qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
25▲11 vs prev. week
Victims · 30d
119active targets
Victims · 90d
360
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 23:46UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,257 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Broad High Asset Management | · Sep 18, 2025 | Broad High Asset Management Co., Korean Leak2. A private investment fund management company registered with the Financial Services Commission in April 2022. The company's total investment portfolio is 2.65 billion won ($1.8 million). Key prod ... |
| ST Asset Management Co | · Sep 18, 2025 | ST Asset Management Co, Korean Leak2. You can change your name and declare a new mission, but you still won't be able to hide your deceitful nature. Meet ST Asset Management Co., Ltd., Seoul, Korea. They position themselves as specialists in ... |
| Orum Asset management | · Sep 18, 2025 | Orum Asset management Co, Korean Leak2. The company has been operating on the Korean stock market since 2021. Its total capital is 5.4 bil won ($3.8 mil). The company's main priority is the real estate market. The company has a public offerin ... |
| EOS Asset management | · Sep 18, 2025 | EOS Asset management CO., Korean Leak2. The company has been operating on the Korean stock market since 2021. Its total investment portfolio is 22 bil won ($15.8 mil). An asset management company specializing in brokerage services for lendin ... |
| Dblock Asset Management Co | · Sep 18, 2025 | Dblock Asset Management Co, Korean Leak2. They have blocked the development of their own future. Dblock Asset Management Co., Ltd is an investment company specializing in the acquisition and management of real estate and funds, part of the D- ... |
| SUNIQUE Asset Management Co | · Sep 18, 2025 | SUNIQUE Asset Management Co, Korean Leak2. General business in the field of direct investment, investment consulting, and investment agency. The company's portfolio is 1.5 billion won ($1 million). The company claims that it works only with ... |
| Saebom Asset Management | · Sep 17, 2025 | Saebom Asset Management Co., Korean Leak2. The company was founded in 2022. It operates in the Korean financial market and has several funds: multi-strategy and high-yield private investment funds, a mezzanine direct investment fund, and a pu ... |
| Zebra Asset Management Co | · Sep 17, 2025 | Zebra Asset Management Co., Korean Leak2. The company has been operating on the Korean stock market since 2021. The company has a portfolio of 15bn won ($11m). The company continuously audits undervalued companies in order to make profits in ... |
| spartanburgcounty | · Sep 17, 2025 | SPARTANBURG, USA - Failure before the election. 08/08/25 FOX Carolina issued an urgent announcement: “Spartanburg County officials have stated that a ‘cybersecurity incident’ has occurred on their network.” As always, local authoritie ... |
| Prime Asset Fund | · Sep 17, 2025 | Prime Asset Fund, USA is a highly questionable player in the US financial market. It is a company that operates in the investment banking industry. It employs 20 to 49 people and has revenues of $10 million to $25 million. Prime Asset also in ... |
| www.vdyne.com | · Sep 17, 2025 | VDyne, USA is a clinical-stage medical device company dedicated to developing transcatheter valve solutions for the treatment of debilitating and life-threatening Tricuspid Regurgitation (TR). They are developing medical micro-prostheses that ... |
| Pieffe Auto Group | · Sep 17, 2025 | Pieffe Auto Group is a leading multi-brand automotive dealership network based in the Abruzzo region of Italy. The group represents a wide portfolio of car brands, including Peugeot, Citroën, DS Automobiles, Opel, Fiat, Jeep, Alfa Romeo, H ... |
| volinc.com | · Sep 15, 2025 | Founded in 1992 and headquartered in Conyers, Georgia, Volume Transportation, Inc. provides ground transportation, cargo loading, warehousing, storage, and material flow management services. 1.The document is a confidential mediation stateme ... |
| trchealthcare.com | · Sep 15, 2025 | The Therapeutic Research Center was founded in 1985 and is headquartered in Stockton, California. The Therapeutic Research Center specializes in studying and evaluating new drugs that are approved for use each year. 1.The document is a clini ... |
| VANCHOR Asset Management | · Sep 15, 2025 | VANCHOR Asset Management, Korean Leak part 1. - The company operates in the stock market and provides and manages products based on alternative investment assets, primarily real estate investments. The company states that “the company puts ... |
| APEX Asset Management | · Sep 15, 2025 | APEX Asset Management, Korean Leak part 2 - The company operates on the stock market in the field of private equity. It engages in investment management and investment consulting. The company has a capital of 5 billion won ($35 million). It i ... |
| Majesty Asset Management Co. | · Sep 15, 2025 | Majesty Asset Management Co., Korean Leak part 3 - bastards of royalty. If a company comes up with a big name, then they are scoundrels. This is almost always the case, and a company called Majesty proves it. They have been in business for o ... |
| Melon Asset Management Co. | · Sep 15, 2025 | Melon Asset Management Co., Korean Leak part 4 - financial asset management company specializing in private equity funds. The company has a portfolio of 2,5 billion won ($1.7 million) and 502,972 shares. The company works with alternative inv ... |
| Taurus Investment & Securities Co | · Sep 15, 2025 | Taurus Investment & Securities Co., Korean Leak part 5 - a major player that has dishonored its name. The company operates in the stock market in Korea and other countries, generating up to $50 million in profits each year. The company's part ... |
| LX Asset Management | · Sep 15, 2025 | LX Asset Management, Korean Leak part 6 - Investment security is paramount. And this is not true. LX Asset is a large investment company that works on the stock market. The main instruments: bonds, shares, real estate. The company is also act ... |
| Klarman Asset Management | · Sep 15, 2025 | Klarman Asset Management, Korean Leak part 7 - careful investing did not save them from losses. The company was founded in 2021 and focuses on multi-strategy investing. They claim that they only work with proven and reliable strategies that a ... |
| Human and Bridge Asset Management | · Sep 15, 2025 | Human and Bridge Asset Management, Korean Leak part 8 - another company with evidence of commercial collusion. The company is involved in high-risk investments. The total number of assets is 1.7 billion won ($1.2 million). The leaked data sho ... |
| Awesome Asset Management Co | · Sep 15, 2025 | Awesome Asset Management Co., Korean Leak part 9 - Safe First, Benefit Second. But only on paper. Сompany operates in the investment market. The company, with a portfolio of 2 billion won ($1.4 million) in assets, came into existence in 202 ... |
| Pollex Asset Management Co. | · Sep 15, 2025 | Pollex Asset Management Co., Korean Leak part 10 - The Company operates in the financial market. The company invests in a variety of assets using professional investment and risk management expertise, achieving optimal investment returns thro ... |
| Eagle Excavation | · Sep 14, 2025 | Eagle Excavation, USA - They pride themselves on their digging skills, but they couldn't bury their dirty secrets deep enough. Eagle Excavation Atlantic performs site preparation work for projects throughout Georgia. They boast of multimillio ... |
| bio3g.com | · Sep 14, 2025 | The BIO3G offering is based on a complex of innovative biostimulants based on affordable and complementary lines. Our solutions are generally based on original and patented formulas, rich in biostimulants and specific natural compounds that c ... |
| opso.us | · Sep 14, 2025 | The Orleans Parish Sheriff's Office and Sheriff Marlin N. Guzman are responsible for the custody, care, and control of inmates in one of the largest urban correctional facilities in the United States. 1.The document is a summary report on in ... |
| Office Of The Registrar Of Political Parties | · Sep 14, 2025 | The Office of the Registrar of Political Parties (ORPP) is a state office in Kenya responsible for the registration, regulation, and funding of political parties as mandated by the Constitution and the Political Parties Act. It aims to promot ... |
| denali-industrial.com | · Sep 12, 2025 | Denali Industrial Supply - a knockout blow to its reputation. For 35 years, Denali Industrial Supply has been a supplier of high-quality industrial tools, fasteners, and accessories in Alaska. They work with many well-known manufacturers, inc ... |
| TAKwest | · Sep 12, 2025 | Broadband data leak. Those who provide access to new digital opportunities have failed to ensure their own cybersecurity. TAK West Shore is a subsidiary of TAK Broadband. They offer comprehensive service solutions in the field of fiber optic ... |
| Spectra Logic | · Sep 10, 2025 | Spectra Logic, USA - data protection and storage company LMAOOOAHHAHA I'm dead!!! Sorry, but this is really funny. PROTECTION! STORAGE! DATA!!!! On our blog, yes. So, Spectra Logic helps organizations manage, migrate, store and preserve busin ... |
| Ekotrade | · Sep 10, 2025 | EKOTRADE was founded in 1991. It operates on the Polish market and is one of the leaders in the security industry. EKOTRADE offers extensive experience, knowledge, and the highest quality services available on the market. The diligence and pr ... |
| Wouters France | · Sep 10, 2025 | Wouters France is a trading company that supplies fruit and vegetables wholesale to France and the European Union. Customers can choose from a wide range of seasonal fruit and vegetables, such as apples, pears, oranges, carrots, broccoli, and ... |
| Plan B Die Fachanwaltskanzlei | · Sep 9, 2025 | They acquitted criminals and now find themselves in the shoes of lawbreakers. The law firm Plan B was founded in Munich in 2014. Theft, robbery, fraud, murder, drug trafficking - for money, the lawyers at Plan B are ready to take on any dirty ... |
| EPLS: Entreprise d'Installations électriques Courant Fort | · Sep 8, 2025 | EPLS, France - the company is engaged in the design and construction of high-voltage and low-voltage systems for a large service sector that includes airports, hospitals, data centers and other critical infrastructure in France. EPLS prides i ... |
| runaces.com | · Sep 8, 2025 | Finished the game. Running Aces -you're playing a losing hand.The Running Aces Casino and Racetrack opened in Columbus, Minnesota, in April 2008. Things did not go well from the start. In its first year of operation, the racetrack lost $4 mil ... |
| Mechatronics | · Sep 6, 2025 | Mechatronics, Inc. USA specializes in providing a wide range of AC, DC, and EC fans and blowers, including accessories and custom assemblies, catering to industries such as telecom, medical, industrial, alternative energy, lighting displays, ... |
| Ekmanian Tax & Accounting | · Sep 4, 2025 | Ekmanian Tax & Accounting, USA - scandal immediately after M&A. Company is a law firm that provides tax account services and bookkeeping for people and companies. Most recently, they announced a merger with another company, Brave Accounting. ... |
| Osaki Medical | · Sep 4, 2025 | Osaki Medical is a Japanese company, established in 1936, that manufactures and markets safe, functional, and cost-effective medical supplies, sanitary materials, cosmetics, and medical equipment for the medical and nursing care industries. T ... |
| Rivertown Surgey Center | · Sep 4, 2025 | Rivertown Surgery Center is a Medicare-certified ambulatory surgical center specializing in outpatient procedures. The facility offers general surgery, pain management, foot surgery, and radiology services, supported by modern equipment. It ... |
| flamgard.co.uk | · Sep 4, 2025 | Flamgard Calidair, UK is global force in the design, innovation, and manufacture of high-integrity damper products for numerous applications including tunnels, marine vessels, and nuclear power stations. Now multiple buildings where Flamgard ... |
| Master System Inc | · Sep 3, 2025 | Master System develops and supports software and services that deliver enterprise management and collaborative supply chain solutions to thousands of small to midsize distributors in a number of industries.Master System is headquartered in Ar ... |
| musimmas.com | · Sep 3, 2025 | Musim Mas Group, Singapore - poisoning the world, not expensive. Headquartered in Singapore, Musim Mas is one of the world's largest, integrated palm oil corporations with operations in every part of the supply chain across the Americas, Euro ... |
| blytheco.com | · Sep 3, 2025 | Blytheco is a full-service consulting firm that has been working with small and medium-sized businesses since 1980. Blytheco offers a wide range of business management software (ERP, CRM, HCM, marketing automation), backed by exceptional prof ... |
| camaradealmeria.com | · Sep 3, 2025 | Cámara Oficial de Comercio e Industria de vila, Spain - is a public corporation whose purpose is to represent, promote and defend the interests of Spanish companies. It also represents and coordinates the activities of regional chambers of c ... |
| NPIAV | · Sep 3, 2025 | NPi Audio Visual Solutions, USA - the company organizes and hosts business events and parties. What happens behind closed doors at private conventions? Now we can peek behind the curtain and find out what the rich and famous really discuss an ... |
| identic.be | · Sep 2, 2025 | Identic, Belgium, is the country's largest digital printing and signage company, as well as a copy machine store. The company is located in a 2,000 m² production facility, where approximately 20 employees work. The company works with many wo ... |
| PathoQuest-Biotechnology Research | · Sep 1, 2025 | PathoQuest-Biotechnology Research, USA-France The company conducts research on innovative biopharmaceuticals under complex testing conditions on two continents. PathoQuest offers a proven next-generation sequencing (NGS) approach to biosafety ... |
| L&S Proline | · Aug 31, 2025 | L&S Proline, USA - Drill, baby, drill! L&S Proline is a full-service company specializing in solutions for the oil and gas industry, offering a range of products and services, including measurement control equipment, structural fabrication, a ... |
| Tecnología Especializada Asociada de México | · Aug 31, 2025 | Tecnología Especializada Asociada de México, not a dream TEAM. The company positions itself as a ‘strategic link between producers, distribution channels and end consumers’. In reality, behind the buzzwords they try to hide the reality. ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .