Captured Sep 18, 2026

Ceres Tolvas

qilin

Ransomware leak-site victim intelligence

Views

4,876

Posted

Sep 18, 2026

Country

Industry

Business Services

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

The leak claims data from Ceres Tolvas has been exfiltrated; no quantity is specified on the leak page. The material is described as HR and recruitment records, internal documentation and source code. The leak page lists cerestolvas.com.ar in the Business Services sector and is published (posted 2026-09-18).

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Blog Ceres Tolvas

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX: 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
onion_link: http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
WikileaksV2: https://wikileaks2.com/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Logo featuring a stylized head with a wheat symbol and the text "CeresTolvas."

onion leak page58 KB

Negotiation

Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68

Onion http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion