qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
23▲9 vs prev. week
Victims · 30d
117active targets
Victims · 90d
361
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 17:40UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,255 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Kaemmerlen Solutions | · Mar 26, 2026 | Construction |
| Louise Medical Center | · Mar 26, 2026 | 0 |
| Living in green, s. r. o. | · Mar 26, 2026 | Home Improvement & Hardware Retail |
| Mac Interiors | · Mar 26, 2026 | Construction |
| LP Kolding | · Mar 26, 2026 | Building Materials |
| Noi Hotels | · Mar 26, 2026 | Hospitality |
| Aroostook Mental Health Services | · Mar 24, 2026 | 0 |
| Retail Centenario | · Mar 24, 2026 | Business Services |
| Groupe SFPI | · Mar 23, 2026 | Building Materials |
| J E Culp Transport | · Mar 22, 2026 | Freight & Logistics Services |
| Southern Commercial Real Estate | · Mar 22, 2026 | Real Estate |
| Southwire | · Mar 22, 2026 | Manufacturing |
| Marc Dorcel | · Mar 22, 2026 | Broadcasting |
| nPower Technologies | · Mar 22, 2026 | Software |
| Elite Limousine Plus | · Mar 22, 2026 | Business Services |
| Grupo Coril | · Mar 21, 2026 | Banking |
| Muffett | · Mar 21, 2026 | Industrial Machinery & Equipment |
| Nanxun Enterprise Co., Ltd. | · Mar 21, 2026 | Architecture, Engineering & Design |
| Millerfoto | · Mar 21, 2026 | Consumer Services |
| WAL Consultant | · Mar 20, 2026 | Architecture, Engineering & Design |
| AGENCAVI SRL | · Mar 20, 2026 | Industrial Machinery & Equipment |
| VirtualExpo Group | · Mar 20, 2026 | Accounting Services |
| Accolend | · Mar 19, 2026 | Finance |
| Enviaseo ESP | · Mar 19, 2026 | Industrial Machinery & Equipment |
| BTX Global Logistics | · Mar 18, 2026 | Freight & Logistics Services |
| hollu Systemhygiene | · Mar 18, 2026 | Food & Beverage |
| Arca Service | · Mar 18, 2026 | Hospitality |
| Elite Flower | · Mar 18, 2026 | Retail · Pennsylvania |
| Jacobs & Sons | · Mar 18, 2026 | Retail · Pennsylvania |
| Sievert Electric Service and Sales | · Mar 18, 2026 | Industrial Machinery & Equipment |
| Productos La Aguadillana | · Mar 18, 2026 | Food & Beverage |
| L H Lacy | · Mar 18, 2026 | Construction |
| Affinity Designs | · Mar 18, 2026 | Retail · Pennsylvania |
| Shwapno | · Mar 17, 2026 | Retail · Pennsylvania |
| Von Weise Associates | · Mar 16, 2026 | Architecture, Engineering & Design |
| PINNACLE TAX INC | · Mar 16, 2026 | Business Services |
| MCC Economics | · Mar 16, 2026 | Business Services |
| Ruhnau Clarke | · Mar 16, 2026 | Architecture, Engineering & Design |
| Biogel | · Mar 16, 2026 | Chemicals & Related Products |
| Salag | · Mar 15, 2026 | Home Improvement & Hardware Retail |
| Duffy's Sports Grill | · Mar 14, 2026 | Hospitality |
| Alarmco | · Mar 13, 2026 | Business Services |
| FMRS Health Systems | · Mar 13, 2026 | 0 |
| Millard Manufacturing | · Mar 13, 2026 | Industrial Machinery & Equipment |
| RMZ Oilfield Engineering | · Mar 13, 2026 | Industrial Machinery & Equipment |
| Syed Professional Services | · Mar 12, 2026 | Accounting Services |
| TDS Construction | · Mar 12, 2026 | Construction |
| Silvon Software | · Mar 12, 2026 | Software |
| Arimex Importadora | · Mar 11, 2026 | Electronics |
| Fortress Systems | · Mar 11, 2026 | Electronics |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .