Skip to content
Leak-site post naming Cotesma, captured by ThreatCluster

Cotesma

qilin

Ransomware leak-site victim intelligence

Views
0
Posted
Oct 4, 2026
Country
CL
Industry
Advertising & Marketing

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot

The leak post, published by the qilin group, claims to pertain to the victim Cotesma. It lists the victim's domain as www.cotesma.coop and places the sector in Advertising & Marketing. The post provides an onion link and Wikileaks references, and ThreatCluster captured a screenshot of the leak. No data types or volumes are specified in the leak post.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
http://www.cotesma.coop

What was taken

Cotesma

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

onion_link
http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
WikileaksV2
https://wikileaks2.com/
wikileaks_source
https://wikileaks2.com/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image contains a logo featuring a green circular design alongside the word "cotesma" in black text.
onion leak page22 KB

Negotiation

Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
Onion http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion