Peru: Qilin and Rhysida in ransomware registry
Ransomware.live links Qilin and Rhysida to Peruvian government and private-sector domains, but part of the record is unclear.
The ransomware.live portal records Qilin activity involving corahperu.org, identified as the official site of the Special Project CORAH, described as a Peruvian government project. The same map also includes references to Gob.pe, FMP and CNPC Peru S.A., although some of that information is marked as AI-generated or lacks public detail on the impact.
The ransomware.live portal records activity tied to the Qilin and Rhysida groups involving Peruvian government and private-sector domains and entities, including corahperu.org, gob.pe, fmp.gob.pe and CNPC Peru S.A. Some of the record is uncertain, and the portal itself says certain information is "AI generated".
What does ransomware.live record about Qilin in Peru?
The ransomware.live portal records Qilin activity involving corahperu.org, identified as the official site of the Special Project CORAH, described as a project of the Peruvian government.
What other Peru-linked records appear on the map?
On the same map, ransomware.live mentions "Government of Peru" and the gob.pe domain, which the portal defines as the Single Digital Platform of the Peruvian state, in connection with Rhysida activity. The page does not publicly detail what kind of impact that link may have had, or the status of the intrusion.
The Peru entry also includes references to fmp.gob.pe, described as the MIVIVIENDA Fund of the Peruvian government, and to CNPC Peru S.A., an oil and gas company operating in the country, as entities linked to ransomware activity. In that section, the portal notes that part of the information is "AI generated", so the data should be treated with caution.
Based on the available material, the ransomware.live map points to possible attempts or compromises against public entities and an energy-sector company in Peru, with attributions to Qilin and Rhysida, but without additional public confirmation on the real scope of those events.
What coverage context accompanies the record?
Among the available sources is also the cybersecurity news section of Gestión, with references to Kaspersky forecasts for Peru. However, the material provided for this note does not include a recent public report confirming APT campaigns or state actors against government, banking or energy targets with attribution verified by official or threat-intelligence sources.
