> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ransomware: qilin named von Schaewen (DE)
- URL: https://f4n6.co.uk/security-feed/ransomware-qilin-named-von-schaewen-de/
- Published: 2026-10-24T09:33:07.000Z
- Updated: 2026-10-24T09:33:07.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

The qilin ransomware group listed von Schaewen, a German victim, on its leak site on 2026-10-23\. The only public detail is the victim name, country (DE) and website (www.von-schaewen.de); no data volume, deadline, sample, or negotiation status was published. No CVE is associated with this item, no CISA KEV entry applies, and no MITRE ATT&CK profile for qilin is available to corroborate the group's tooling or initial-access methods. The risk to EMEA financial services is indirect: qilin is an active extortion operation, and any supplier or counterparty relationship with the named victim warrants a third-party exposure check rather than a technical response.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

The source material does not describe an attack chain. Ransomware.live indexes the leak-site post only; it records the group, victim name, country and website, and states that it does not access or hold the underlying stolen data. No initial-access vector, exploited component, payload, persistence mechanism, command-and-control infrastructure, lateral-movement path, exfiltration volume or ransom demand is published.

What can be stated as confirmed:

1. qilin posted von Schaewen to its leak site on 2026-10-23 at 20:16 UTC.
2. The victim is recorded as located in Germany, with website www.von-schaewen.de.
3. No leak screenshot content, file listing or sample data was captured in the indexed page.

Everything beyond those three points is unconfirmed. The source does not state whether data was exfiltrated, whether encryption occurred, whether a ransom was demanded or paid, or whether the listing is a double-extortion claim with no supporting data. Treat the listing as an unverified extortion claim until the victim or a national authority confirms otherwise.

Attribution to qilin rests on the leak-site post itself, which is a single source and is operator-controlled. No MITRE ATT&CK profile for qilin is available in the reference data, so the group's tooling, infrastructure and affiliate structure cannot be corroborated here. Do not map this item to specific ATT&CK techniques on the strength of the listing alone.

## 4\. Mitigation & containment

The source gives no victim-side technical detail, so the actions below address third-party exposure and generic qilin resilience rather than a confirmed intrusion path.

P1 (within 24h)

- Check whether von Schaewen (www.von-schaewen.de) appears in your supplier register, vendor master, payment-beneficiary list or active contract set. If it does, treat the relationship as potentially compromised and suspend any change to bank details or payment instructions pending out-of-band verification with a known contact.
- Confirm no inbound mail, invoice or payment-remittance change has arrived from the von-schaewen.de domain in the last 30 days. If one has, quarantine it and review the payment for fraud.

P2 (within 72h)

- Ask any first-tier supplier that depends on von Schaewen to confirm whether their service is affected and whether they hold or process your data. Record the answer for your DORA Art. 28 third-party file.
- Review EDR and mail-gateway telemetry for qilin-associated activity against your estate. No atomic indicators are available from this source, so rely on behavioural detection (see §6) rather than IOC matching.

P3 (within 7 days)

- Re-test offline, immutable backups for the systems that support your highest-value payment and settlement flows. qilin is an extortion operation; the control that determines recovery is a restore you have actually performed, not a backup job that reports success.
- Confirm that privileged accounts used for payment infrastructure require phishing-resistant MFA and that helpdesk identity-verification procedures resist a caller who already holds employee data.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

The source publishes only the victim name (von Schaewen), country (DE) and website (www.von-schaewen.de). These are victim identifiers, not threat artefacts, and are not emitted as IOCs. No behavioural indicators are described either: the source records no authentication pattern, process activity or network traffic attributable to the intrusion.

## 6\. Detection

Insufficient indicators to author detection rules.

The source contains no malware strings, command-line flags, file paths, registry keys, ransom-note text or network artefacts. A rule built on the victim name or the group name would detect reporting about the event, not the threat, and is not emitted.

## 7\. Sources

- Ransomware.live, "Victim: von Schaewen – qilin", https://www.ransomware.live/id/dm9uIFNjaGFld2VuQHFpbGlu, published 2026-10-23.

## 8\. Adverse Trace position

Adverse Trace assesses this item as an unverified extortion claim with no technical corroboration: no CVE, no CISA KEV entry, no MITRE ATT&CK profile for qilin, and no indicators in the single source available. The severity to a given client depends entirely on whether von Schaewen sits in that client's supplier or payment chain, which we cannot determine from the listing. We will monitor the qilin leak site for a data release, deadline update or victim response over the next 14 days, and we will issue a follow-up if a leak dump, ransom demand or German authority statement appears. Clients with a confirmed von Schaewen relationship should contact their Adverse Trace analyst so we can scope the exposure against their third-party register.

---

[Read the original source →](https://www.ransomware.live/id/dm9uIFNjaGFld2VuQHFpbGlu?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*