QILIN

Summary

Identity

Qilin first appeared as Agenda in July 2022. Trend Micro documented the first Golang samples that August, the first victim appeared on the leak site in October, and the operators rewrote the malware in Rust in December. HighS1,S3 The operators changed the name to Qilin in September 2022 but continued using both names. Researchers still use Agenda, and Trend Micro, Group-IB, and HHS HC3 treat Agenda and Qilin as the same operation. MITRE ATT&CK tracks the malware as S1242. ConfirmedS1,S2 HighS1,S3,S4

The operation remains active. Multiple vendors ranked Qilin as the most active ransomware operation for much of the period from mid-2025 through H1 2026, when it posted new victims to its leak site every week. Its lead narrowed in Q2 2026. Most trackers still placed Qilin first for the quarter, with The Gentlemen a close second, though ReliaQuest put The Gentlemen first. The Gentlemen took the monthly lead in June 2026, and Qilin's monthly output fell by roughly a third from April to June. The U.S. ATF is its most recent confirmed victim; the agency confirmed the incident on 2026-08-26. HighS5,S6,S7,S8

I assess with high confidence that Qilin operates from Russia. The public indicators support this: Russian-language affiliate recruitment on RAMP, an affiliate rule against attacking CIS targets, and CIS-locale exclusion built into the encryptor. My confidence also rests on additional Arkem reporting beyond these public indicators. The Chinese-mythology name does not establish a Chinese connection, and I found no source tying the operators to China. HighS1,S3,S9,S67

Figure 1. Affiliate ecosystem. Each link is attributed to its source and coded by confidence. Confirmed links, Moonstone Sleet and the Group-IB panel, are separated from reported or unverified ones such as the alleged DragonForce coalition and the code-overlap lineage.

Operating model

Qilin runs a ransomware-as-a-service program built around double extortion. The core operators maintain the encryptor, leak site, and negotiation infrastructure, while affiliates conduct the intrusions. Group-IB infiltrated the program in March 2023 through a private Tox conversation with the recruiter Haise and documented the affiliate structure, payment split, and sections of the admin panel. HighS3 Affiliates reportedly keep about 80% of ransoms up to USD 3 million and about 85% above that. The operators take the remainder. ModerateS3,S10

The operation recruited affiliates on the Russian-language RAMP forum, where Group-IB tied its 2023 activity to Haise. The FBI seized RAMP on 2026-01-28, and its administrator, Stallman, said he would not rebuild it. Qilin moved its recruitment to other forums. ModerateS3,S10 / on RAMP seizureConfirmedS55,S56 First-party collection later observed a Qilin-branded recruitment thread on RootSploit from 2025-12-25 through 2026-07-17. The thread remained active across the RAMP seizure, sought experienced Active Directory pentest teams, and directed applicants to the public Tox address listed in the Indicators. The account advertised four encryption modes, Safe Mode execution, log and shadow-copy clearing, network spread, a build configurator, Call Lawyer support, and Rust for Windows with C for Linux and ESXi. Those features match vendor reporting on Qilin (S51, S6). The dated thread and Tox are direct observations, and I assess the account as genuine Qilin recruitment rather than an imposter. observation: thread, dates, ToxHighS53 first-party, Tier 1 / genuine Qilin recruitmentHighS51,S53

Qilin gains affiliates but also loses experienced operators. ArmCorp, a high-volume affiliate using the handle Hastalamuerte, began building its own encryptor by about 2025-07-17. Days later, it argued publicly with Qilin's operators on RAMP over withheld payouts. Group-IB assesses that the dispute provided cover for a planned exit rather than causing it. ArmCorp launched The Gentlemen on 2025-09-12 as a competing service with a 90/10 split, and PRODAFT records The Gentlemen's operators as former affiliates of Qilin, Embargo, LockBit, Medusa, and BlackLock. on defection, dispute, datesModerateS49,S50,S52 / on the reported USD 48,000 commissionLowS54

Qilin also recruited affiliates displaced by the shutdown of ALPHV/BlackCat and RansomHub and by LockBit's decline after Operation Cronos. LockBit still operates, but at a fraction of its former scale. Vendors connect that influx to Qilin's growth in 2025, and at least one state actor has used the service. ModerateS6,S11 The operators began advertising DDoS support around April 2025 and a Call Lawyer feature in mid-2025. They claim Call Lawyer connects affiliates with legal counsel who can pressure victims, but I found no evidence confirming that claimed support. UnverifiedS12,S13

Linked actors and reported relationships

North Korea's Moonstone Sleet, formerly Storm-1789, developed its own ransomware called FakePenny. Microsoft attributed FakePenny to the group in May 2024 after an April 2024 attack with a USD 6.6 million demand. Beginning in February 2025, Moonstone Sleet also deployed Qilin in a small number of attacks. Microsoft reports that this was the first time the group used a RaaS operator's payload instead of its own. on FakePennyHighS58 / on Qilin deploymentHighS14

The other reported relationships are less certain. Several vendors identify Scattered Spider as a Qilin affiliate or partner, but I did not find evidence confirming the relationship. ModerateS6,S11 Arkana Security appeared in March 2025 using "Qilin Network" branding, but that relationship also remains unverified. UnverifiedS11 Researchers have reported infrastructure overlap with BianLian and code similarities between early Agenda samples and Black Basta, BlackMatter, and REvil. That may point to a shared development source in the Russian cybercrime underground, but it does not establish lineage. LowS11

DragonForce promoted a coalition with Qilin and LockBit in September 2025. An account named "dragonforce" posted the proposal on RAMP on 2025-09-15, LockBit replied in agreement, and Qilin flatly denied any alliance or sharing of software, infrastructure, or affiliates when researchers asked. Five independent analyses (ZeroFox, DataBreaches.net, Yarix, Halcyon, and SuspectFile) found no shared infrastructure, tooling, or joint operations. The cartel framing traces to ReliaQuest's Q3 2025 report, which said the collaboration was "expected to" facilitate sharing, a forward-looking expectation rather than an observation; some secondary outlets later upgraded that to "traced shared infrastructure," which the primary does not support. DragonForce's encryptors are built from the LockBit 3.0 builder that leaked publicly in September 2022, which many groups adopted. That points to LockBit losing control of its builder, not to a relationship with LockBit, and Qilin has no such lineage. UnverifiedS15,S16,S59,S60,S61,S62,S63,S68

Targeting

Qilin targets organizations worldwide across many sectors. Manufacturing accounts for roughly 14 to 23% of claimed victims in vendor datasets, more than any other sector, followed by professional and scientific services, technology, and healthcare. The victim lists also include energy, financial services, retail and wholesale, education, and government. HighS6,S17,S18 Vendor datasets place victims in 60 to 108 countries. GuidePoint reported that the United States accounted for about 51% of victims in Q1 2026, with the UK, Canada, France, and Germany following at much lower levels. In September and October 2025, the Korean Leaks campaign caused a spike in South Korean financial-sector victims after an upstream MSP was compromised. HighS17,S19

The operation bars affiliates from attacking CIS targets, including Russia and Belarus, and its encryptor avoids CIS locales. I base that assessment on the affiliate rules and malware behavior. I did not find a published builder configuration that confirms it. ModerateS9,S20

Confirmed victims

The most consequential confirmed Qilin incident is the 2024 attack on Synnovis, a UK NHS pathology provider. Synnovis confirmed the attack on 2024-06-03 after it disrupted pathology and blood testing across King's College Hospital, Guy's and St Thomas', and other trusts. More than 10,000 outpatient appointments and about 1,700 elective procedures were affected. In June 2025, King's College Hospital NHS Foundation Trust confirmed that a delayed blood-test result caused by the attack contributed to a patient's death, the first UK fatality publicly linked to a cyberattack. Synnovis placed direct costs above GBP 32 million, while some case studies cite as much as GBP 37.7 million. Qilin demanded USD 50 million and published about 400 GB of data on 2024-06-20 after non-payment. ConfirmedS21,S22,S23

Asahi Group Holdings confirmed a ransomware attack and data theft in late September and October 2025. The incident disrupted production across much of the Japanese brewer's roughly 30 factories and reportedly caused tens of millions of dollars in lost revenue. Qilin claimed responsibility and said it stole about 27 GB of data. The intrusion and disruption are victim-confirmed; the amount of stolen data remains an actor claim. on incidentHighS24,S25 / on data-theft specificsUnverifiedS24

ATF confirmed a cybersecurity incident involving a standalone system that held information on agency investigation targets, and DOJ designated it a major incident on 2026-08-26. ATF did not attribute the breach to Qilin. Qilin listed the agency on its leak site that week but did not post sample data. on breachConfirmedS26 / on Qilin attributionUnverifiedS26 Other victim-acknowledged incidents reported by credible media include Lee Enterprises, Cobb County in Georgia, Covenant Health, and Court Services Victoria in Australia. HighS6,S27

Claimed activity

Leak-site counts are not confirmed breach totals. Depending on the tracker, Qilin has made more than 1,900 to more than 2,200 claims since the operation began, with more than 800 in 2026. UnverifiedS8,S28 Notable claims include Malaysia Airlines and Malaysia Airports in February 2026; Nissan Creative Box, with about 4 TB claimed, in August 2025; International Game Technology; SK Group; Volkswagen Group France, with about 150 GB claimed; and the Church of Scientology. UnverifiedS25,S29

Figure 2. Claimed-victim volume, 2023 to 2026. These are self-claimed leak-site listings aggregated by third-party trackers, not confirmed breaches. Vendor methods and totals differ.

Tradecraft

Initial access varies by affiliate. Common methods include compromised or stolen VPN credentials, often for accounts without MFA and sometimes purchased from access brokers; spear-phishing; and exploitation of internet-facing remote-access and backup appliances. One Qilin intrusion should not be used as a template for all of them. HighS30,S31

Across affiliate intrusions, researchers have observed Valid Accounts (T1078), Exploit Public-Facing Application (T1190), and Phishing (T1566) for initial access. Credential theft includes LSASS dumping with embedded Mimikatz (T1003.001). Sophos also documented mass theft of Chrome-stored credentials through a logon GPO and PowerShell in 2024 (T1555.003, T1552.001). Affiliates move laterally with PsExec, RDP, and WinRM (T1570, T1021.002). They bring their own vulnerable drivers to disable EDR (T1068, T1562.001) and run the Linux encryptor inside Windows Subsystem for Linux to evade Windows EDR (T1202). For impact, Qilin deletes shadow copies and ESXi VM snapshots (T1490) and encrypts data (T1486). Exfiltration tools include Rclone, MEGA, and FTP (T1567). HighS32,S33,S34

The encryptor can also reboot a host into Safe Mode, log in automatically, and run the payload again. It creates a Run-key value with an asterisk prefix, forcing the entry to execute in Safe Mode (Registry Run Keys T1547.001, Safe Mode Boot T1562.009). This defeats recovery attempts based on rebooting into Safe Mode. Incident-response analysis found the value pointing to a payload in C:\PerfLogs. First-party recruitment material advertised the feature, and vendor reporting confirms it. ModerateS48,S51,S53

Exploited CVEs

Every entry in this table has a source that specifically names Qilin exploitation. The broader FortiGuard capability-association list does not meet that standard and is not treated as confirmed exploitation.

FortiGuard associates roughly four dozen additional CVEs with Qilin operators. It presents them as a capability-association list, not as confirmed Qilin exploitation. I excluded them from the table for that reason. LowS40

The original encryptor was written in Golang, and the operators moved to Rust in December 2022. The Qilin.B variant, first reported in October 2024, uses AES-256-CTR and RSA-4096 and can tamper with services and logs before deleting itself. Qilin runs on Windows and Linux and has a purpose-built ESXi variant that stops VMs, releases VMDK locks, and deletes snapshots. Tools seen across affiliate intrusions include embedded Mimikatz, Cobalt Strike, PsExec, WMIC, AnyDesk, ScreenConnect, Splashtop, Rclone, and MEGA. HighS1,S32,S34

Qilin normally uses double extortion. Affiliates encrypt systems and threaten to publish stolen data on the leak site, although some activity from 2024 through 2026 relied more heavily on data theft for pressure. Reported demands range from tens of thousands of dollars to tens of millions; Qilin demanded USD 50 million from Synnovis. HighS3,S22 I found no legitimate free Qilin decryptor as of mid-2026. Multiple vendors report the same, and Qilin does not appear on the No More Ransom project. Recovery depends on backups. Sites promising a guaranteed Qilin decryptor are selling data-recovery services, not offering a free tool. HighS46,S47

Infrastructure and finance

Qilin runs a Tor leak site known as the Qilin blog and added a clearnet mirror branded WikiLeaksV2 in May 2024. The mirror copies the name of a well-known disclosure organization and exposes victim data to search engines instead of keeping it behind Tor. Qilin also hosts individual victim dumps on separate onion addresses. Its leak infrastructure is unreliable and has gone offline for several days at a time. Negotiations take place through dark-web portals and Tox. HighS41,S42

Flare surfaced a Tor-forum repost of an April 2026 incident-response analysis covering a Qilin intrusion from mid-2025. The analyst recovered a ransom note that identified wikileaks2.site as the media page and listed two onion addresses for the leak blog. This shows that Qilin payloads still referenced WikiLeaksV2 during the July 2025 incident. Public reporting indicates the .site domain has since lapsed to registrar parking, while the operational WikiLeaksV2 mirror is wikileaks2.com, live since May 2024 and actively posting victims. The Indicators section includes the two onion addresses and the FTP and staging IPs from the same report, all in defanged form. ModerateS48,S64,S66

Indicators (defanged)

Indicators are defanged ([.], [:]) for safe handling. They are provided for detection, blocking, and pivoting. Long hex strings and onion addresses were transcribed from dark-web sources. Verify them before automated ingestion. Each row includes confidence and provenance.

Infrastructure and contact

Personas / handles

Finance

No verified Qilin-specific revenue total exists. GuidePoint's GRIT 2026 report provides the most detailed actor-specific chain analysis I found. It identified at least 128 on-chain payments against 869 victims posted in 2025, for a payment rate of at least about 14.79%. Wallets tied to Qilin and its affiliates received at least about USD 47 million in 2025, with an average payment of about USD 366,000. Those figures are lower bounds based only on observable on-chain payments, not a verified total. Chainalysis documented the wider 2025 trend: total ransomware payments fell about 8% to roughly USD 820 million while claimed attacks rose about 50%. About 28% of victims paid, and the median payment increased to roughly USD 60,000. ModerateS43,S44

No Tier 1 chain analysis provides a lifetime revenue figure for Qilin. GRIT's estimate of roughly USD 47 million in on-chain receipts for 2025 is the strongest available data point, but it remains a lower bound. Weaker reporting claims Qilin collected more than USD 50 million in 2024, and I found no Tier 1 corroboration for that figure. Synnovis and Asahi each reported victim-side losses in the tens to hundreds of millions, but those costs are not Qilin revenue. Every figure in this section should be treated as a dated estimate, not a verified total. ModerateS43,S22,S24 Reported demands range from tens of thousands of dollars to the USD 50 million Qilin demanded from Synnovis and scale with the size of the target. ModerateS22

Timeline

Figure 3. Operational timeline. Green nodes are government, vendor, or victim-confirmed. Red nodes are self-claimed or unverified.

• July 2022: Qilin begins as Agenda. Trend Micro documents the first Golang samples the following month. HighS1,S3
• September 2022: The operators rename it Qilin and later rewrite the malware in Rust. HighS1,S3
• December 2022: The Rust variant appears with intermittent encryption and stronger evasion. HighS3
• March 2023: Group-IB infiltrates the operation and documents the affiliate panel, builder, 80/85 payment split, and the RAMP recruiter Haise. HighS3
• June 2024: HHS HC3 publishes a Qilin threat profile. Qilin attacks Synnovis on 2024-06-03, disrupts London pathology services, demands USD 50 million, and publishes about 400 GB on 2024-06-20 after non-payment. ConfirmedS4,S22
• July and August 2024: Sophos documents the group using a logon GPO to steal Chrome-stored credentials, unusual tradecraft for a ransomware operation. HighS32
• February and March 2025: Microsoft observes Moonstone Sleet deploying Qilin, its first known use of a RaaS payload instead of its own FakePenny ransomware. HighS14
• April to June 2025: Researchers report Qilin-linked exploitation of FortiGate CVEs in the Phantom Mantis campaign and pre-disclosure exploitation of SAP NetWeaver CVE-2025-31324. HighS30,S36
• June 2025: King's College Hospital NHS Foundation Trust confirms disruption from the Synnovis attack contributed to a patient's death. ConfirmedS23
• September 2025: An account named "dragonforce" proposes a coalition with Qilin and LockBit on RAMP. Qilin denies any alliance, and four independent analyses find no technical evidence of joint operations. UnverifiedS15,S16,S59
• September and October 2025: The Korean Leaks campaign hits about 28 South Korean financial-sector victims through an upstream MSP. Bitdefender reports possible Moonstone Sleet involvement, and Qilin claims the victim-confirmed Asahi intrusion. on campaignHighS19,S24 / on state involvementModerateS19
• Late 2025: Vendors rank Qilin the year's most active operation, with trackers recording more than 1,000 claimed victims and more than 40 claims a month in the second half. HighS6,S17
• 2026-01-28: The FBI seizes RAMP, the main forum where Qilin recruited affiliates. Authorities do not charge Qilin's operators or take down its infrastructure, and recruitment moves elsewhere. Rapid7 tracks migration to Tierone and Rehub. ConfirmedS55,S56,S57
• Q1 and Q2 2026: Qilin's lead narrows. Most trackers rank it first for Q2 with The Gentlemen a close second, though ReliaQuest ranks The Gentlemen first. The Gentlemen takes the June monthly lead, and Qilin's monthly output falls by roughly a third from April to June. HighS8,S45,S61
• May and June 2026: Researchers report Qilin-affiliate exploitation of Check Point VPN CVE-2026-50751 from 2026-05-07 and Palo Alto PAN-OS CVE-2026-0257. CISA adds the Check Point flaw to KEV. HighS37,S38,S39
• 2026-08-26: ATF confirms a cybersecurity incident that DOJ designates a major incident. Qilin had listed the agency on its leak site. on breachConfirmedS26 / on attributionUnverifiedS26

Law enforcement and legal

I found no indictments, takedowns, arrests, or infrastructure seizures against Qilin's core operators or infrastructure as of 2026-08-28. Gap The FBI's 2026-01-28 seizure of RAMP affected a shared recruitment venue rather than Qilin itself. Qilin had used the forum to recruit affiliates and moved that activity to other forums after the seizure. Rapid7 documented migration to Tierone and Rehub. ConfirmedS55,S56,S57

The U.S. Treasury sanctioned the Aeza Group bulletproof-hosting operation in July 2025. Treasury named BianLian and other groups that used Aeza, but it did not name Qilin. LowS11 I found no OFAC or DOJ designation specific to Qilin as of 2026-08-28. Gap HHS HC3 published a Qilin threat profile in June 2024, and CIS and MS-ISAC published a Qilin advisory in Q2 2025. I found no dedicated CISA or FBI StopRansomware advisory for the group. HighS4,S18

Analyst assessment

Qilin has remained active because it runs a competitive RaaS program and continues to attract affiliates. It became the most active ransomware brand of 2025 and held or shared the top position into H1 2026. No single campaign explains that growth. Qilin offers affiliates an 80 to 85% share, supports Windows, Linux, and ESXi, and uses a clearnet leak mirror to increase pressure on victims. It also recruited affiliates displaced by the shutdown of ALPHV/BlackCat and RansomHub and by LockBit's decline.

The affiliate model is the main attribution problem in this card. The same Qilin payload can appear in intrusions run by actors with different skills, targets, and objectives. Microsoft confirmed that North Korea's Moonstone Sleet deployed Qilin. Other affiliates are ordinary financially motivated criminals. You cannot treat their tradecraft as if it came from one crew.

I found no technical evidence supporting the coalition that DragonForce promoted with Qilin and LockBit in September 2025. Qilin denied any alliance, and four independent analyses found no shared infrastructure or operations. DragonForce's use of the leaked LockBit 3.0 builder is its own lineage and does not tie Qilin to LockBit. I rate the overall assessment Moderate because Qilin is a multi-affiliate service, most victim counts come from the group's own leak site, and no verified Qilin-specific revenue total exists. Moderatederived

Outlook

Without law-enforcement disruption, I assess that Qilin will very likely remain among the two or three most active ransomware operations through the rest of 2026. It may not stay in first place. The Gentlemen is growing quickly, and researchers tracked more than 90 active groups in Q2 2026. Qilin affiliates will likely continue to weaponize new flaws in edge devices and remote-access products, hit healthcare and manufacturing, and expand activity in Asia-Pacific. Do not treat claims of a LockBit or DragonForce coalition as evidence of joint operations. Qilin denied it, and the available evidence points to marketing rather than shared operations. Low–Moderatederived

Intelligence gaps

The identities and location of Qilin's core operators remain unresolved. Haise, the RAMP recruiter, is the only known handle, and no dox, indictment, or sanction ties that persona to a real identity. The real-name attribution for Hastalamuerte and ArmCorp identifies the administrator of The Gentlemen, a former Qilin affiliate. It does not identify Qilin's core operators.

Cry0 still needs adjudication. First-party collection records the handle as a prospective Qilin affiliate, but reporting on the T1erOne forum also describes Cry0 as a separate group. I could not resolve which entity the name identifies. ShadowByt3 appears in the same 2026 recruitment chatter but remains an unverified lead with no tie to confirmed Qilin activity.

No verified Qilin-specific revenue total exists. Chain analysis provides a lower bound, not a final number. Trackers list more than 1,900 to more than 2,200 self-claimed victims, but only a small subset are confirmed breaches, and vendor totals differ because their methods differ.

I found no verified operational alliance among Qilin, LockBit, and DragonForce. DragonForce promoted the coalition, Qilin denied it, and no technical evidence supports shared operations. The boundary between Qilin's core operators, ordinary affiliates, and state users such as Moonstone Sleet also remains unresolved, preventing clean attribution at the brand level.

Qilin's leak infrastructure is unreliable, and WikiLeaksV2 is not consistently available. The wikileaks2.site URL from the recovered ransom note has since lapsed to registrar parking, while the operational clearnet mirror wikileaks2.com remains active (S64, S66).