qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
30▲17 vs prev. week
Victims · 30d
123active targets
Victims · 90d
365
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-18 13:53UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,262 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| upstartpower.com | · Jun 12, 2025 | All data of this company will be available for download on 23.06.2025. Upstart Power was founded in 2018 with a mission to design and manufacture solid oxide fuel cell (SOFC) generators that will make a sensation in the market, are reliable, ... |
| dcinvestors.com | · Jun 12, 2025 | All data of this company will be available for download on 24.06.2025.Duff Capital Investors is a conglomerate of more than 20 companies operating in a variety of sectors, including trucking, tires, automotive, construction, energy and insura ... |
| biokplus.com | · Jun 12, 2025 | All data of this company will be available for download on 23.06.2025.Bio-K Plus International specializes in the research, production and marketing of Bio-K+ probiotic. 1.Confidential agreement. 2.Non-disclosure agreement. |
| haydist.com | · Jun 12, 2025 | All data of this company will be available for download on 26.06.2025.Hayward is a family-owned, two-stage distribution company focused on dealers in the outdoor power equipment, small engine, farm equipment, construction, forestry, furnace a ... |
| wilsonappliance.com | · Jun 12, 2025 | All data of this company will be available for download on 24.06.2025.Wilson AC & Appliance was founded in 1949 by J. W. Wilson, Jr. and his wife Lurleen. After returning from service in the Pacific during World War II, J.W. decided to explor ... |
| garmonandcompany.com | · Jun 12, 2025 | All data of this company will be available for download on 26.06.2025.Garmon & Company specializes in commercial flooring designed specifically for businesses looking to expand their reach and impact. The company prides itself on understandin ... |
| skirball.org | · Jun 12, 2025 | All data of this company will be available for download on 22.06.2025.Skirball Cultural Center is a meeting place guided by the Jewish tradition of welcoming the stranger and inspired by American democratic ideals of freedom and equality. 1. ... |
| nucamprv.com | · Jun 12, 2025 | The full leak will be published soon, unless a company representative contacts us via the channels provided.nuCamp RV (http://nucamprv.com) manufactures the highest quality recreational vehicles on the market today. Integrity lies at the core ... |
| titantrailers.com | · Jun 12, 2025 | The full leak will be published soon, unless a company representative contacts us via the channels provided.Titan Trailer Mfg., manufactures Cargo, Stock and Horse Trailers. All trailers are made with Steel frames and galvanneal metal. We hav ... |
| McCracken Financial Solutions | · Jun 12, 2025 | McCracken Financial Solutions Corporation offers commercial loan servicing software that automates the entire lifecycle of loans, including origination, servicing, accounting, and asset management. Their comprehensive system integrates variou ... |
| lawyersmutual.com | · Jun 12, 2025 | All data of this company will be available for download on 16.06.2025.Lawyers Mutual Insurance Company is a key provider of legal malpractice insurance designed specifically for California lawyers, boasting five decades of reliable service. T ... |
| apollomd.com | · Jun 12, 2025 | All data of this company will be available for download on 16.06.2025.ApolloMD is a fully integrated and coordinated national group practice,that partners with more than 100 leading medical facilities across the country to provide multidiscip ... |
| www.waveny.org | · Jun 12, 2025 | Committed to our community for over 50 years as a trusted nonprofit, Waveny has sought to provide the highest quality care since 1975. From independent, assisted and memory care living, to at-home and in-patient short-term physical rehabilita ... |
| www.kerrvilleisd.net | · Jun 11, 2025 | Founded in 1890, Kerville Public School District is an accredited 5-A school district located in Texas Hill Country. The District is home to seven traditional campuses, one early childhood center, and an academic alternative high school. The ... |
| Asefa Insuarance | · Jun 11, 2025 | Founded in Spain in 1972, Asefa was part of the SMABTP group, a leader French insurer in building and civil works in France with more 160 years of experience. In Asefa Seguros they have been committed to the needs of clients and collaborators ... |
| bioalleva | · Jun 11, 2025 | Il biologico a piene mani. Definirsi amanti del biologico non basta, bisogna crederci fino in fondo. Per Bioalleva non mai stata semplicemente una tendenza, ma una vera e propria vocazione: rispettare lintegrità del territorio per recuperare ... |
| fasse.com | · Jun 11, 2025 | Fasse Valves specializes in precision motion control, offering a wide range of hydraulic valves and controls engineered for demanding applications. Their products cater to industries such as agriculture, construction, lawn and turf care, and ... |
| rmzoilfield.com | · Jun 10, 2025 | RMZ Oil field was established by the team of oilfield experts with respective experience in providing "complete solution for oilfield industry", RMZ is a Singapore based company specializes in design and manufacturing of oilfield Equipment's ... |
| palawancoop hospital | · Jun 10, 2025 | All data of this company will be available for download on 22.06.2025 The MMG-PPC Cooperative Hospital now known as Palawan Medical Mission Group Multipurpose Cooperative (PMMGMPC) is owned and managed by its members whose aim is to provide ... |
| girv | · Jun 9, 2025 | Girva International Broker Srl is a company that operates in the Automobile Dealers industry. It employs 10to19 people and has 1Mto5M of revenue. The company is headquartered in Castellammare di Stabia, Campania, Italy.GI.R.VA. INTERNATIONAL ... |
| dugoni | · Jun 9, 2025 | Dugoni is a company that operates in the Facilities Management & Commercial Cleaning industry. It employs 20to49 people and has 1Mto5M of revenue. The company is headquartered in Mantova, Lombardy, Italy. |
| ecoter | · Jun 9, 2025 | As rare as it is specialized, the profession of naturalist engineer—or ecologist—aims to diagnose a natural ecosystem in order to understand the ecological challenges of a site and guide development projects in intelligent collaboration w ... |
| golf-schoenenberg.ch | · Jun 5, 2025 | All data of this company will be available for download on 16.06.2025. The famous Schönenberg Golf and Country Club. In this privileged geographical location, a challenging 18-hole golf course was built in 1967, which has since met the highe ... |
| frylite.com | · Jun 5, 2025 | All data of this company will be available for download on 17.06.2025.Every member of the Frylite team is proud to contribute to the complete supply of vegetable oil and waste cooking oil collection to all our customers throughout Ireland. Fo ... |
| regen.com | · Jun 5, 2025 | All data of this company will be available for download on 16.06.2025.Celebrating 40 years, since 1983, ReGenerating Solutions, a privately held technology consulting firm, has built and maintained a reputation for delivering to customers the ... |
| regentscapital.com | · Jun 5, 2025 | All data of this company will be available for download on 17.06.2025.Regents Capital Corporation is a rapidly growing independent commercial equipment finance firm committed to changing the way companies finance equipment. Regents believes i ... |
| cityofbelvedere.org | · Jun 5, 2025 | All data of this company will be available for download on 18.06.2025.Belvedere is one of the smallest and oldest cities in California. It was incorporated in 1896 and is located north of San Francisco across the Golden Gate Bridge in Marin C ... |
| microman.com | · Jun 5, 2025 | All data of this company will be available for download on 17.06.2025.Founded in 1987, Microman is a full-service technology integrator with over 2,000 installed networks in 25 years of operation. Their focus is the cost-effective application ... |
| healthtrust.org | · Jun 5, 2025 | All data of this company will be available for download on 17.06.2025.In 1996, The Health Trust was formed through the sale of a local not-for-profit hospital system to a for-profit corporation. Since then, we have been serving the Silicon Va ... |
| brucknertruck.com | · Jun 5, 2025 | All data of this company will be available for download on 18.06.2025.Founded in 1932, Bruckners Truck & Equipment offers a wide range of trucks and trailers, semi-trailer repair, and an extensive parts catalog. The company is headquartered i ... |
| britteninc.com | · Jun 5, 2025 | All data of this company will be available for download on 19.06.2025.Britten is a creative production house dedicated to creating innovative signage, displays and event branding solutions that set our clients apart from the crowd. Utilizing ... |
| accuvein.com | · Jun 5, 2025 | All data of this company will be available for download on 19.06.2025.AccuVein Inc. - the world leader in vein imaging technology. AccuVein's flagship product, AccuVein, is the world's only portable, non-contact vein illumination solution. Th ... |
| appotech | · Jun 5, 2025 | AppoTech is a semiconductor company who provides one-stop solution in IC design and application development. It was founded in 2003 by Mr. Cheng Cheuk Wing from Silicon Valley in the United States. AppoTech is headquartered in HongKong, and h ... |
| FLOE International | · Jun 3, 2025 | FLOE International, Inc. engages in the manufacture of aluminum docks, boat lifts, and trailers. It offers modular docks, roll-in docks, floating docks, dock accessories, boat lift accessories, snowmobile trailers, enclosed trailers, utility ... |
| VANTAGE | · Jun 3, 2025 | By allowing over 2TB of sensitive data — primarily client information — to be exfiltrated, the company has demonstrated a blatant disregard for the privacy and trust of its customers. They now have exactly 150 hours to make contact. If t ... |
| basakkent | · Jun 3, 2025 | Başakkent Law and Mediation Office is a distinguished legal practice offering a comprehensive range of services in both law and alternative dispute resolution. We are honored to serve a diverse clientele, including embassies, international c ... |
| sky | · Jun 3, 2025 | Established in 1987, Sky-mac is specialised in Air-Conditioning and Mechanical Ventilation (ACMV), HVAC system, related services, which encompasses the designing, installation, service, maintenance and repair of ACMV systems. Sky-mac has o ... |
| radicon | · May 31, 2025 | The Radicon product range, not only consists of the traditional standard product offering of worm gears, geared motors, couplings and industrial reducers, but also includes custom engineered gearboxes with an output torque range over 50 milli ... |
| office-national | · May 30, 2025 | Office National is an Australian network of independent office supply stores. It is located in a suburb of Sydney, NSW, Australia. |
| www.shautoparts.com | · May 30, 2025 | At SH Auto Parts, we leverage cutting-edge computerized and robotic technologies to deliver precision-engineered auto components. Our fully automated smart factory ensures the highest levels of quality and safety throughout the manufacturing ... |
| evergreen-hotel | · May 30, 2025 | Evergreen Hospitality Group is one of British Columbia's largest family-owned hospitality and tourism companies, dedicated to showcasing the region's beauty to its guests. The group operates a variety of accommodations across 26 destinations, ... |
| wheel-king | · May 30, 2025 | Wheel King Transhaul Inc. is a privately held Canadian company with dedicated fleet services as its core business. Our company is built upon the values and work ethics that are foundational to family operated businesses. We offer our custome ... |
| Chalmers Suspensions International | · May 30, 2025 | Chalmers Group is a privately owned corporation with subsidiaries in the U.S. and Canada, offering niche quality products to medical and transportation equipment industries since 1992. For the last 50+ years their high performing suspension p ... |
| eli | · May 29, 2025 | Benvenuto in Little Italy at Frankfurt Airport How wonderful that Italian cuisine exists, with its colorful and aromatic dishes that always taste a little like vacation. With crisp salads, soups, succulent meat, and fresh fish, LITTLE ITALY ... |
| bcps.k12.va.us | · May 29, 2025 | All data of this company will be available for download on 12.06.2025.The mission of Botetourt County Public Schools is to provide all students with the quality learning experiences necessary to grow, adapt, and meet the challenges of respons ... |
| personalassistants.com | · May 29, 2025 | All data of this company will be available for download on 10.06.2025.In 2004, Dallas-based entrepreneurs Adam Alfia and Kfir Alfia co-founded Maestro Personal Assistants, which focuses on providing personal assistance and concierge services ... |
| a1trusses.com | · May 29, 2025 | All data of this company will be available for download on 09.06.2025.A1 Trusses Ltd. has been building timber trusses for contractors and residents of the Lower Mainland area of Vancouver since 1983. We are one of the oldest truss companies ... |
| teamhorner.com | · May 29, 2025 | All data of this company will be available for download on 11.06.2025.Team Horner is a family of companies operating in various fields in the pool and spa industry worldwide. Founded in 1969, Team Horner is an integrated manufacturer, wholesa ... |
| logan.edu | · May 29, 2025 | All data of this company will be available for download on 13.06.2025.Logan University is a private university specializing in chiropractic and health sciences located in Chesterfield, Missouri. 1.Part-time employment agreement between Logan ... |
| cpshawaii.net | · May 29, 2025 | All data of this company will be available for download on 12.06.2025.ControlPoint Surveying, Inc. - a recognized leader in topographic, hydrographic and cadastral surveying in Hawaii and the Pacific Rim. The name of the firm is associated wi ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .