qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
30▲16 vs prev. week
Victims · 30d
123active targets
Victims · 90d
365
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-18 13:53UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,262 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| capmark.org | · Jul 1, 2025 | An independent registered municipal advisor dedicated to providing public jurisdictions with comprehensive advice on planning, structuring and issuing bonds, notes and lease debt to meet their capital and cash flow needs. Their prospective ... |
| Alert Medical Alarms | · Jul 1, 2025 | Alert Medical Alarms is a nationwide leader in Personal Emergency Response Systems (PERS), bringing over 25 years of healthcare expertise to deliver innovative, life-enhancing solutions. Our mission is to empower individuals and support manag ... |
| LP Charpente | · Jul 1, 2025 | Charpente in Annecy in the Haute-Savoie region of France, LP Charpente is a builder of timber-frame houses and all types of traditional carpentry work, including zinc work, roofing and building extension renovations. |
| exhibits-intl.com | · Jul 1, 2025 | Founded in 1961, kubik maltbie produces experiences for museums, visitor centers, and exhibition projects. It offers fabrication and installation services, exhibit design and production, and creation of interactive exhibits. The company is he ... |
| simmons-Boardman Publishing, Inc | · Jun 30, 2025 | Simmons-Boardman Publishing Corporation is one of the oldest, most well-respected, privately held B2B publishers. Our diverse portfolio of print and digital products includes magazines, books, directories, email newsletters, conferences, webs ... |
| semco-tech.com | · Jun 30, 2025 | SEMCO Technologies is a France-based expert in electrostatic chucks (ESCs), essential components in semiconductor device manufacturing. The company focuses on delivering advanced and tailored wafer handling solutions to meet the needs of larg ... |
| www.nuphoton.com | · Jun 30, 2025 | Nuphoton Technologies, Inc. is a pioneer in fiber lasers and fiber amplifiers with applications covering industrial, defense, aerospace, biomedical, telecommunications and research areas. The company is in operation since 1996 using proprieta ... |
| elpasoglass.com | · Jun 27, 2025 | We are commited to being one of the best and highest quality commercial contract glazing firms in the rocky mountain region. While specializing in Curtainwall, Storefront and Commercial windows we understand how important scheduling and compl ... |
| greatcdltraining.com | · Jun 27, 2025 | Over more than 30 years, Driver Solutions has specialized in providing affordable driver training and quality trucking job opportunities to new drivers. We do this by offering a company-sponsored CDL training program that allows new drivers ... |
| broadleafgame.com | · Jun 27, 2025 | Broadleaf is a family-owned food distribution company supplying high-quality meats and deli meats to distributors and retailers throughout the United States and abroad.Founded in 1988, Broadleaf entered the U.S. market as a major importer and ... |
| buffalomarine.com | · Jun 27, 2025 | Buffalo Marine Service, Inc. founded in 1935, is a bunkering and marine transportation company specializing in inland waterway towing with a focus on the Intracoastal Waterway System. 1.The document is a Professional Services Agreement (Prof ... |
| norsk.global | · Jun 27, 2025 | Norsk is a privately owned independent company. With 30 years of experience in international shipping. 1.Invoice for the purchase of an Audi Q8 Sportback Sport 55 e-t by Norsk European Wholesale Ltd. 2.UPS international shipments, including ... |
| artexmanagement.com | · Jun 27, 2025 | Artex Management was founded in 2005 to meet the industry's demand for reliable and hassle-free property management.Our mission is to achieve the standard of living you desire for each property. 1.The document is a Payment Agreement (Payment ... |
| SiloKing | · Jun 27, 2025 | SILOKING is the brand for innovative feeding technology. SILOKING Mayer Maschinenbau GmbH produces innovative feeding technology and sells it in over 50 countries worldwide. The owner-managed family company is based in Tittmoning, Bavaria. ... |
| Airedale Springs | · Jun 26, 2025 | Established in 1945 Airedale Springs Ltd is a successful family business which has gained a World-Wide reputation for up to the minute expertise for the manufacture of quality springs and wire forms for many national and international custome ... |
| Tappoo Group of Companies | · Jun 26, 2025 | The Essence of Tappoo The Tappoo Group of Companies retails, wholesales and supports an extensive range of high-quality products. RETAIL SERVICES Tappoo Department Stores are located at the key commercial centres of Suva, Nadi and Sigatoka ... |
| melilla.es | · Jun 26, 2025 | The other day we learned with interest that the autonomous city of Melilla was subjected to a serious hacker attack =) But what surprised us even more was that none of the authorities even tried to contact us. So, it's time for our team to t ... |
| Habitat for Humanity of Greater Sioux Falls, Inc. | · Jun 26, 2025 | We build, preserve & advocate for affordable housing. Habitat for Humanity of Greater Sioux Falls is committed to improving the quality of life, health and economic prosperity of our community through shelter. Eligible residents of Minnehaha ... |
| Quaser Machine Tools, Inc | · Jun 25, 2025 | Quaser Machine Tools, Inc. is a Taiwan-based company that manufactures and sells various machine tools, primarily CNC (computer numerical control) machine tools. Our team managed to breach the QMT network. 2TB of sensitive data leaked f ... |
| CMI | · Jun 25, 2025 | Credit Mediators Inc. specializes in commercial B2B debt recovery and collection services, offering solutions such as direct collect, letter series, outsourcing, and bankruptcy turnaround services. With over 40 years of experience, CMI serves ... |
| Tecore | · Jun 25, 2025 | Founded in 1991 and headquartered in Hanover, Maryland, Tecore Networks has been a supplier of 2G, 3G, 4G and 5G-ready wireless network infrastructure. Tecore Solutions Tecore Networks is a global supplier of All-G mobile networks that provi ... |
| gudeco.de | · Jun 25, 2025 | Gudeco Elektronik has been a contractual partner of leading manufacturers in the electronics industry for more than 40 years – well known as a specialist and distributor for electronic components / passive and electromechanical components, ... |
| AEROBLOX | · Jun 25, 2025 | Optimizing for What’s Next The AEROBLOX platform is currently undergoing optimization to better serve your tokenized assets. Smart contracts are syncing. Protocols are refining. Value engines are recalibrating. Your wealth is safe ... |
| sbh | · Jun 24, 2025 | BH Hotels & Resorts FUERTEVENTURA, LANZAROTE AND ZANZIBAR For more than 30 years we have been offering you comfort, gastronomy, a wide range of facilities, fun and excellent service in modern hotels located directly on the first line of the ... |
| www.covenanthealth.net | · Jun 24, 2025 | Covenant Health of Tewksbury, Mass, an innovative, Catholic regional health delivery network and a leader in values-based, not-for-profit health and eldercare. Covenant Health consists of hospitals, skilled nursing and rehabilitation centers, ... |
| caldine | · Jun 23, 2025 | Fratellanza Popolare Caldine is a company that operates in the Training industry. It employs 50to99 people and has 10Mto25M of revenue. The company is headquartered in Fiesole, Tuscany, Italy. |
| Estes Forwarding Worldwide | · Jun 23, 2025 | Estes Forwarding Worldwide (EFW) is a leading provider of high-touch, door-to-door logistics and freight forwarding solutions. Headquartered in Richmond, Virginia, and a subsidiary of Estes—the largest privately held freight transportation ... |
| rioglass-solar | · Jun 21, 2025 | Founded in 2007, Rioglass Solar is now the largest CSP mirror supplier in the world with cutting edge production facilities in Spain, the United States and South Africa. Rioglass Solar has supplied worldwide more than seven million mirrors fo ... |
| SUSTA-STAMPI | · Jun 19, 2025 | Susta Srl is a dynamic company operating in the manufacturing sector, headquartered in Castellalto, Abruzzo, Italy. The company employs between 20 and 49 people and generates annual revenues in the range of €5 to €10 million. Thanks to ... |
| januschke.at | · Jun 19, 2025 | Our mission is to provide the fastest, most effective, and secure solution to your issue. We operate at the highest professional level, supported by modern infrastructure and a comprehensive, client-focused approach. Your interests are our to ... |
| glwholesale.com | · Jun 19, 2025 | Great Lakes Wholesale Group is a retail store supplier providing quality wholesale Health & Beauty, Household, General Merchandise, OTC, Pet, Grocery and other wholesale merchandise for local, national and international discount, convenience ... |
| nipro.com | · Jun 18, 2025 | All data of this company will be available for download on 01.07.2025.Nipro Medical Corporation, headquartered in Bridgewater, is a subsidiary of Nipro Corporation, headquartered in Osaka, Japan. Founded in 1954, our parent company has over 2 ... |
| gmaxequine.com | · Jun 18, 2025 | All data of this company will be available for download on 29.06.2025.Gmax Technology develops products and services that will maximize your horse's performance and well-being. Accurate measurement of factors such as heart rate, intermediate ... |
| fiestafranchise.com | · Jun 18, 2025 | All data of this company will be available for download on 30.06.2025.Founded in 1999 and headquartered in Santa Ana, California, Fiesta Auto Insurance Centers operates as an insurance brokerage firm. The firm offers auto insurance and tax pr ... |
| realityfinance.com | · Jun 18, 2025 | All data of this company will be available for download on 27.06.2025.Reality Finance is an independent asset finance broker based in the UK with offices in Godalming, Surrey and Leeds. Established in 2000, our team of asset finance brokers h ... |
| nardinifire.com | · Jun 18, 2025 | All data of this company will be available for download on 28.06.2025.Nardini Fire Equipment is a family owned and operated company based in Minnesota and North Dakota, specializing in complete fire protection solutions for businesses of all ... |
| hparchitecture.com | · Jun 18, 2025 | All data of this company will be available for download on 30.06.2025.A Chicago-based architectural, planning and interior design firm that has been in business nationally since 1987. 1.A memo from the architectural and development team sent ... |
| kontek.com | · Jun 18, 2025 | All data of this company will be available for download on 29.06.2025.KONTEK Systems partners with customers to design, integrate and support audio-visual technology solutions. |
| mileschristi.org | · Jun 18, 2025 | All data of this company will be available for download on 29.06.2025.Miles Christi (English Soldier of Christ, postnominal abbreviation MC) is a spiritual religious order in the Catholic Church based in the Archdiocese of La Plata, Argentina ... |
| accu-search.com | · Jun 18, 2025 | All data of this company will be available for download on 30.06.2025.Established in 1984, Accu-Search Inc.'s Edmonton and Calgary offices have grown to become the largest provider of NUANS® corporate name search and incorporation services i ... |
| spacebridge.com | · Jun 18, 2025 | All data of this company will be available for download on 01.07.2025.SpaceBridge specializes in innovative satellite solutions that span broadband, tactical defense, backhaul cellular and broadcasting. The company's products include various ... |
| spg.net | · Jun 15, 2025 | The full leak will be published soon, unless a company representative contacts us via the channels provided. SPG Construction LLC specializes in heavy industrial construction and process systems for capital-intensive projects across the Unite ... |
| moserengineering.com | · Jun 15, 2025 | The full leak will be published soon, unless a company representative contacts us via the channels provided. Moser Engineering manufactures and sells High Performance Rear-ends, drive-line components, brakes and suspension parts to the afterm ... |
| faycom | · Jun 13, 2025 | Faycom specializes in providing replacement parts and accessories for various types of vehicles, including trucks, vans, and agricultural machinery. Their extensive product range includes special lighting, safety components, and equipment for ... |
| isd1.org | · Jun 12, 2025 | All data of this company will be available for download on 25.06.2025.Aitkin Public Schools is a company that employs 20 to 49 people and has revenue between 1M and 5M. It is headquartered in Aitkin, MN. 1.The document is a notice of commenc ... |
| sgapl.com.au | · Jun 12, 2025 | All data of this company will be available for download on 24.06.2025.The Skeggs Goldstien team are dedicated, experienced, professional and qualified professionals. With a combined experience of over 140 years, our team of consultants and ac ... |
| cypress | · Jun 12, 2025 | Cypress Industries is a global, vertically-integrated contract manufacturer specializing in PCB assemblies, sheet metal fabrication, wire harnesses, custom cables, custom control panels, and plastic injection molding. The company provides val ... |
| 550madison.com | · Jun 12, 2025 | All data of this company will be available for download on 23.06.2025. 550 Madison is an architectural landmark in New York City, a building managed by The Olayan Group(https://olayan.com/) Anticipated clients include companies seeking a pre ... |
| talismancivil.com | · Jun 12, 2025 | All data of this company will be available for download on 23.06.2025.Talisman Civil Consultants is a full-service design and surveying firm,based in Salt Lake City, specializing in civil engineering, land surveying and innovative design solu ... |
| lakebook.com | · Jun 12, 2025 | All data of this company will be available for download on 22.06.2025.Lake Book has been in the book production business for over 45 years. Our history and experience allows us to provide the most complete and comprehensive service to the boo ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .