qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
25▲11 vs prev. week
Victims · 30d
119active targets
Victims · 90d
360
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 23:46UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,257 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Mecklenburg County Public Schools | · Oct 6, 2025 | Charlotte-Mecklenburg School District, USA - Do you keep your children's secrets? They are the most precious thing you have. They must not be betrayed. And that is exactly what the Charlotte-Mecklenburg School District (CMS) specializes in. T ... |
| mcgeorgeai.com | · Oct 6, 2025 | McGeorge Architecture Interiors (MAI), USA - свободный доступ в любой дом. MAI is a full service architecture and interior design firm specializing in corporate office, retail projects of all varying scopes and sizes, ... |
| ville-saintclaude.fr | · Oct 6, 2025 | Mairie de Saint-Claude, France - life on a volcano. Saint-Claude is a commune in the Jura department, in the Burgundy-Franche-Comté region. It is the administrative center of the arrondissement of Saint-Claude and the canton of Saint-Claude. ... |
| kecymetals.com | · Oct 6, 2025 | Kecy Metal Technologies, USA - Terrible management, outdated equipment, uncompetitive salaries. This is how employees describe working conditions at Kecy Metal Technologies on condition of anonymity. The company was founded in 1988 in Michiga ... |
| Lipapromet | · Oct 6, 2025 | Lipapromet, Croatia - is there light at the end of the tunnel? This Croatian company was founded in Zagreb in 1990. It specializes in LED lighting solutions. According to financial reports, Lipapromet's annual revenue in 2024 was €31,728,95 ... |
| Rihatec.de | · Oct 5, 2025 | Rihatec Systemlösungen, Germany - Automation of control systems, innovative solutions, cooperation with large corporations. Sounds impressive, doesn't it? However, there is one caveat. Rihatec Systemlösungen GmbH was founded in 1995 near Mu ... |
| uhlcompany.com | · Oct 5, 2025 | Imagine that the building where you live or work has gone haywire. You can't turn the lights on or off, the heating and air conditioning systems are out of order, and the video cameras have stopped focusing on the right areas. Do you think th ... |
| AIP Asset Management | · Oct 4, 2025 | AIP Asset Management, KoreanLeak3 - is a global financial error. A company with a market-leading specialization in alternative investment strategies. AIP provides institutional and retail clients with access to customized investments that gi ... |
| Corban OneSource | · Oct 4, 2025 | Corban OneSource, USA - maximize risks to compliance. Company provides comprehensive HR outsourcing services, including payroll administration, employee benefits management, and HR support, aimed at reducing risks and improving organizational ... |
| IONODES | · Oct 4, 2025 | IONODES, Canada - Privacy? No, we don't know about that. The company supplies and configures solutions for IP video storage, management, and display. Its products include smart devices such as IP video encoders and decoders, NVR servers, reco ... |
| sagchip.org | · Oct 2, 2025 | the Saginaw Chippewa Indian Tribe of Michigan, USA - It's impossible to keep a poker face now. This small community of about 3,000 people is located in Isabella County, near Mount Pleasant. The tribe owns gas stations, a water park, a hotel, ... |
| Mitchell Industries | · Oct 2, 2025 | Mitchell Industries, USA - like sand through one's fingers. The company manufactures Accu-Weld¢ wedge wire screens for applications in both the petroleum and refining industries. The family-owned company has been in business for many years a ... |
| Shamir Medical Center | · Oct 2, 2025 | We have successfully infiltrated and gained full access to your systems at Shamir Hospital, the largest medical facility in Israel. Over the course of our operation, we have exfiltrated approximately 8 terabytes of sensitive and confidential ... |
| Mitrani Rynor Adamsky & Toland | · Oct 1, 2025 | The company has failed to contact us. Full file directory: http://securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion/data/12/ -- Files of interest -- Trial list including discovery and perso ... |
| Foremost Asset Management | · Sep 30, 2025 | Foremost Asset Management, KoreanLeak3 - First and foremost, they forgot the rules of survival in the market. Company was established in 2021 in Seoul, South Korea. Young businessman Kim Yong-chol was confident that he could manage investment ... |
| Rectory School | · Sep 30, 2025 | Rectory School, USA - What began as a charitable educational project has, turned into a money-making machine for children. The school, founded by Reverend Frank H. Bigelow in 1920, is now far removed from its philanthropic ideals. Sending you ... |
| TRAUM Investment Co. | · Sep 30, 2025 | TRAUM Investment Co., KoreanLeak3 - We confirm your fears. TRAUM Investment, a major player in the country's stock market, appeared in 2016. The company now has capital of 3.8 billion won ($2.7 million) and an investment portfolio of 119.8 bi ... |
| Petraville Asset Management | · Sep 30, 2025 | Petraville Asset Management, KoreanLeak3 - a direct path to investment loss. Company was founded in Seoul, Korea, in 2022. The company is young but growing rapidly. Last year, they acquired a logistics center in Ichon (Gyeonggi Province). The ... |
| Mobidic Asset Management | · Sep 30, 2025 | Mobidic Asset Management Co., KoreanLeak3 - another failure. The company has been operating on the country's stock market since 2021 (EX-DK Investment Korea) and currently has capital of 6 billion won ($4.2 million). The company operates as a ... |
| Pangea Travel Store | · Sep 29, 2025 | PANGEA The Travel Store is a boutique travel agency that designs bespoke, full-service trips tailored to individual tastes. It blends an online platform with physical flagship stores so customers can get face-to-face consultations as well as ... |
| lakehaven.org | · Sep 29, 2025 | Lakehaven Water District provides essential water and sewer services to residents of South King County, Washington. 1.The document dated January 3, 2025, is a report on GL Distribution for the pay period December 16–31, 2024 (payment on Ja ... |
| heparks.org | · Sep 29, 2025 | The Hoffman Estates Park District strives to provide the local community with exceptional recreational programs, well-maintained parks, and high-quality facilities. Their offerings include a variety of programs for youth, adults, and seniors, ... |
| PTR Asset Management | · Sep 28, 2025 | PTR Asset Management, KoreanLeak3 - A shell company that jumps from bed to bed. Meet PTR Asset Management. An investment company from South Korea. As they state on their official website, PTR Asset Management engages in value investing, ident ... |
| Yooshin Engineering Corporation | · Sep 27, 2025 | Yooshin Engineering Corporation provides engineering consulting services in South Korea and internationally. It offers various services, including feasibility study, basic and detailed design, construction project management, and post-complet ... |
| thomasmhughes.com | · Sep 26, 2025 | Thomas M. Hughes, Ltd. USA - Calculation error. Company specializes in providing experienced legal counsel focused on employee benefits, ERISA, tax, and pension law. With over 30 years of expertise, they offer clear, practical solutions tailo ... |
| Podo Asset Management | · Sep 26, 2025 | Podo Asset Management, KoreanLeak3 - Don't bite off more than you can chew. Not everyone follows this simple rule. A clear example is Podo Asset Management. It was founded in 2018. It specializes in direct investments and IPOs. Podo Asset Ma ... |
| WEST Inc. | · Sep 25, 2025 | West Water & Energy Systems Technology, USA - clean, but dangerous. Company specializes in sustainable water treatment solutions for various industries, particularly mining, boiler systems, and cooling towers. The company suffered a global da ... |
| XCAssociates | · Sep 25, 2025 | XC Associates, USA specializes in the design and manufacturing of advanced carbon glass fiber composites tailored for various high-performance industries including medical, aerospace, energy, and consumer sectors. They offer a comprehensive r ... |
| HUB ASSET MANAGEMENT Co | · Sep 25, 2025 | HUB ASSET MANAGEMENT Co, KoreanLeak3 - an alternative approach to investment security. The company has a portfolio of 2.8 billion won, $2 million. HUB ASSET "strives to set standards for best practices in alternative investments by making inv ... |
| Summit Asset Management | · Sep 25, 2025 | Summit Asset Management, Inc., KoreanLeak3 - a report that investors do not want to get. The company has been operating on the stock market since 2022 and has a portfolio of 2.8 billion won, $2 million. Summit Asset, as required by law, publi ... |
| Trustar Capital Management Co | · Sep 25, 2025 | Trustar Capital Management Co., Korean Leak3 - the company has an investment portfolio of 2.4 billion won ($1.7 million). Registered on July 29, 2022 with the Financial Services Commission as a specialized asset manager in the private equity ... |
| oconnorcp.com | · Sep 25, 2025 | O'Connor Capital Partners is a real estate investment company specializing in retail, office, industrial, residential, and multifamily properties in major cities across North America and Europe. The company was founded in 1983 and is headquar ... |
| waxhaw.com | · Sep 25, 2025 | The Town of Waxhaw in North Carolina. 1.All files relate to municipal procurement and contracts for the Town of Waxhaw (NC) for land rights acquisition services, map preparation, and related work for the Waxhaw-Marvin Road and Kensington Dri ... |
| smpeurope.com | · Sep 25, 2025 | SMP EUROPE, a family-owned business based in Nottingham, has been supplying engine management and ignition components to original equipment manufacturers and the aftermarket for over 50 years. We have achieved success in a competitive market ... |
| regalmold.com | · Sep 25, 2025 | We design and manufacture custom molds, components, and many other types of tools and assemblies for a wide range of customers.To manufacture custom products, we use precision machining on CNC machines, 5-axis machining, electrical discharge ... |
| sperispa.com | · Sep 25, 2025 | SPERI SPA provides its clients with a full range of services related to the architectural environment, buildings, and infrastructure. 1.Summary of the project “Sustainable Management of Protected Areas in Mauritania – Fisheries Monitorin ... |
| grupobocel.com | · Sep 25, 2025 | Grupo Bocel is a holding company comprising two companies: La Dominicana Industrial and Molinos Valle del Cibao, located in Santiago de los Caballeros, Dominican Republic.La Dominicana Industrial manufactures and sells pasta, while Molinos Va ... |
| halemakua.org | · Sep 25, 2025 | Hale Makua Health Services is a private, non-profit company located on the Hawaiian island of Maui. Our mission is to improve the well-being of our clients by providing personalized medical services at home, both at our facility and at your ... |
| www.officepro.cl | · Sep 24, 2025 | Office Pro, Chile - a leading distributor of office supplies. The company began operations in 1991 in the Vitacura district under the name Distribuidora Capri. Over many years of operation, the company has accumulated a huge number of custome ... |
| www.mpmimports.com.cy | · Sep 24, 2025 | MPM IMPORTS LTD, Cyprus - is a family owned business which has been established in September 2013 as a spin off from the MPM GROUP of companies. The company supplies cosmetics, car tires, and other consumer goods to the island. Over the years ... |
| www.cr-installers.com | · Sep 24, 2025 | Chris Rodriguez Installers, USA - The company specializes in the installation, delivery, and warehousing of system furniture for federal, regional, and commercial organizations. CRI also operates a 50,000-square-foot warehouse conveniently lo ... |
| www.chinup.com.tw | · Sep 24, 2025 | Chinup Technology Co., Taiwan - Chinup specializes in manufacturing Cutting Presses, Die Cutting Machines, Automated Cutting Systems, and Card Processing Machinery. Established in 2001, the company expanded its expertise to include solar modu ... |
| www.apm-finance.de | · Sep 23, 2025 | APM Finance GmbH, Germany specializes in outsourced accounting services specifically designed for the automotive industry. The company offers comprehensive accounting, payroll, management accounting, and control consulting services. The compa ... |
| www.meduane-habitat.fr | · Sep 23, 2025 | MEDUANE HABITAT, France - The company builds and rents out social housing. Today, Méduane Habitat manages 6,300 housing units, mainly in Laval, but since 1996, the company has expanded its activities to other municipalities in the Laval aggl ... |
| cegconstruction.com | · Sep 22, 2025 | CEG Construction is on a path to self-destruction. This company is an industrial contractor based in Southern California that specializes in the construction of concrete warehouses and food processing facilities. They offer comprehensive desi ... |
| ZEF | · Sep 21, 2025 | ZEF, Germany - Center for Development Research University of Bonn. ZEF conducts interdisciplinary research in the fields of political, economic, and general development. The institute advises governments, national and international organizati ... |
| goodcents.com | · Sep 20, 2025 | Goodcents, USA - Cheap food outlets are part of Custom Foods Inc., a company that produces frozen dough. The company manufactures a wide range of products, including dough for pizza, bread, cookies, and much more. The company supplies its pro ... |
| NV ELMAR | · Sep 20, 2025 | A blackout in Aruba is only a matter of time. The incompetence and unprofessionalism of NV ELMAR managers — the only electricity supplier on the island — could send the entire island back to the Stone Age. It has long been known that thin ... |
| Promociones Luis Barros | · Sep 20, 2025 | Promociones Luis Barros is a Galician family firm specializing in the construction and promotion of luxury residences in southern Pontevedra. They offer high-end housing solutions, including custom-built homes, catering to discerning client ... |
| EUM Asset Management | · Sep 19, 2025 | EUM Asset Management, Korean Leak2. Company claims that customer trust is their top priority. Well, they have lost that trust. The Seoul-based asset management company focuses primarily on private equity funds. They also deal in stocks, bonds ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .