qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
25▲11 vs prev. week
Victims · 30d
119active targets
Victims · 90d
360
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 23:46UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,257 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| bvasd.net | · Aug 12, 2025 | The Belle Vernon Area School District (BVASD) is a medium-sized public school district located approximately 40 minutes southeast of Pittsburgh in Westmoreland and Fayette counties, Pennsylvania.Formed in 1965 through the merger of the Belmar ... |
| northernconstruction.com | · Aug 12, 2025 | Northern Construction Service, LLC is a Massachusetts-based general contractor specializing in bridge construction, construction site work, port and harbor work, concrete work, and utility services. 1.The document consists of two invoices fr ... |
| syncadd.com | · Aug 12, 2025 | SYNCADD is a technology solutions provider that delivers effective data and business results to customers worldwide, including divisions of the US Armed Forces. The company's wide range of services includes audit preparation, corporate soluti ... |
| venturecreditunion.com | · Aug 12, 2025 | Venture Credit Union is a company from Trinidad and Tobago that provides financial services: car loans, mortgages, and consumer loans, as well as tools for investing and saving. The company is a leader in its country in one of the most disgus ... |
| Haeger & Schmidt Logistics | · Aug 12, 2025 | Haeger & Schmidt Logistics is a German transport and logistics company that has been operating in the cargo transportation market since 1887. We do not know what exactly this company transported for the Nazis. Much more is known about the com ... |
| Assisted Living Pharmacy Service LLC | · Aug 12, 2025 | Assisted Living Pharmacy Service LLC operates in the field of providing medicines and assistance in selecting medications in WL, USA. The company states that “Our mission is to provide the best services in the industry at the highest level ... |
| burmann.de | · Aug 11, 2025 | Burmann, Germany – a leading company in the field of automatic door installation and other security structures. It works with the business sector: shopping centers, movie theaters, entertainment parks...but most importantly – offices of l ... |
| Çağrı Group | · Aug 11, 2025 | Çağrı Elektrik - Çağrı Grup A.Ş. is a Turkish company that specializes in providing electrical materials, project contracting, renewable energy solutions, switchboard manufacturing, medium voltage systems, low voltage systems, and engi ... |
| agrofair | · Aug 11, 2025 | Banana collapse. AgroFair Benelux BV, based in Barendrecht, the Netherlands, is an importer and distributor of organic and Fairtrade tropical fresh fruit that sells its products in Belgium, Denmark, the Netherlands, Finland, Italy, Austria, S ... |
| empur | · Aug 11, 2025 | EMPUR Produktions GmbH, Germany is a producer and full-range retailer of innovative, high-quality surface heating and cooling systems. The company produces over 70% of all system components itself. Quality “made in Germany”, as they say. ... |
| St Thomas More Catholic High School | · Aug 10, 2025 | St. Thomas More Catholic High School is one of the most famous and prestigious schools in Louisiana, USA. Every child in Lafayette wants to study here, and parents are willing to pay a lot to get their child into this elite environment. On th ... |
| getech.com | · Aug 10, 2025 | Getech applies world-leading geoscience data and unique geospatial software products to locate the subsurface resources that are vital for energy security and a sustainable transition. It has offices in the UK, USA and operates worldwide. And ... |
| jtekt.eu | · Aug 10, 2025 | JTEKT Corporation manufactures and sells steering systems, transmission components, bearings, machine tools, electronic control devices, home appliances, etc. It has its headquarters in Japan and offices in Europe, North America, Asia, Oceani ... |
| formacompany | · Aug 10, 2025 | Formacompany & Co is a company that operates a gray business money laundering scheme. They declare that: "Our staff have experience in incorporating companies worldwide including Europe and tax efficient Offshore Jurisdictions. We have expand ... |
| CIMEXSTEEL.CZ | · Aug 8, 2025 | The Czech holding company CS STEEL a.s. manufactures and sells metal structures for private and public sector clients. A small company that failed to protect its infrastructure has put dozens of its clients at risk. These are not private indi ... |
| shinko plastics co. ltd | · Aug 7, 2025 | Shinko plastics co. ltd Sales of plastic sheet, plastic film, raw material, and related sub-material and plastic finished goods. The company has several offices throughout Japan and is one of the leaders in this industry. The company's financ ... |
| Belmont christian college | · Aug 7, 2025 | Belmont Christian College is a school in Australia located in the state of New South Wales. The published data archive contains all internal information about the educational institution, including personal data of students and employees. It ... |
| ryeco.com | · Aug 7, 2025 | Ryeco is an international company that services and manufactures paper, hygiene products, and recycling materials such as paper, hygiene products, nonwoven materials, films, foil, labels, packaging, metals, plastics, printing, printing, glass ... |
| lpco.co | · Aug 7, 2025 | Lawrence Paper specializes in the design and manufacture of corrugated boxes and packaging solutions. The company offers a wide range of services, including industrial boxes, retail-ready packaging, custom box manufacturing, as well as digita ... |
| eyeqmonitoring.com | · Aug 7, 2025 | Founded in 2007, EyeQ Monitoring is one of the largest providers of real-time video surveillance services in the United States. EyeQ installs and maintains state-of-the-art video surveillance systems throughout the United States and hires and ... |
| avosinamed.com | · Aug 7, 2025 | Avosina Healthcare Solutions specializes in providing comprehensive medical billing and IT services, striving to optimize the work of doctors. 1.The document is an official payslip for March 2025 for an employee of Avosina Medical Technologi ... |
| camdon.ca | · Aug 7, 2025 | Camdon Construction is a Red Deer-based construction and commercial company specializing in project management services throughout Alberta.The company offers design-build services, including concept development, site planning, and 3D visualiz ... |
| lodipd.org | · Aug 7, 2025 | The primary duty of the Lodi Police Department is to serve humanity, protect life and property, defend the innocent from fraud, the weak from oppression or intimidation, and the peaceful from violence or disorder, and to respect the constitut ... |
| csrepair.com | · Aug 7, 2025 | CS Truck & Trailer is a comprehensive fleet service provider specializing in mobile repairs, preventive maintenance, and complex diagnostics for trucks and trailers. 1.The document is a notarized affidavit from Mason Jones confirming the acc ... |
| studebakersubmetering.com | · Aug 7, 2025 | The Belle Vernon Area School District (BVASD) is a medium-sized public school district located approximately 40 minutes southeast of Pittsburgh in Westmoreland and Fayette counties, Pennsylvania. Formed in 1965 through the merger of the Belma ... |
| sotaconstruction.com | · Aug 7, 2025 | Sota Construction Services is a leading provider of comprehensive and cost-effective construction services specializing in commercial and residential construction. The company emphasizes environmentally friendly construction methods and has b ... |
| azurewave.com | · Aug 7, 2025 | AzureWave Technologies is a worldwide leading provider of wireless connectivity and image processing solutions. Our products lines include Bluetooth, Wi-Fi, 3G, GPS, DTV and Digital Camera modules, which could be extensively applied in person ... |
| Kengen | · Aug 6, 2025 | Kenya Electricity Generating Company abbreviated to KenGen, is a government enterprise in the Republic of Kenya charged with the production of electricity for the country and around East Africa. KenGen is the largest electric power producer ... |
| ferrocortes | · Aug 6, 2025 | Ferrocortes S.A.S is a leader in high-quality steel solutions for heavy machinery and hardware from Colombia. The company provides customized steel products such as sheets and profiles, catering to various industrial sectors including mining, ... |
| alpresor.se | · Aug 4, 2025 | Have you traveled to the Alps? Your personal data is in this archive. The full archive of STS Alpresor company is publicly available. The largest tour operator in the Nordic region, operating in Sweden, Norway and Finland. The company has bee ... |
| easternadjustment.com | · Aug 4, 2025 | Eastern Adjustment Company, Inc., is a locally owned Independent Adjusting firm designed to assist insurers primarily in the adjustment of losses and claims in fire, allied lines, marine and casualty. We specialize in personal and commercial ... |
| Aggressive Air Compressor & co | · Aug 3, 2025 | We have full control of your systems, including: ✅ All invoices ✅ Customer databases (names, addresses, contact details) ✅ Scanned documents (IDs, driver’s licenses, confidential files) ✅ Financial records & other sensitive data ... |
| cadex.com | · Aug 1, 2025 | Cadex Electronics specializes in the design and manufacturing of diagnostic chargers, battery analyzers, and rapid testers aimed at optimizing battery performance and longevity. Their products serve a variety of sectors including military, me ... |
| envac.es | · Aug 1, 2025 | Envac Iberia SA is a company that operates in the Waste Treatment, Environmental Services & Recycling industry. It employs 20to49 people and has 5Mto10M of revenue. The company is headquartered in Barcelona, Catalonia, Spain. |
| fortsmithschools.org | · Aug 1, 2025 | The Fort Smith Public School district is a destination district built on relationships, collaboration, and a culture of excellence. With over 2,000 employees, FSPS is one of the largest employers in Fort Smith, Arkansas. Our qualified educato ... |
| www.afmco.jo | · Jul 31, 2025 | ABOUT THE AQABA SPECIAL ECONOMIC ZONE AUTHORITY (ASEZA) The Aqaba Special Economic Zone Authority plays a leading role at the administrative and governmental level in the Hashemite Kingdom of Jordan and applies the principle of good governanc ... |
| PDC www.cobranzasbeta.com.co | · Jul 30, 2025 | Promociones y Cobranzas Beta was created in 1987 as a collection unit of the then Banco Superior, which was acquired by Davivienda in 2006. Since then, it has established itself as the subsidiary specialized in the collection and financial a ... |
| Custom Food Ingredients | · Jul 29, 2025 | Custom Food Group specializes in providing tailored food solutions for a diverse range of clients. With a focus on customization, they offer a variety of food products designed to meet the unique needs of businesses in the food service and re ... |
| tissot.com | · Jul 29, 2025 | TISSOT Industrie is an internationally recognized French company, expert in heavy boilermaking and in the realization of tailor-made industrial projects. Since 1942, the TISSOT company has studied, manufactured, transported and assembl ... |
| www.barobinson.com | · Jul 28, 2025 | Founded in 1936 and headquartered in Winnipeg, Manitoba, B. A. Robinson Co. Ltd. is a fully diversified distributor of plumbing, lighting and electrical products. B. A. Robinson distributes to the construction industry and retail home improve ... |
| Yapi Teknik Proje | · Jul 28, 2025 | Yapı Teknik was established in Istanbul in 1988 to operate in the static design & project planning and implementation of reinforced concrete, steel and timber structures in all national and international fields. Yapı Teknik, with its qua ... |
| Astro Industries Inc. | · Jul 25, 2025 | Astro Industries, Inc. is engaged in the manufacturing and distribution of Military and Commercial wire, cable, cable assemblies, shrink tubing, and value-added products and services. We also stock a variety of military and commercial knobs, ... |
| BALNEARIO DE MONDARIZ | · Jul 24, 2025 | El Balneario de Mondariz, complejo hotelero y termal de Galicia. Hotel con 194 habitaciones; moderno balneario con aplicación de aguas mineromedicinales; el Palacio del Agua, spa de 3000m2; campo de golf de 18 hoyos y mucho ms |
| morgan911.org | · Jul 24, 2025 | Morgan County 911 provides emergency and non-emergency call dispatching services for the residents of Morgan County, Alabama. The organization is dedicated to ensuring public safety and operates a countywide radio system as well as an ambulan ... |
| foiegrasespinet | · Jul 24, 2025 | Maison Espinet specializes in traditional foie gras products, offering a variety of options including fresh, frozen, semi-cooked, and canned goods. Their offerings cater particularly to caterers and the restaurant industry, with a specific fo ... |
| moonsafari | · Jul 24, 2025 | Moon Safari est une agence d’architecture et d’urbanisme pluridisciplinaire, volontairement éclectique et ouverte ; tertiaire, logement, éducation, sport, industrie ou équipement, tous les projets attirent notre attention. Nous pensons ... |
| jaegerndorfer.at | · Jul 24, 2025 | Dear lovers of railways and cable car models! If something breaks down, do not worry, we will be happy to help. |
| Metricon Homes | · Jul 24, 2025 | Founded in 1976, Metricon Homes is one of Australia's largest and most reputable residential home builders. With nearly five decades of experience, the company has established a strong presence across the country, offering a diverse portfolio ... |
| DelCampo | · Jul 23, 2025 | el Campo is a third-generation, family-owned business dedicated to growing the best tasting fruits and vegetables year round. We are a vertically integrated operation with state of the art greenhouses in Sinaloa and Jalisco, Mexico; which are ... |
| www.balkankalip.com | · Jul 23, 2025 | Founded in Istanbul in 1998, Balkan Kalıp is a company that produces molds and mass-produces parts to meet the needs of the automotive industry. With a solution-oriented approach and a vision of sustainable and continuous development, Balkan ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .