qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
30▲17 vs prev. week
Victims · 30d
114active targets
Victims · 90d
365
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-18 13:53UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,262 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| ccllabel.com | · May 29, 2025 | All data of this company will be available for download on 12.06.2025.Operating in the packaging and advertising industry for over sixty years, CCL is a global leader in the supply chain of innovative, high-quality packaging, promotional medi ... |
| tmcousa.com | · May 29, 2025 | All data of this company will be available for download on 09.06.2025. TMCo, Inc. - an Oklahoma corporation specializing in the manufacture of orifice fittings for natural gas metering.The company was founded in September 2003 and has manufac ... |
| hallmarknameplate.com | · May 29, 2025 | All data of this company will be available for download on 14.06.2025.Hallmark Nameplate is located in a 30,000 square foot manufacturing facility in the heart of Central Florida. Since 1957, our engineering and manufacturing teams have been ... |
| mhmlawgroup.com | · May 29, 2025 | All data of this company will be available for download on 10.06.2025. MHM Law Group is one of the fastest growing law firms in California. The firm handles all personal injury, immigration, and criminal defense matters. 1.The document is a ... |
| innovasystems.com | · May 28, 2025 | InnovaSystems, Inc., based in Mooretown, New Jersey, was founded by John Waters (President) and Nick Schreier, in 1989 as a technology engineering company. InnovaSystems provided then, and continues to provide now, a single source for clients ... |
| Lasercam | · May 27, 2025 | Lasercam specializes in providing advanced milling machines and a variety of cutting tools including dies, blanking tools, and stripping tools. Their products cater to industries that require precision machining and tool-making solutions. Whi ... |
| Cape Robbin Inc | · May 27, 2025 | Cape Robbin is the ultimate runway-inspired fashion brand for women’s shoes, offering a combination of style and affordability. Featuring bold heels and chic sandals, each designed with the fashion-conscious woman in mind. Cape Robbin is a ... |
| www.nexus.edu.my | · May 27, 2025 | We accomplish this by "celebrating diversity and challenging minds". Our promise is to treat everyone as gifted and talented individuals and to foster those talents and gifts through careful mentorship and guidance that is based on respect fo ... |
| Centralno grijanje Tuzla | · May 27, 2025 | The central heating of the city of Tuzla was established in 1977 and since then has provided its users with central heating services that cannot be compared in terms of reliability, quality, and price to any other type of heating in Bosnia an ... |
| elitavia.com | · May 24, 2025 | One of Europe's largest mixed fleet business aircraft operators, Elit'Avia is a fully-integrated provider of business aircraft sales, leasing, charter, aircraft management and related services, including flight operations management, staff pr ... |
| Berko İlaç Ve Ki̇mya San Aş | · May 23, 2025 | Pharmacist Berat Beran, who started to work with the thought "I received education to produce medicine, not to present it" from the first day of his career, first realised his love of production in his pharmacy. Berat Beran, who later continu ... |
| www.bestop.com | · May 23, 2025 | In the shadow of the Rocky Mountain foothills in 1954, Tom Bradley started Bestop in a small upholstery shop in Boulder, Colorado. He envisioned a Jeep top that could easily open up to let in the pine-scented air and warm sun, making his driv ... |
| radiologue.paris | · May 22, 2025 | The radiological groups IMEF and RIM Maussins Nollet have joined forces to form a single medical structure that is completely independent of non-medical financial groups. Our values are those of a human radiology, based on coherent medical pr ... |
| Cacspmec | · May 22, 2025 | CACSPMEC (Cooperativa de Ahorro y Crédito de los Servidores Públicos del Ministerio de Educación y Cultura) is an Ecuadorian financial cooperative organization founded in 1978. It provides a wide range of financial services, including savi ... |
| The Holiday:Adult Care Community & Retirement Homes | · May 21, 2025 | All data of this company will be available for download on 29.05.2025.Holiday Skilled Nursing and Rehabilitation Center in Manville is a family-owned facility that has been proudly serving Northern Rhode Island since 1973. Our team is compose ... |
| tennsco.com | · May 20, 2025 | All data of this company will be available for download on 1.06.2025.Founded in 1961, Tennsco manufactures and supplies storage and archiving systems, steel office furniture, industrial and institutional systems, shelving, lockers, and commer ... |
| edgeanalytical.com | · May 19, 2025 | All data of this company will be available for download on 28.05.2025.Edge Analytical provides comprehensive laboratory testing services including organic, inorganic, microbiological analyses and specialty testing for drinking water, soils, b ... |
| blainemn.gov | · May 16, 2025 | All data of this company will be available for download on 28.05.2025. The Parks Department provides a comprehensive, year-round recreational activity program for residents of all ages. Parks is the focal point for residents seeking informati ... |
| abilenetx.gov | · May 16, 2025 | All data of this company will be available for download on 27.05.2025.The Abilene Housing Authority (AHA) provides affordable housing options to 20 counties in West Central Texas.AHA administers two rental subsidy programs for the U.S. Depart ... |
| gmb.com | · May 16, 2025 | All data of this company will be available for download on 25.05.2025.GMB Architecture + Engineering is a full-service architecture and engineering firm of approximately 90 professionals,with offices in Holland, Michigan; Grand Rapids, Michig ... |
| chreynolds.com | · May 16, 2025 | All data of this company will be available for download on 27.05.2025.Founded in 1983 as an electrical contracting firm, CH Reynolds (CHR) now provides a comprehensive portfolio of electrical, data construction, managed IT services. We share ... |
| cwcglobal.com | · May 16, 2025 | All data of this company will be available for download on 29.05.2025.Provider of industrial supplies and packaging solutions. The company serves a variety of industries, including agriculture, construction, warehousing, marine and food proce ... |
| gestionnaireimmobilier.ca | · May 16, 2025 | All data of this company will be available for download on 26.05.2025. It is a Canadian company with over 37 years of experience in the property management industry serving the Greater Montreal region including Laval, Montreal, Reeve-Nor and ... |
| compagnons-du-devoir.com | · May 16, 2025 | All data of this company will be available for download on 25.05.2025.The Association ouvrière des Compagnons du Devoir et du Tour de France (AOCDTF) is a non-profit association under the law of 1901. It brings together men and women of the ... |
| aldersonlaw.com | · May 16, 2025 | All data of this company will be available for download on 27.05.2025. Alderson Law Firm is a full-service law firm located in Topeka, Kansas, founded in 1983. The firm specializes in various areas of law, including administrative law, busine ... |
| scelltech.com | · May 16, 2025 | All data of this company will be available for download on 28.05.2025.Scelltech specializes in marking, signage, floor finishing and pavement maintenance services. Whether you're a general contractor, a property manager or your municipality's ... |
| Straits Construction | · May 16, 2025 | For more than five decades, company played a major role in transforming Singapore’s urban landscape. Company's ongoing projects includes Tengah Plantation EC Plot A,THE CONTINUUM,TERRA HILL,KI RESIDENCES, and other fashionate and monumenta ... |
| ITinSell group | · May 15, 2025 | The ITinSell group is made up of several companies working hand in hand with a common objective: to collect, structure, exploit and secure data! With ITinSell Software we offer a 100% Saas platform to improve the experience and performance ... |
| MKA Accountants: Business Advisers, Moonee Ponds VIC | · May 15, 2025 | For over two decades, MKA Accountants has been delivering high quality accounting services to clients across a wide range of industries. We understand that each client has unique needs and challenges, which is why we take a personalised appro ... |
| www.cmic-cmo.com | · May 14, 2025 | CMIC CMO Co Ltd is a company that operates in the Drug Stores & Pharmacies industry. It employs 250to499 people and has 25Mto50M of revenue. The company is headquartered in Shimada, Shizuoka, Japan. |
| SHRADERLAW | · May 8, 2025 | Shrader & Associates, L.L.P. is pleased to recognize Roberts' and Romani's contributions with this well-earned promotion. As a firm with national recognition by the likes of CNN and CBS, each attorney on its roster must meet extremely high st ... |
| www.hcsheriff.gov | · May 8, 2025 | Hamilton County, TN In anticipation of this weekends July 4th festivities, the Hamilton County Sheriffs Office would like to offer the following safety reminders to ensure the citizens of Hamilton County enjoy a safe and meaningful holiday. J ... |
| mdgny.com | · May 6, 2025 | All data of this company will be available for download on 16.05.2025.MDG Design & Construction is a leading affordable housing-only contracting and development firm specializing in the rehabilitation and new construction of affordable reside ... |
| clinpath.com | · May 6, 2025 | All data of this company will be available for download on 16.05.2025.Founded 50 years ago, the breadth and depth of expertise of Clin-Path associates is unmatched statewide. Professional and laboratory services are provided to hospitals, phy ... |
| gslelectric.com | · May 6, 2025 | All data of this company will be available for download on 16.05.2025. GSL Electric Inc. performs a wide range of projects for public and private clients, including commercial, industrial, institutional, manufacturing, utility, transmission l ... |
| jbanksdesign.com | · May 6, 2025 | All data of this company will be available for download on 16.05.2025. J. Banks Design is a full-service interior design firm with over 55 employees, a leader in residential and hospitality design. For over thirty-six years, our certified des ... |
| gates-cooper.com | · May 6, 2025 | All data of this company will be available for download on 16.05.2025. Gates & Cooper LLP is an intellectual property law firm specializing in providing high-value patent prosecution and related intellectual property legal services to large c ... |
| NSS 長崎船舶装備株式会社 | · May 6, 2025 | Since our founding in 1943, our shipbuilding business has supported Japan's shipbuilding industry with interior construction work. We boast the long history and track record of excellence in the ship interior industry, with a national market ... |
| HCI Informatique d'entreprise | · May 2, 2025 | Située à Perpignan, au cœur du Roussillon, dans les Pyrénées-Orientales, HCI est une ESN (Entreprise de Services du Numérique). Créée en 1998, H.C.I. est spécialisée dans l'ingénierie réseau, la maintenance, l'installation, le sui ... |
| Megachem Singapore | · May 2, 2025 | Propelled by a vision to be a leading chemical player, MegaChem has evolved through the decades to become a valued chemical solutions provider to its business partners; one that is able to meet its customers' needs through innovation and valu ... |
| cobbcounty | · May 1, 2025 | Cobb County is a county in the U.S. state of Georgia, and is a core county of the Atlanta metropolitan area in the north-central portion of the state. We also publish a full dump AD. 400.000+ files. over 150gb. All data will be rel ... |
| www.newseason.com | · May 1, 2025 | Founded in 1986, New Season provides opioid drug addiction treatment. It offers medication-assisted treatment, counseling, and medical services. It is headquartered in Maitland, Florida. |
| www.ancc.org | · May 1, 2025 | Started in 1861, the Army Navy County Club offers golfing, swimming, use their fitness center, and golf and tennis Pro Shops to its members. |
| MALAYSIA AIRPORTS HOLDINGS BERHAD Part 1 of data taken !!! | · May 1, 2025 | Our team managed to breach and encrypt Malaysia Airport Holdings Berhad's network, further read as MAHB. The network was completely encrypted excluding flight control systems and over 2TB of data leaked from there. It was a complex IT o ... |
| SoloVue | · May 1, 2025 | SoloVue is a cutting edge, revolutionary new software service that is now available to the wholesale distribution industry. Developed by Solo Business Systems Inc., a Costa Mesa, CA based company, SoloVue provides a managed business solution ... |
| mossyoak.com | · May 1, 2025 | All data of this company will be available for download on 11.05.2025.It’s not a passion, it’s an obsession. Every day at Mossy Oak, we live and breathe the outdoors — from hunting and conservation, to stewardship and legacy efforts. Si ... |
| dlcid.com | · May 1, 2025 | All data of this company will be available for download on 11.05.2025.Founded in 2015 by Jon de la Cruz, De la Cruz Interior Design (DLC-ID) is a distinguished residential and hospitality design firm based in San Francisco. At his namesake fi ... |
| bostonconveyorandautomation.com | · May 1, 2025 | All data of this company will be available for download on 11.05.2025.BCA, Boston Conveyor & Automation took its name from a city with a revolutionary history that has shaped itself into a world-class, technology-driven metropolis. Like that ... |
| nuovadfl.it | · May 1, 2025 | All data of this company will be available for download on 11.05.2025.DFL, an acronym for “Distribuzione Ferramenta Lamura,” is a hardware wholesaler, based in Sala Consilina (Salerno province); founded more than 45 years ago by Giuseppe ... |
| rfsd13.org | · May 1, 2025 | All data of this company will be available for download on 11.05.2025.Rock Falls Elementary School District #13 is a PreSchool through 8th grade district. Our Elementary district is the largest of three elementary school districts that attend ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .