1. Executive summary
On 16 August 2026, the Qilin ransomware group publicly claimed a victim named DELTA WAYS, a Germany-based organisation (domain: www.deltaways.de). The actor "qilin" has no MITRE ATT&CK profile in the verified reference data; attribution is therefore unconfirmed. The claim was posted on the group's leak site and indexed by Ransomware.live. The same actor has claimed at least six additional victims in August 2026 across Germany and the Netherlands, including TQ Financial Services, indicating an active and broad targeting campaign. EMEA financial services clients should treat Qilin as an active threat, particularly given the inclusion of a financial services entity among recent victims.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | A ransomware actor has publicly claimed a victim, and the same actor has recently claimed a financial services entity (TQ Financial Services). | Financial entities should classify Qilin campaign activity as a relevant cyber threat for the purposes of their ICT incident classification and register it in their threat taxonomy. |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | If a client or a critical ICT third-party provider is confirmed as a Qilin victim, the public claim and potential data exfiltration may meet the criteria for a major incident. | Clients must be prepared to assess whether a confirmed compromise triggers the major-incident reporting timeline and notify competent authorities accordingly. |
3. Technical analysis & attack chain
Attribution caveat: The actor "qilin" has no MITRE ATT&CK profile in the verified reference data. Attribution to the Qilin ransomware group is based solely on the Ransomware.live listing — single-sourced; verify before enforcement.
Campaign context: Qilin has claimed at least seven victims in recent days, six of which are Germany-based and one Netherlands-based. The victims span construction, engineering, financial services, and logistics sectors:
| Victim | Country | Domain |
|---|---|---|
| DELTA WAYS | DE | www.deltaways.de |
| Sitmatic | DE | www.sitmatic.com |
| Clausing | DE | www.clausing-tiefbau.com |
| TQ Financial Services | — | www.tqfinancials.com |
| Urban Worldwide | NL | www.urbanworldwide.com |
| GURR Abdichtungstechnik GmbH | DE | www.gurr-abdichtungstechnik.de |
| dbHMS | DE | www.dbhms.com |
Confirmed facts about the DELTA WAYS claim
- Qilin posted DELTA WAYS as a victim on its leak site on or before 2026-08-16.
- The victim domain is www.deltaways.de; the organisation is based in Germany.
- Hudson Rock's Infostealer intelligence, surfaced via the Ransomware.live listing, reports 0 compromised employees, 0 compromised users, 2 third-party employee credentials, and 0 external attack surface findings for the victim domain.
- No leak screenshot or stolen data preview was available at time of writing.
- No technical details of the intrusion (initial access vector, malware sample, persistence mechanism, C2 infrastructure, or encryption methodology) are available in the source material.
Analytical note: The presence of 2 third-party employee credentials in the Hudson Rock data suggests a potential supply-chain or partner-compromise initial access vector, but this is correlational, not confirmed. No intrusion methodology, CVE exploitation, or malware-specific technical detail is available from the sources. The attack chain cannot be reconstructed from the provided material.
4. Mitigation & containment
P1 — Within 24 hours
- Assess whether your organisation has any business or supply-chain relationship with DELTA WAYS or any of the other named Qilin victims. If so, initiate incident response procedures and review for potential lateral exposure.
- Review threat-intel feeds for Qilin-specific IOCs. None are available in this source material; monitor for emerging indicators from multi-source reporting.
- Brief SOC and IR teams on the active Qilin campaign targeting German organisations and at least one financial services entity.
P2 — Within 72 hours
- Validate that backup and recovery procedures are operational and that offline backups exist for critical systems. Qilin is a double-extortion ransomware operation — both encryption and data exfiltration should be assumed.
- Review third-party and partner credential exposure. The Hudson Rock data for DELTA WAYS flags 2 third-party employee credentials — assess whether your own partner credential ecosystem has similar infostealer-derived exposure using commercial Infostealer intelligence services.
- Ensure EDR coverage is in place across all endpoints and that ransomware behaviour-detection rules are enabled.
P3 — Within 7 days
- Conduct a tabletop exercise simulating a Qilin-style double-extortion scenario, including public leak-site claims and regulatory notification decisions.
- Review and update the organisation's ICT incident classification taxonomy to include Qilin as a named threat, per DORA Art. 18 obligations.
- Monitor Ransomware.live and primary threat-intel sources for additional Qilin victims and any released IOCs.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, file paths, or URLs) are available in the source material. The source provides only victim identification data, not threat artefacts.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Public victim claim on Qilin leak site | Ransomware.live monitoring / dark-web threat-intel feeds | High — confirmed for DELTA WAYS |
| Third-party employee credential exposure (2 credentials) | Hudson Rock Infostealer intelligence platform | Medium — correlational, single-sourced |
| Targeting pattern: German organisations across construction, engineering, financial services | Ransomware.live victim corpus | High — corroborated across 7 victims |
6. Detection
Insufficient indicators to author detection rules. The source material contains no malware artefacts, command-line strings, file paths, registry keys, mutex names, network indicators, or ransom-note text. No YARA or Sigma rules can be produced from the available data.
7. Sources
- Ransomware.live — "Ransomware: qilin named DELTA WAYS (DE)" — https://www.ransomware.live/id/REVMVEEgV0FZU0BxaWxpbg== — Published 2026-08-16
- Ransomware.live — "Ransomware: qilin named Sitmatic (DE)" — https://www.ransomware.live/id/U2l0bWF0aWNAcWlsaW4=
- Ransomware.live — "Ransomware: qilin named Clausing (DE)" — https://www.ransomware.live/id/Q2xhdXNpbmdAcWlsaW4=
- Ransomware.live — "Ransomware: qilin named TQ Financial Services" — https://www.ransomware.live/id/VFEgRmluYW5jaWFsIFNlcnZpY2VzQHFpbGlu
- Ransomware.live — "Ransomware: qilin named Urban Worldwide (NL)" — https://www.ransomware.live/id/VXJiYW4gV29ybGR3aWRlQHFpbGlu
- Ransomware.live — "Ransomware: qilin named GURR Abdichtungstechnik GmbH (DE)" — https://www.ransomware.live/id/R1VSUiBBYmRpY2h0dW5nc3RlY2huaWsgR21iSEBxaWxpbg==
- Ransomware.live — "Ransomware: qilin named dbHMS (DE)" — https://www.ransomware.live/id/ZGJITVNAcWlsaW4=
8. Adverse Trace position
This is a low-fidelity, single-sourced advisory: the Qilin claim against DELTA WAYS is confirmed as a public leak-site posting, but no technical intrusion detail, IOCs, or malware artefacts are available. Attribution to "qilin" is unconfirmed per the verified reference data (no MITRE ATT&CK profile). The campaign is notable for EMEA financial services clients because Qilin has recently claimed TQ Financial Services as a victim, demonstrating intent and capability to target the sector. The Hudson Rock data flagging 2 third-party employee credentials for DELTA WAYS is a useful but correlational signal — it does not confirm the initial access vector. We will monitor for multi-source corroboration, emerging IOCs, and any technical reporting on Qilin intrusion methodology. Clients should treat this as situational awareness at present and escalate to active response only if a direct supply-chain or business relationship with a named victim is identified.
Published via PulseTrace — Adverse Trace threat intelligence.