Captured Sep 20, 2026

Zorlu Holding

qilin

Ransomware leak-site victim intelligence

Views

6,029

Posted

Sep 20, 2026

Country

Industry

Holding Companies & Conglomerates

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

Qilin claims exfiltration of data categorized as “Holding Companies & Conglomerates” from zorlu.com. The leak page on the group’s site is listed (publication status: listed). Victim identification on the page shows the domain zorlu.com within the Holding Companies & Conglomerates sector.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains: http://www.zorlu.com

What was taken

Blog Zorlu Holding

Data categories

Holding Companies & Conglomerates

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX: 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
onion_link: http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion
WikileaksV2: https://wikileaks2.com/
wikileaks_link: https://wikileaks2.com/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture

Logo featuring the word "ZORLU" in gray, with a red circular design surrounding the letter "Z."

onion leak page71 KB

Negotiation

Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68

Onion http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion