qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
24▲10 vs prev. week
Victims · 30d
118active targets
Victims · 90d
360
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 21:48UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,256 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Centrotherm International | · Jan 25, 2026 | Industrial Machinery & Equipment |
| OKIN GROUP | · Jan 25, 2026 | Business Services |
| Şemsioğlu Uşak Ev Tarhanası | · Jan 25, 2026 | Food & Beverage |
| Shiffler Equipment Sales | · Jan 24, 2026 | Furniture |
| Borg Argentina | · Jan 24, 2026 | Agriculture |
| D & D Building | · Jan 24, 2026 | Construction |
| Herzing | · Jan 24, 2026 | Manufacturing |
| HARTE-BAVENDAMM Rechtsanwlte PartG mbB | · Jan 24, 2026 | Law Firms & Legal Services |
| Milott Laboratories | · Jan 24, 2026 | Consumer Services |
| YCC Parts Mfg | · Jan 23, 2026 | Consumer Services |
| Proleasing | · Jan 22, 2026 | Business Services |
| EDF Group | · Jan 22, 2026 | Electronics |
| SiNetCon | · Jan 22, 2026 | Consumer Services |
| Farmacias Vilela | · Jan 22, 2026 | Drug Stores & Pharmacies |
| Copetrol | · Jan 22, 2026 | Industrial Machinery & Equipment |
| Mutest | · Jan 21, 2026 | Insurance |
| Centro de Desarrollo Emprendedor Ensenada | · Jan 21, 2026 | Accounting Services |
| Kontena Nasional Berhad | · Jan 20, 2026 | Business Services |
| Altius Geotecnia y Obras Especiales | · Jan 20, 2026 | Civil Engineering Construction |
| Yumark Enterprises | · Jan 19, 2026 | Consumer Services |
| Casadei | · Jan 19, 2026 | Manufacturing |
| University Volkswagen Mazda | · Jan 18, 2026 | Business Services |
| Dreher Law Firm | · Jan 18, 2026 | Law Firms & Legal Services |
| Jampen Holzbau AG | · Jan 18, 2026 | Construction |
| Vietnam Airlines | · Jan 18, 2026 | Business Services |
| Balneario | · Jan 18, 2026 | 0 |
| Orthopaedic Specialists of Massachusetts | · Jan 17, 2026 | 0 |
| Cary Pediatric Center | · Jan 17, 2026 | 0 |
| Ilumno | · Jan 17, 2026 | Software |
| UGS | · Jan 17, 2026 | Business Services |
| Colacem | · Jan 17, 2026 | Building Materials |
| Laboratorios Smasac | · Jan 17, 2026 | Business Services |
| Fluorsid Spa | · Jan 17, 2026 | Business Services |
| Central Roofing South Wales | · Jan 17, 2026 | Construction |
| CFM Mozambique | · Jan 16, 2026 | Business Services |
| PSTECHLTD | · Jan 15, 2026 | Business Services |
| Krez & Flores | · Jan 15, 2026 | Law Firms & Legal Services |
| Texas State Utilities | · Jan 15, 2026 | Electricity, Oil & Gas |
| Neo Group | · Jan 15, 2026 | Food & Beverage |
| Moen | · Jan 15, 2026 | Building Materials |
| Aero-Coating | · Jan 15, 2026 | Manufacturing |
| Bergmanis Preyra | · Jan 15, 2026 | Law Firms & Legal Services |
| Gtech | · Jan 14, 2026 | Consumer Services |
| Ernest Maier | · Jan 14, 2026 | Building Materials |
| Designers Mirror and Glass | · Jan 14, 2026 | Construction |
| Pathology Associates Of Saint Thomas | · Jan 14, 2026 | 0 |
| Lunsford Capital | · Jan 14, 2026 | Finance |
| Pre-Con Builders | · Jan 14, 2026 | Construction |
| Radiant Remodeling | · Jan 14, 2026 | Construction |
| Resource Corporation of America | · Jan 12, 2026 | Business Services |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .