qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
25▲11 vs prev. week
Victims · 30d
119active targets
Victims · 90d
360
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 23:46UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,257 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| ESIC_TR | · Aug 30, 2025 | ESIC University, Spain, is a higher education institution focused on the world of marketing. In other words, they teach how to sell products and ideas. One of the main principles of marketing is that people don't know what they need until we ... |
| atlanta neighborhood charter school | · Aug 30, 2025 | Atlanta Neighborhood Charter School (ANCS) is a K-8 public charter school in Atlanta, recognized for its academic excellence and innovative programs. However, they could not make a program to protect their own students. All information on the ... |
| allphaselandscape.net | · Aug 29, 2025 | All Phase Landscape, USA is a company engaged in landscaping, design, and service of green areas in parks, around administrative, office, and residential buildings. Making the surrounding space more beautiful and environmentally friendly is o ... |
| ibew1547.org | · Aug 29, 2025 | IBEW Local 1547, USA - a union in Alaska that is supposed to provide safety and protect the rights of electric utility and communications workers, local officials, health care workers, and many other professionals. Safety - failed. Protection ... |
| ogdenpubs.com | · Aug 29, 2025 | Ogden Publications Inc., USA - history repeats itself. One of the oldest publishing houses in the USA repeats its mistake time after time and has no experience. There is no other word than “idiocy” for their approach to problem solving. O ... |
| Town of Chatham, MASSACHUSETTS | · Aug 29, 2025 | Chatham, Massachusetts is located at the southeast tip of Cape Cod. Chatham MA is a municipal government that provides essential services to its residents, including emergency services, utilities, and community resources. The town focuses ... |
| gmcontractinginc.com | · Aug 28, 2025 | GM Contracting offers a full range of residential utility construction services. GM Contracting has years of residential experience with water and sewer utilities. In addition to traditional construction methods, GM Contracting is a full serv ... |
| Weathercraft Companies | · Aug 27, 2025 | Contractor Specializing in Roofing, Siding, Gutters, Windows, and Overhead Door Installation In 1976, Weathercraft of North Platte was founded by Alan Erickson and Bill Livengood, branching out from Weathercraft of Lincoln, NE. Weatherc ... |
| brebeuf.org | · Aug 27, 2025 | Brebeuf Jesuit Preparatory School, USA - cut off and in trouble with the law. A small Jesuit school in Indianapolis got attention in 2019 when it refused to fire a teacher who was in a gay marriage. The school was then cut from the Archdioces ... |
| singersf.com | · Aug 27, 2025 | Singer Associates, USA - Money has no odor. The company is cleaning up its reputation and washing other company's dirty laundry. It used to be done by laundresses and asenizers, now it's done by PR people. One of them, Sam Singer. He bought h ... |
| gibbswire.com | · Aug 26, 2025 | Gibbs Interwire, USA, is the nation's leading processor and distributor of Strip Coil and Wire Products in Stainless Steel, Carbon Steel, Nickel Alloys, and Red Metals. The company is continually growing and increasing production capacity thr ... |
| hydrometrics.com | · Aug 26, 2025 | Hydrometrics, Inc., USA delivers professional scientific and engineering services to various sectors including industrial, commercial, municipal, and private clients across the United States. With over 40 years of experience, the company spec ... |
| www.nuggetent.com | · Aug 26, 2025 | Nugget Enterprises, Inc. USA - We can't protect Your Data. The company develops software and provides servers for dozens of companies across the country. Is Your Data Really Secure? - That's the question hanging on the home page of the compan ... |
| nrlassoc.com | · Aug 25, 2025 | NRL Associates, Inc. USA. The company manufactures machine tooled parts for a variety of customers. 10 years ago, the company significantly expanded and moved into a new 55,000 square foot state-of-the-art facility. They now have the most mod ... |
| diversifiedcpc.com | · Aug 25, 2025 | Diversified CPC International, USA manufactures products whose name is not known to the general public. The company is a world leader in the development, manufacture and distribution of aerosol propellants, hydrocarbon refrigerants, biomass s ... |
| swanforlife.com | · Aug 25, 2025 | SWAN, Mauritius – welcome to the dark side of the insurance business. The company is based in a country known for its money laundering and offshore account creation organizations. SWAN specializes in all types of insurance and advertises th ... |
| medosweet.com | · Aug 24, 2025 | Medosweet Farms provides a full range of distribution services for fresh and frozen locally produced dairy products, made from environmentally friendly materials, to food service businesses throughout the Pacific Northwest. 1.Full company ... |
| Graphite Construction Group | · Aug 23, 2025 | Graphite Construction Group is a commercial construction company that provides exceptional service and innovative design solutions that exceed expectations for quality construction. It is Central Iowa's fastest-growing contractor. In th ... |
| www.ecodemolizionisrl.com | · Aug 23, 2025 | Eco Demolizioni, Italy - the company deals with demolition of large buildings, quarrying, reclamation, beach cleaning etc. Even in its name the company uses the word ECO. When deeply analyzing its work it becomes clear that this is just a mar ... |
| Inicio - Ganadería Revuelta | · Aug 22, 2025 | Inicio - Ganadería Revuela, Mexico - the company produces beef. It has its own production chain, which includes: feedlots, slaughterhouse, packing factory and finished product factory. The company supplies meat to the United States, Canada, ... |
| www.wyongleagues.com.au | · Aug 22, 2025 | Wyong Rugby League Club, Australia is a network of 12 organizations, each offering entertainment, recreational and dining opportunities and promoting membership of their club. It is the membership card that opens up a full range of entertainm ... |
| www.greneker.com | · Aug 22, 2025 | Greneker, USA - boobs and slaves. The company manufactures mannequins for clothing stores and entertainment centers. Its clients include major international brands such as Disney and Under Armour. The published date reveals the unpleasant sid ... |
| www.gillette-ac.com | · Aug 21, 2025 | Gillette Air Conditioning Company, USA specializes in air conditioning, heating, refrigeration, and boilers for commercial and industrial facilities. The company prides itself on safety, quality, and productivity, utilizing advanced technolog ... |
| Spohn + Burkhardt GmbH & Co KG | · Aug 21, 2025 | At Spohn + Burkhardt, Germany produce custom control transmitters, control systems and resistors that are robust and comfortable. These are highly customized and complex products that are often designed and manufactured in a single piece. On ... |
| seabridge.eu+efico.com | · Aug 21, 2025 | Seabridge, Belgium is a logistics service center and distribution platform for green coffee. They buy coffee from other countries and bring it to Europe. The company says it operates to green eco-standards and also “acts as an example of wo ... |
| Nissan CBI | · Aug 21, 2025 | The "Nissan Creative Box" refers to a design studio in Tokyo, previously known as a satellite design base for Nissan, and is now part of the larger Nissan design network. It is located in the Harajuku district of Tokyo. The studio was est ... |
| Fullerton Surgical Center (FSC) | · Aug 21, 2025 | Fullerton Surgical Center, USA, is a surgical clinic offering services in general surgery, orthopedics, otolaryngology, plastic surgery, pain management, urology, and gastroenterology. Of course, all these services cost a fortune, and the US ... |
| welldone.com.tw | · Aug 20, 2025 | Welldone Company is the first legal remittance company for migrant workers in Taiwan： Approved by the Financial Supervisory Commission to conduct financial technology innovation experiments for migrant workers’remittances in 2018. Obtai ... |
| DAOR E&C Co., Ltd | · Aug 20, 2025 | DAOR E&C Co., Korea is a company engaged in the production and construction of concrete structures: concrete bridges, large cable-stayed bridges, liquefied natural gas tanks, underground tunnels, and heavy lifting structures. Over 40 years of ... |
| lee-irvine.com | · Aug 20, 2025 | Lee & Associates Irvine Inc. is a law firm specializing in representing clients in the acquisition, sale, and leasing of various commercial real estate properties, including industrial, office, retail, and medical properties. 1.The document ... |
| haaker.com | · Aug 20, 2025 | Haaker Equipment Company manufactures sweepers, sludge suction machines, and spare parts for them. The company was founded in 1972 and is headquartered in Los Angeles, California. 1.The document is invoice No. 3300290201 from Nilfisk Inc., i ... |
| insoca.es | · Aug 20, 2025 | A family-owned business with a high level of technology in the corrugated cardboard sector. 1.The document is a gas bill from DISA ENERGY S.L.U. to Cartonajes Izquierdo S.A. for the period from June 1, 2025, to June 30, 2025. 2.This is the ... |
| netfusionconsulting.com | · Aug 20, 2025 | NetFusion Consulting, Inc. is California's largest company specializing in IT integration in the medical and dental fields, specializing in IT consulting and integration specifically for dentists. The company offers a wide range of services, ... |
| garnertrucking.com | · Aug 20, 2025 | Garner is a company specializing in dry freight transportation, located in northwestern Ohio. 1.The document dated June 2, 2025, is the annual report on school tax withholdings in Ohio for 2021 for Garner Contract Maintenance. 2.The documen ... |
| idscorporation.com | · Aug 20, 2025 | It is a systems engineering company providing consulting, design, and manufacturing services for a wide range of airborne and ground-based unmanned systems. 1.Technical appendix with a statement of compliance with the requirements of the Ken ... |
| Inotiv, Inc | · Aug 19, 2025 | Inotiv, Inc. is a publicly USA traded contract research organization (CRO) that provides nonclinical and analytical drug discovery and development services to the pharmaceutical and medical device industries.As a leading contract research org ... |
| Uganda Electricity Transmission Company Limited | · Aug 18, 2025 | Uganda Electricity Transmission Company Limited organizes the delivery of electricity within the country and to nearby countries. the company actively cooperates with other countries such as the USA. UETCL buys technology and equipment from t ... |
| apderm.com | · Aug 18, 2025 | APDerm is the largest physician-owned dermatology clinic in New England, with 25 locations in New Hampshire, Massachusetts, and Rhode Island. The company offers a full range of innovative medical, surgical, and cosmetic procedures to help pat ... |
| Welcome Financial Group | · Aug 18, 2025 | Welcome Financial Group, Korea is a huge ecosystem operating in the finance industry. The group provides banking, digitalization, payments, integrated asset management, distressed loans, residential leasing, and startup financing services to ... |
| ethicalpackaging.co.uk | · Aug 16, 2025 | Ethical Packaging, UK, is a company that provides printing services and packaging production. The company works with world-renowned brands such as Hermes and the Ferrero Group. Thanks to the publication of the company's internal data, anyone ... |
| Xperthair | · Aug 16, 2025 | Xpert Professional, Ireland is one of the most well-known companies in the country that sells hair and face cosmetics. Girls, this information is for you. If you have bought cosmetics here, all your information (name, home address, date of bi ... |
| marma.com.pl | · Aug 15, 2025 | MARMA Polskie Folie is one of the largest plastics processors in Europe. The company produces products for agriculture, horticulture, construction and packaging industries. Internally, the company employs more than 1,000 people. On 08/8/25, t ... |
| Morgenstern AG | · Aug 15, 2025 | Morgenstern AG, Germany specializes in providing comprehensive print and document solutions, including consulting services and digital workspace implementations. On August 7, the company's website reported that it had “successfully repelled ... |
| L-Pimenta (etdeletronics) | · Aug 14, 2025 | L-Pimenta is a company that repairs and constructs buildings and buildings in Portugal. Some of the buildings are sold after renovation to generate profit. However, the new owners are not always happy with such a purchase. Published documents ... |
| www.captrade.com | · Aug 14, 2025 | Capital Trade, Incorporated, based in Washington, D.C., is the real force behind the crazy policy of raising US tariffs. The company provides legal services in the field of international trade and litigation support. They help the US governme ... |
| liabergamo.it | · Aug 14, 2025 | A large union of businessmen from Bergamo and other cities in the country, which threatened the existence of dozens of Italian companies. The association wanted to unite businessmen in order to sell them services in the areas of labor relatio ... |
| smefazur.fr | · Aug 14, 2025 | SMEF AZUR, France, is a company operating in the field of climate engineering. The company deals with all technical aspects of construction: refrigeration, air conditioning, and multi-functional services. This means it has detailed drawings a ... |
| Charak Center for Health | · Aug 13, 2025 | Charak Health and Wellness Center, USA: an organization providing mental health services and treatment for alcoholism and drug addiction. The widest range of psychiatric services in northeastern Ohio. The publication of internal company data ... |
| ffs.com | · Aug 13, 2025 | Flavor & Fragrance Specialties is now a Lucta brand specializing in flavorings for coffee and other beverages. Our dedicated teams in the US will continue to provide unique market insights and customized flavor and fragrance solutions for our ... |
| Ahtna Incorporated | · Aug 13, 2025 | Ahtna Inc., provides construction and integrated services. The company is headquartered in Glennallen, Alaska. Ahtna, Incorporated is Alaska Native Regional Corporations established by Congress under terms of the Alaska Native Claims Settleme ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .