1. Executive summary
The Qilin ransomware group listed Power Funding, a UK financial firm (powerfundingltd.com), on its leak site on 2026-10-26. The listing is a claim of compromise published by the operator; no sample, hash, ransom note, exfiltration volume or initial-access detail accompanies it in the source material, and Power Funding has not confirmed the incident in anything supplied here. Qilin has no MITRE ATT&CK profile in the reference data, so the attribution to a tracked actor is unconfirmed and the listing should be treated as an unverified operator claim until corroborated. For EMEA financial services the exposure is indirect but real: a UK lender appearing on a Qilin leak page is a third-party and supply-chain event for any client that funds through, banks with, or shares borrower data with the firm, and the absence of technical detail means detection has to rest on generic Qilin tradecraft rather than this listing. No CVE is associated with this item.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | A UK financial firm that clients may use as a funding counterparty or data-sharing partner has been listed by a ransomware group. | Clients must determine whether Power Funding sits in their ICT third-party register and, if so, whether the listing triggers a third-party risk review and contractual notification. |
| DORA Art. 29: preliminary assessment of ICT concentration risk | If multiple clients route funding or borrower data through the same small UK lender, a single compromise concentrates exposure. | Clients sharing a common counterparty should assess whether the listing represents concentration risk across their own portfolio. |
| NIS2 Art. 21(2)(d): supply chain security measures | The listed entity is a supplier in the funding chain for clients in NIS2-scope sectors. | In-scope clients must confirm supply-chain security measures cover this counterparty and record the assessment. |
The listing itself is an operator claim, not a confirmed incident. The DORA Art. 19 and NIS2 Art. 23 reporting duties attach to a client's own major incident, not to a third party's leak-site appearance, so they are not engaged by this item alone.
3. Technical analysis & attack chain
The source material is a leak-site index entry. It gives the group name (qilin), the victim name (Power Funding), the country (GB) and the victim website (www.powerfundingltd.com). It gives no initial-access vector, no exploited component or CVE, no malware sample, no persistence mechanism, no command-and-control detail, no exfiltration volume and no proof-of-data. A numbered attack chain cannot be reconstructed from confirmed steps because none are present.
What can be said with confidence is limited to the listing event itself:
- Qilin published Power Funding on its leak site on 2026-10-26 at 11:55 UTC.
- The listing names a UK-domiciled financial firm and its public domain.
- No supporting artefacts (samples, hashes, screenshots of stolen data, negotiation records) are included in the supplied sources.
Everything beyond that is inference from Qilin's general operating pattern, which is not documented in the material provided and must not be presented as fact here. The related corpus entry for a separate Qilin victim (FIRMENGRUPPE APPL Holding GmbH, DE) shows the same index format and a Hudson Rock panel reporting one third-party employee credential, but that panel belongs to the German victim, not to Power Funding, and must not be transferred across. Treat any claim that Power Funding suffered credential compromise, data theft or encryption as unconfirmed until the firm or a first-party source states it.
Attribution caveat: Qilin has no MITRE ATT&CK profile in the reference data. The group name is the operator's self-designation as indexed by ransomware.live. It is single-sourced and unconfirmed. Do not map this to a tracked intrusion set without independent corroboration.
4. Mitigation & containment
P1 (within 24h)
- If Power Funding is a live counterparty, funding partner or data-sharing third party, contact them through a known-good channel (not an address on the listed domain) and ask directly whether they have an active incident. Record the answer.
- Suspend any automated data feeds, API integrations or file transfers with powerfundingltd.com until the firm confirms status. Manual review of the last 30 days of exchanged files for unexpected content.
- Pull the third-party register entry for Power Funding and flag it for DORA Art. 28 review.
P2 (within 72h)
- Review authentication logs for any account, service principal or API key that authenticates to or from Power Funding infrastructure. Look for new device registrations, impossible-travel logins and MFA changes on shared accounts.
- If clients share borrower or applicant data with the firm, confirm the data-sharing agreement's breach-notification clause and whether the firm is obliged to notify on a leak-site listing.
- Check endpoint telemetry for Qilin-associated behaviour on any host that has recently communicated with the firm's domain: unusual archive creation (7z, rar), mass file rename with a common extension, and deletion of volume shadow copies.
P3 (within 7 days)
- Complete the concentration-risk assessment under DORA Art. 29 if multiple portfolio clients depend on the same counterparty.
- Update supply-chain security documentation under NIS2 Art. 21(2)(d) to record this listing and the response taken.
No vendor fix, patch or version pin applies: this is a leak-site listing, not a vulnerability with a CVE.
5. Indicators of compromise
No indicators of compromise available in the source material.
The only atomic indicator present is the victim's own domain, which is not a threat indicator and is not reproduced here as an IOC. No hashes, IPs, URLs, filenames, registry keys or ransom-note strings are supplied. Behavioural indicators cannot be listed either: the source describes no authentication pattern, device registration or process activity attributable to this incident.
6. Detection
Insufficient indicators to author detection rules.
The source contains no distinctive strings, command-line flags, mutex names, scheduled-task names, file paths, registry keys or ransom-note text tied to this listing. Authoring a YARA or Sigma rule from the group name or the victim domain would detect reporting about the event, not the threat, and is not emitted.
7. Sources
- ransomware.live, "Ransomware: qilin named Power Funding (GB)", https://www.ransomware.live/id/UG93ZXIgRnVuZGluZ0BxaWxpbg==, published 2026-10-26. Primary listing; single source for the claim.
- ransomware.live, "Ransomware: qilin named FIRMENGRUPPE APPL Holding GmbH (DE)", https://www.ransomware.live/id/RklSTUVOR1JVUFBFIEFQUEwgSG9sZGluZyBHbWJIQHFpbGlu. Context only; separate victim, not evidence about Power Funding.
8. Adverse Trace position
Adverse Trace assesses this as a low-confidence, unverified operator claim: a leak-site listing with no technical corroboration, no confirmed data theft and no confirmed encryption, against a UK financial firm that may be a third party to some clients. The severity of the underlying event cannot be scored from the material available, and we will not assign one. Client impact is limited to those with a live relationship to Power Funding and is primarily third-party and concentration risk rather than direct technical exposure. We will monitor the listing for the appearance of proof-of-data, samples or a ransom demand, re-issue this advisory if Power Funding confirms an incident or if Qilin publishes artefacts, and in the meantime advise affected clients to verify status directly with the firm and record the check against their DORA Art. 28 and NIS2 Art. 21(2)(d) obligations.
Published via PulseTrace — Adverse Trace threat intelligence.