qilin
23 victims claimedFirst seen Oct 22, 2026Last post 14h ago4 known sitesAssessed nexus: Russia
Russian-speaking RaaS that recruits affiliates on Russian-language forums (industry reporting)
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion - demanding payment for a decryptor, as well as for the non-release of stolen data.
Targeted sectors
- Other4
- Professional Services3
- Technology3
- Hospitality3
- Retail & E-Commerce2
- Manufacturing1
- Financial Services1
- Healthcare1
Targeted countries
- United States3
- Germany3
- Australia3
- Argentina2
- Mexico2
- Myanmar1
- Switzerland1
- United Kingdom1
Tactics and techniques (MITRE ATT&CK)
- Initial Access
- T1078 · Valid AccountsT1190 · Exploit Public-Facing ApplicationT1566 · PhishingT1566.003 · Phishing: Spearphishing via Service
- Execution
- T1059.001 · Command and Scripting Interpreter: PowerShellT1059.004 · Command and Scripting Interpreter: Unix ShellT1569 · System ServicesT1569.002 · System Services: Service Execution
- Persistence
- T1037 · Boot or Logon Initialization ScriptsT1053 · Scheduled Task/JobT1053.005 · Scheduled Task/Job: Scheduled TaskT1098.004 · Account Manipulation: SSH Authorized KeysT1136 · Create AccountT1547 · Boot or Logon Autostart Execution
- Privilege Escalation
- T1068 · Exploitation for Privilege Escalation
- Defense Evasion
- T1027 · Obfuscated Files or InformationT1036.001 · Masquerading: Invalid Code SignatureT1134.004 · Access Token Manipulation: Parent PID SpoofingT1211 · Exploitation for Defense EvasionT1480 · Execution GuardrailsT1497.001 · Virtualization/Sandbox Evasion: System ChecksT1553.002 · Subvert Trust Controls: Code SigningT1562.001 · Disable or Modify ToolsT1562.004 · Impair Defenses: Disable or Modify System FirewallT1564 · Hidden ArtifactsT1564.003 · Hidden Artifacts: Hidden Window
- Credential Access
- T1003.001 · OS Credential Dumping: LSASS MemoryT1040 · Network SniffingT1110.002 · Brute Force: Password CrackingT1555.003 · Credentials from Web Browsers
- Discovery
- T1012 · Query RegistryT1046 · Network Service DiscoveryT1082 · System Information DiscoveryT1614 · System Location Discovery
- Lateral Movement
- T1021 · Remote ServicesT1021.001 · Remote Services: Remote Desktop ProtocolT1021.002 · Remote Services: SMB/Windows Admin SharesT1021.004 · Remote Services: SSHT1570 · Lateral Tool Transfer
- Collection
- T1560.001 · Archive Collected Data: Archive via UtilityT1602.002 · Network Device Configuration Dump
- Exfiltration
- T1011 · Exfiltration Over Other Network MediumT1011.001 · Exfiltration Over Other Network Medium: Exfiltration Over BluetoothT1048.003 · Exfiltration Over Alternative Protocol: Unencrypted Non-C2 ProtocolT1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage
- Command and Control
- T1001 · Data ObfuscationT1001.001 · Data Obfuscation: Junk DataT1071.001 · Application Layer Protocol: Web ProtocolsT1572 · Protocol Tunneling
- Impact
- T1486 · Data Encrypted for ImpactT1490 · Inhibit System RecoveryT1561 · Disk WipeT1561.001 · Disk Wipe: Disk Content Wipe
- Resource Development
- T1587.001 · Develop Capabilities: Malware
Most recent victims
- White & CaseProfessional Services · United States14h ago
- Hossner-Textil GmbHManufacturing · Germany14h ago
- Ooredoo MyanmarTechnology · Myanmar15h ago
- ECOMRetail & E-Commerce · Switzerland21h ago
- ETOGermany1d ago
- Castle Howard EstateHospitality · United Kingdom1d ago
- SLTN Inter AccessNetherlands1d ago
- Commonwealth Community BankFinancial Services · United States2d ago
- Miljaus Producciones S.L (www.miljaus.com)Other · Spain2d ago
- von SchaewenOther · Germany2d ago
- Labaid Cancer Hospital And Super Speciality CenterHealthcare · Bangladesh2d ago
- Kale Balata AAgriculture and Food Production · Turkey2d ago
- MaxiSeguridadProfessional Services · Argentina2d ago
- AryzaTechnology · Argentina2d ago
- AerotopTransportation · Chile2d ago
- CDG Chartered AccountingProfessional Services · Australia2d ago
- Revi GroupOther · Mexico2d ago
- Coop ItaliaRetail & E-Commerce · Italy3d ago
- SEPIVERMexico3d ago
- United Restaurant SupplyHospitality · United States3d ago
- AirtificialTechnology3d ago
- Bathurst RSLHospitality · Australia3d ago
- Creative UniverseOther · Australia3d ago