Movitecnica Data Breach

Movitecnica, a manufacturing company based in Peru, was identified as a target of the Qilin ransomware group when it was listed on their dark web leak site on August 19, 2026. This listing represents another instance of the Qilin group targeting entities in Latin America. The identification of this claim was made possible through SOCRadar’s Dark Web Monitoring service. Movitecnica operates in the industrial equipment and technical services sector, which can be attractive to ransomware actors due to the potential for significant operational disruption and the value of intellectual property. In the 60 days leading up to this listing, the Qilin ransomware group claimed approximately 196 victims. The group primarily targets the Manufacturing, Professional Services, and Technology sectors, with a concentration of victims in the United States, Germany, and France. Recent attacks on the manufacturing sector have included companies like Megawide in the Philippines, Botek in Germany, Teikoku USA, and motorenmaier gmbh in Germany, indicating a pattern of targeting this industry. Movitecnica’s placement within this ongoing campaign suggests a continuation of Qilin’s established operational patterns.

SOCRadar’s analysis of stealer-log telemetry related to movitecnica[.]com.pe yielded 11 records. These records were specifically identified as employee credentials associated with organizational systems. A significant number of these credentials, involving @movitecnica[.]com.pe accounts, were linked to Microsoft Entra ID, Microsoft Live authentication, and OAuth2 authorization endpoints. The time frame for these credentials spans from February 2024 to July 2026, indicating a persistent exposure of credentials over more than two years. This longevity, coupled with multiple distinct usernames and varying geographic origins, suggests either a lack of regular credential rotation or a recurring compromise of endpoints. Further examination of the telemetry revealed two records associated with crosoftonline[.]com, a domain designed to mimic Microsoft’s legitimate login page. This discovery raises concerns about potential phishing attacks or sophisticated credential interception methods targeting Movitecnica’s employees. While these findings do not definitively confirm a successful ransomware deployment by Qilin, the persistent exposure of Microsoft identity credentials, combined with the presence of a potential phishing indicator, aligns with the typical pre-staging activities observed in Qilin ransomware operations. Assessment: Infostealer-sourced credentials are a known entry vector for the Qilin ransomware group, often involving access brokers who acquire fresh logs, validate corporate accounts, and use them to authenticate into Microsoft 365 or VPN portals before deploying ransomware. The observed telemetry for Movitecnica, while not direct confirmation of Qilin’s intrusion, highlights a significant and prolonged exposure of Microsoft identity credentials. This, alongside the identified phishing indicator, presents a scenario consistent with the preparatory stages of a ransomware attack. The identified telemetry points to several critical actions for Movitecnica. These include rotating credentials for all affected @movitecnica[.]com.pe accounts, conducting a thorough review of Azure sign-in logs for any unusual or anomalous activity, and investigating the specific hits against the crosoftonline[.]com domain to determine the source and scope of the potential phishing or credential harvesting.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.