Summary
Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot, our reportingQilin claims Inland and Offshore Contractors as the victim, listing the company and its domain iocltt.com (civil engineering and construction). The leak page provides a TOX hash, an onion link, and a WikileaksV2 reference, but does not disclose data volumes, specific data types, or what may have been exfiltrated. ThreatCluster's news reporting notes that around 2026-09-17, multiple ransomware groups, including Qilin, published new victims, indicating wider campaign activity during that period.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Domains
- http://www.iocltt.com
What was taken
Inland and Offshore Contractors
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- TOX
- 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
- tox_hash
- 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
- onion_link
- http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
- Company url
- http://www.iocltt.com
- WikileaksV2
- https://wikileaks2.com/
- company_url
- http://www.iocltt.com
- wikileaks_source
- WikileaksV2
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.