qilin

Qilin, also tracked as Agenda, is a ransomware-as-a-service operation first documented in 2022. Affiliates use double extortion: they steal data, encrypt systems with Go and later Rust ransomware, and pressure victims through a data-leak site. Public reporting describes a Russian-speaking criminal ecosystem, not a confirmed state nexus. In 2026, multiple outlets reported that Japan detained a suspected Russian Qilin operative who was extradited to Germany, where authorities arrested an alleged core member. Leak-site tracking for this dashboard nevertheless still showed heavy listing volume into October 2026 (23 names in seven days and 349 over 90 days, last post 2026-10-09), so the brand appears operationally active. Impact is opportunistic across sectors; the widely reported June 2024 Synnovis incident disrupted NHS pathology services in London.