qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
25▲11 vs prev. week
Victims · 30d
119active targets
Victims · 90d
360
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-17 23:46UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,257 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Windsor Door | · Jul 22, 2025 | Windsor Door, Inc., founded in 1976 and based in Little Rock, Arkansas, is a recognized manufacturer specializing in garage door solutions for both residential and commercial applications. The company’s offerings include embossed steel pane ... |
| http://www.balkankalip.com | · Jul 22, 2025 | Founded in Istanbul in 1998, Balkan Kalıp is a company that produces molds and mass-produces parts to meet the needs of the automotive industry. With a solution-oriented approach and a vision of sustainable and continuous development, Balkan ... |
| ARCTICGROUP | · Jul 22, 2025 | Arctic Glacier is North America’s leading manufacturer and direct-to-store distributor (DSD) of premium quality packaged ice, ice equipment and related services. Since its start in 1882, Arctic Glacier has grown significantly through strate ... |
| WIBAIE | · Jul 22, 2025 | WIBAIE, a joinery specialist for over 50 years. Based in Cholet (Maine-et-Loire), WIBAIE is a key player in the French window and door market. Our business is 100% dedicated to Building & Housing distribution, and our industrial expertise has ... |
| danielslawgroupllc.com | · Jul 21, 2025 | Daniels Law Group LLC is a results-oriented law firm located in Grand Junction, Colorado, specializing in civil law with an emphasis on domestic relations, including complex divorces and family law matters. The firm serves clients across the ... |
| Bronze Craft | · Jul 21, 2025 | The company has failed to negotiate with us. New files will be published every 12 hours. File directory: http://securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion/BronzeCraft/ -- Files of interest -- |
| chainstoreguide.com | · Jul 21, 2025 | Chain Store Guide is the leader in Retail Foodservice sales leads, market research, and geocoded locational data, offering a 7-day free trial access to company profiles and contact information. With 97.6% data accuracy and 15 years of histori ... |
| Krusell | · Jul 21, 2025 | Adiantes is a Thailand-based manufacturer specializing in premium quality sustainable leather goods, including handmade handbags, belts, and various accessories. The company focuses on bespoke product design, blending traditional craftsmanshi ... |
| Tiger Communications | · Jul 18, 2025 | If the company does not contact us by 25/07/2025, their files will be published Full file directory: [coming soon] -- Files of interest -- List of customers and their contracts: tiger/E$/Sha ... |
| Ritenour School District | · Jul 18, 2025 | The Ritenour School District, located in Northwest St. Louis County, is one of the oldest districts in the metropolitan area. They have grown from that one room cabin into 10 schools, an early childhood center and a large adult community prog ... |
| KEP Credit Union KEP | · Jul 17, 2025 | KEP Credit Union offers professional and personal financial services tailored to the needs of its members, focusing on saving, investment, and lending. The organization aims to provide flexible loan options and facilitate investment opportuni ... |
| lawforpersonalinjury.com | · Jul 17, 2025 | Prince & Schmidt Personal Injury Lawyers specializes in personal injury law, representing clients in cases such as medical malpractice, vehicle accidents, civil rights violations, and premises liability. Based in Santa Fe, NM, the firm serves ... |
| Media Broadcast Satellite | · Jul 17, 2025 | Media Broadcast Satellite GmbH is a trusted service integrator and managed gateway operator that specializes in satellite and data network communications. The company offers a variety of solutions, including SATCOM as a Service, Infrastructur ... |
| joseantoniorodriguez.com | · Jul 16, 2025 | For over 40 years, we have provided tax and accounting consulting , labor consulting , management , legal consulting , insurance brokerage , and real estate agency services . We have offices in Santander, Cabezón de la Sal, San Vicente de l ... |
| Specialty Components | · Jul 16, 2025 | Specialty Components incorporated has over 30 years experience in designing and manufacturing precision air bearings for semiconductor manufacturing, machine components and metal optics. Our standard product lines include linear, spherical a ... |
| ResourceEnergy | · Jul 16, 2025 | All of data will be available to download on July 15th. Resource Energy was founded in 2007 with the mission of assisting commercial real estate owners with their energy needs. Principals Scott Reinstein, Steven Schlussel, and Richard Plutze ... |
| Halvorsen Family Law Group | · Jul 15, 2025 | At Halvorsen Family Law, we understand that family is everything. When legal issues arise, you need someone who cares about your family as much as you do. We value our clients as we passionately represent them before, during, and even after ... |
| WH Rogers Sheet Metal | · Jul 15, 2025 | WH Rogers Sheet Metal has specialized in the custom fabrication of metal parts for over 50 years, serving the Carolinas with advanced computerized technologies. They offer services based on client designs or with assistance from their CAD dep ... |
| City of Green River | · Jul 15, 2025 | The City of Green River, Utah providing information about community, recreation, events and government to visitors, the local community, employees, business, and government |
| The Paul Wilkinson Law Firm | · Jul 15, 2025 | The Paul Wilkinson Law Firm is a Denver-based personal injury law firm that specializes in helping victims of car, truck, motorcycle, and other motor vehicle accidents. Led by Paul Wilkinson, the firm provides legal representation to clients ... |
| ProActive Solutions USA | · Jul 15, 2025 | Based in Green Bay, Wis. ProActive Solutions USA, LLC is a privately held, ISO 9001 company that is a manufacturer of sanitizers, cleaning chemicals and herd health products for the farm and food industries. They are also a distributor of com ... |
| VM Racing | · Jul 15, 2025 | VM Racing, is a retail company specializing in sports merchandise and equipment. The company deals with the sale of sporting goods, mainly related to the motorcycle sector.We hacked VM Racing and managed to obtain 1.041.539 files, worth 83GB. ... |
| Culver's Lawn & Landscape, Inc. | · Jul 14, 2025 | Culver’s Lawn & Landscape began in 1982, when entrepreneur Todd Culver started a lawn mowing business at the age of 12 in Dallas, Texas. Originally from Iowa, Todd moved back to Cedar Rapids in 1984 where he continued his lawn & landscaping ... |
| pinnacle Roofing and Exteriors | · Jul 13, 2025 | Pinnacle Roofing and Exteriors, Inc. is a roofing and exteriors company located in Charlotte, NC, specializing in a variety of roofing solutions including metal, slate, and traditional shingles, as well as gutter services and custom metal fab ... |
| Darien Telephone | · Jul 11, 2025 | Darien Telephone Company is a family-owned independent communications provider that offers high-speed internet, telephone, and cable services. They cater to both residential and business customers with a focus on rural community needs. Their ... |
| nexa.bb | · Jul 11, 2025 | Nexa is a professional service firm based in Barbados providing client focused accounting, advisory, auditing, consulting, corporate and tax services. At nexa we strive to build strong and long-lasting relationships with our clients. We aim t ... |
| www.intereum.com | · Jul 11, 2025 | Founded in 1980, Intereum is a provider of furniture, audio and visual solutions, and wall systems. Intereum products and services include modular walls, audiovisual integration, and space planning for the corporate, healthcare, education, an ... |
| fuld.com | · Jul 11, 2025 | Founded in 1978 and headquartered in Boston, Massachusetts, Fuld + Company LLC is in the practice of Financial research, Analytics and Competitive intelligence to support competitive strategyhelping executives understand the intricacies of th ... |
| Accu Reference Medical Lab | · Jul 10, 2025 | About Accu Reference Medical Lab Accu Reference is a state-of-the-art medical testing laboratory service that provides a complete range of tests for diagnosis, screening or evaluation of diseases and health conditions. We are certified under ... |
| Microf | · Jul 9, 2025 | Microf specializes in HVAC and water heater financing solutions with lease-to-own options, particularly catering to homeowners with challenged credit. The company offers a simple application process, quick approvals, and flexible payment plan ... |
| volpatoindustrie.it | · Jul 8, 2025 | Since 1974, Volpato Industrie has been working with the aim of continuously improving the technical and aesthetic quality of its products. An approach totally oriented towards customer satisfaction that has allowed the company to develop the ... |
| Ridewill SRL | · Jul 7, 2025 | Ridewill, is a retail company specializing in sports merchandise and equipment. The company deals with the sale of sporting goods, mainly related to the cycling sector. Our team managed to breach Cenomi Retail network. We hacked Ridewill and ... |
| knightknox | · Jul 4, 2025 | We are a Manchester-based, proven property investment specialist with a 20-year history in the property investment business. We specialise in identifying and sourcing high-yield property investments for clients across the UK and overseas. Our ... |
| Punta Del Agua | · Jul 4, 2025 | Punta del Agua is a family-owned dairy company with over 55 years of experience in producing high-quality dairy products. Their extensive product range includes various cheeses, butter, dulce de leche, and powdered milk, all made from premium ... |
| Cenomi Retail | · Jul 3, 2025 | Cenomi Retail, founded in 1990, is a retail company specializing in sports merchandise and equipment. With operations across North America, the Middle East, Africa, and Asia, the company offers both business-to-business and direct-to-consumer ... |
| vresystems.com | · Jul 3, 2025 | If the company does not contact us by 09.07.2025, the data will be published Full file directory here: [coming soon] -- Files of interest -- Employee information: name, DOB, SSN, address, payroll, family members, email: /home/vresys ... |
| corpdvs.com | · Jul 2, 2025 | Corporate Data Voice Solutions is a leading systems integrator and technology consultant with over two decades of industry leadership experience. The company specializes in providing companies with customized, future-ready IT solutions that i ... |
| conlonproducts.net | · Jul 2, 2025 | We offer a solution. As you know, Conlon Products is a local, family-owned, wholesale distributor of paper products, cleaning supplies, safety products and janitorial equipment serving the Merrimack Valley for over 50 years. We have great pro ... |
| https://www.injusa.com/ | · Jul 2, 2025 | INJUSA was born as a family business, and we can say today that it still preserves that spirit of unity, teamwork, and continuous improvement. This spirit is evident in the results of the more than 850,000 toys it produces each year, in its d ... |
| QUINTADAMARINHA.com | · Jul 2, 2025 | Onyria Quinta da Marinha Hotel Between the city and nature, the beach and the mountains, the Onyria Quinta da Marinha Hotel - located in the privileged area of Cascais-Sintra, just 25 km from Lisbon - offers you the perfect setting to enjoy ... |
| atlantissubmarines | · Jul 2, 2025 | Atlantis Submarines is a pioneering leader in passenger-carrying submarine technology, established in 1985, and known for developing the world's first tourist submarine. The company has safely completed over 580,000 dives, carrying over 18 mi ... |
| fcsserves.org | · Jul 2, 2025 | Family & Community Services, Inc. is a non-profit corporation headquartered in Portage County, Ohio. The agency began in 1941 as the Catholic Charities Bureau of the Ravenna Deanery with just two programs and two staff members. Today, FCS ope ... |
| Mainetti | · Jul 2, 2025 | Headquartered in The Scottish Borders, United Kingdom, Mainetti is a manufacture and supplier of packaging for the fashion industry and a provider of smart retail solutions.For over sixty years, Mainetti has been a trusted partner to the worl ... |
| villagecoin.com | · Jul 1, 2025 | Village Coin Shop specializes in providing a wide variety of numismatic products.The store is also recognized as a dealer of US Mint bullion and Royal Canadian Mint bullion. 1.Client lists 2.File is an invoice from SilverTowne (STLP) to Vil ... |
| parsons-peebles.com | · Jul 1, 2025 | Parsons Peebles is a global mechanical and electrical engineering service provider specializing in high, medium and low voltage motors, generators, pumps, gearboxes and compressors. 1.QOS (Quality of Services) and TDC Parsons Peebles Agreeme ... |
| capmark.org | · Jul 1, 2025 | An independent registered municipal advisor dedicated to providing public jurisdictions with comprehensive advice on planning, structuring and issuing bonds, notes and lease debt to meet their capital and cash flow needs. Their prospective ... |
| Alert Medical Alarms | · Jul 1, 2025 | Alert Medical Alarms is a nationwide leader in Personal Emergency Response Systems (PERS), bringing over 25 years of healthcare expertise to deliver innovative, life-enhancing solutions. Our mission is to empower individuals and support manag ... |
| LP Charpente | · Jul 1, 2025 | Charpente in Annecy in the Haute-Savoie region of France, LP Charpente is a builder of timber-frame houses and all types of traditional carpentry work, including zinc work, roofing and building extension renovations. |
| exhibits-intl.com | · Jul 1, 2025 | Founded in 1961, kubik maltbie produces experiences for museums, visitor centers, and exhibition projects. It offers fabrication and installation services, exhibit design and production, and creation of interactive exhibits. The company is he ... |
| simmons-Boardman Publishing, Inc | · Jun 30, 2025 | Simmons-Boardman Publishing Corporation is one of the oldest, most well-respected, privately held B2B publishers. Our diverse portfolio of print and digital products includes magazines, books, directories, email newsletters, conferences, webs ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .