Radicon listed on Qilin ransomware leak site
The Qilin ransomware group has listed the manufacturing company Radicon on its leak site.
- Published
- 2 min read
- 2 min read
- Ransomware group: Qilin
- Country: India
- Sector: Manufacturing
- Announcement date: May 31, 2025
The Qilin ransomware group has listed the manufacturing company Radicon on its leak site. According to an announcement made on May 31, 2025, the threat actor claims to have successfully compromised the organization's networks and exfiltrated sensitive information.
The claimed attack and event details
The threat actor known as Qilin has published a leak announcement claiming to have compromised data belonging to Radicon. The post includes images of various documents related to the company's operations. The threat actor alleges that it has gained access to the company's networks and exfiltrated data.
While the announcement was posted on May 31, 2025, the group claims the attack itself took place on May 30, 2025. At this time, no information has been provided regarding the specific size of the data stolen, the total file count, or the specific ransom demand being made by the attackers.
Data involved in the incident
The provided screenshots display samples that appear to be corporate documents and personal data; however, the full scope and nature of the data remain unconfirmed. The listing identifies the following types of affected information:
- Corporate documents
- Personal data
About Radicon
Radicon is a manufacturing company that offers a wide range of power transmission products, including worm gears, geared motors, couplings, and industrial reducers. In addition to standard products, it specializes in custom-engineered gearboxes with high torque capacity.
Analysis and potential implications
Given the Qilin group's double-extortion tactics, the potential public release of exfiltrated data may pose commercial and operational risks to the company. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's systems but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This creates a dual pressure on the victim to pay to restore operations and to prevent the exposure of confidential information.
The organization could face legal obligations under data protection regulations in India. Furthermore, the exposure of employee or customer data may lead to secondary risks such as identity theft or targeted phishing attacks. The group's past activities suggest that data may be leaked if a ransom is not paid. This situation could result in reputational damage and raise concerns regarding the security of the company's supply chain.
In general, organizations in the manufacturing sector can take various defensive steps to mitigate such risks. These include implementing robust network segmentation to prevent lateral movement, maintaining rigorous backup protocols, and conducting regular security awareness training for employees to defend against phishing. Strengthening identity and access management (IAM) and monitoring for unusual data exfiltration patterns are also critical components of a modern cybersecurity posture.