1. Executive summary
On 2026-10-25 the Qilin ransomware group listed Hossner-Textil GmbH, a German textile manufacturer, as a victim on its leak site, according to the ransomware.live index. The listing is the only confirmed fact: no initial-access vector, no malware sample, no exfiltration volume and no ransom demand have been published, and the victim's own statement is not in the sources. No CVE is associated with this item and no CISA KEV entry applies. The direct risk to EMEA financial services clients is indirect but real: Hossner-Textil is a supplier in a manufacturing supply chain, and any client with a commercial or financing relationship to the firm should treat the listing as a third-party incident requiring its own assessment. Qilin attribution rests on the leak-site post alone; the group has no MITRE ATT&CK profile in the available data, so the attribution is unconfirmed.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | A named ICT third-party (Hossner-Textil) is reported compromised, and clients may hold it as a supplier or counterparty | Clients must assess whether the firm is an ICT third-party provider in their register and whether the incident affects a service they rely on |
| DORA Art. 29 | The listing raises concentration risk if a client depends on this supplier for a critical or important function | Where dependency exists, a preliminary concentration assessment is required before the incident is closed |
| NIS2 Art. 21(2)(d) | Supply chain security measures are engaged where the client is an essential or important entity relying on this supplier | The client must evidence supply chain due diligence and any contractual security requirements with the supplier |
No DORA Art. 17, 18, 19 or 24 obligation is engaged on the facts available: there is no confirmed ICT-related incident at the client, no confirmed major incident, and no testing event. UK NIS 2018 duties are not engaged unless the client is an OES or RDSP with a direct dependency on this supplier.
3. Technical analysis & attack chain
The sources contain no technical detail of the intrusion. The ransomware.live entry carries a victim name, a group name (qilin), a publication timestamp and a placeholder for DNS records and a leak screenshot; the DNS and screenshot fields are empty in the fetched content. No initial-access vector, exploited component, CVE, payload, persistence mechanism, command-and-control address, lateral-movement path, exfiltration volume or ransom demand is stated.
Confirmed steps, in the order the sources support them:
- Qilin operators posted Hossner-Textil GmbH to their leak site on or before 2026-10-25T17:17:40Z.
- ransomware.live indexed the post and republished the victim name and group name.
That is the full confirmed chain. Everything beyond it is inference and is flagged as such.
The listing pattern is consistent with the standard double-extortion model used by Qilin and other leak-site groups: a victim is named publicly, a countdown or data-release threat usually follows, and negotiation happens off-site. The sources do not confirm that data was exfiltrated, that encryption occurred, or that a ransom was demanded. Clients should not assume encryption from the listing alone; a name on a leak site can reflect exfiltration-only extortion, a failed encryption attempt, or a listing made before any payload ran.
Attribution caveat: the Qilin label comes from the leak-site post as indexed by ransomware.live, a single source. There is no MITRE ATT&CK profile for Qilin in the available data and no independent corroboration in the sources. Treat the attribution as unconfirmed until a second source (the victim, a national CERT, or a vendor incident response report) confirms it. The absence of a MITRE profile does not mean the group is inactive; it means the tooling and TTP mapping cannot be verified from the material at hand.
4. Mitigation & containment
P1 within 24 hours
- Confirm whether Hossner-Textil appears in the third-party register as an ICT provider, a supplier, or a counterparty. If it does, open a third-party incident record and notify the relationship owner.
- Check email and file-transfer logs for any inbound correspondence or documents from hossner-textil[.]de domains in the last 30 days. A supplier compromise is a common pretext for invoice-fraud and malware-lure follow-on activity.
- If the client holds a direct integration (EDI, SFTP, API) with the supplier, disable or restrict it until the supplier confirms its status. Do not wait for the supplier to call.
P2 within 72 hours
- Request a written status statement from the supplier covering: whether data was exfiltrated, which systems were affected, and whether any client data was in scope.
- Review DORA Art. 28 and Art. 30 contractual provisions with the supplier: breach notification timelines, audit rights, and the right to terminate or substitute the service.
- If the supplier supports a critical or important function, run the DORA Art. 29 concentration assessment and document the result.
P3 within 7 days
- Update the supply chain risk register with the incident, the assessment outcome and any contractual remediation.
- Brief procurement and finance on the invoice-fraud risk from a compromised supplier; verify any change-of-bank-details request out of band.
- Where the client is an essential or important entity under NIS2, record the supply chain due diligence step taken under Art. 21(2)(d).
No vendor fix, patch or version pin applies: no CVE is associated with this item.
5. Indicators of compromise
No indicators of compromise available in the source material. The ransomware.live entry contains no hashes, domains, IP addresses, file paths or leak-site URLs beyond the index page itself.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Public leak-site listing naming the victim | ransomware leak-site monitoring, ransomware.live index | confirmed (single source) |
| Inbound email or documents from the supplier domain in the run-up to the listing | mail gateway, file-transfer logs | inferred, not confirmed |
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- ransomware.live, "Ransomware: qilin named Hossner-Textil GmbH (DE)", https://www.ransomware.live/id/SG9zc25lci1UZXh0aWwgR21iSEBxaWxpbg==, published 2026-10-25.
- ransomware.live, "Victim: Hossner-Textil GmbH – qilin", https://www.ransomware.live/id/SG9zc25lci1UZXh0aWwgR21iSEBxaWxpbg==, published 2026-10-25 (same index entry as above; not independent corroboration).
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services clients on the evidence available: a single leak-site listing, no confirmed technical detail, no CVE, no CISA KEV entry, and unconfirmed attribution to Qilin. The risk is concentrated in clients with a direct supplier or counterparty relationship to Hossner-Textil, where the exposure is third-party and contractual rather than technical. We will monitor for a victim statement, a national CERT advisory, or a vendor incident response report that confirms the intrusion and provides technical indicators; until one appears, we will not attribute the incident beyond the leak-site claim. Clients with a supplier relationship should treat the P1 checks in §4 as the immediate action and report back any confirmed contact from the supplier domain so we can reassess.
Published via PulseTrace — Adverse Trace threat intelligence.