df3173e2cbc028bae.png

add83954dbd42f51d4b8d1bf572c5c16.png

b887c2cdca8f748dcc360fc318cb4f40.png

a97555cfaf7f58c63a3cf12f194e1797.png

5615875147ded96038dd94d5b5ed90c0.png

75351fc4537f24d095f679f15c873b7b.png

336055e51380a496c9e981ae3b3b2251.png

78c78767636532c7d097299d6e34cc70.png

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX: 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
onion_link: http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
company_url: http://www.aarsleff.se
wikileaks_source: WikileaksV2 (https://wikileaks2.com/)

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

The image features a blue square icon with a white graphic depicting a construction or excavation tool, including a shovel and a bucket.

onion leak page16 KB

The image shows a detailed map or blueprint with various lines and annotations, including numbered sections and highlighted areas in pink and yellow.

onion leak page66 KB

Blueprint of a building layout with annotations, dimensions, and various symbols indicating plumbing and electrical systems.

onion leak page45 KB

Document titled "Anbud nr 303 865" with details about a project proposal, including sections for specifications, costs, and contact information.

onion leak page61 KB

Document with a header, dated November 27, 2014, containing a notice of completion and a signature at the bottom.

onion leak page62 KB

Screenshot of an Excel spreadsheet displaying a schedule with colored cells indicating different statuses or categories.

onion leak page57 KB

Blueprint of a building layout with annotations indicating specific features and measurements.

onion leak page46 KB

Blueprint of a building layout, showing rooms, dimensions, and plumbing or electrical plans with annotations.

onion leak page42 KB

Document with a header, listing work details for a week, including dates, tasks, and hours worked.

onion leak page44 KB

Screenshot of an Excel spreadsheet with multiple columns and rows containing numerical data and text labels.

onion leak page34 KB

Negotiation

Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68

Onion pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion