qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
30▲17 vs prev. week
Victims · 30d
114active targets
Victims · 90d
365
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-18 13:53UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,262 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Matrix New World Engineering | · May 1, 2025 | Matrix New World Engineering is a company of engineering and science experts who focus on some of the nation's most pressing long-term challenges, including climate change, resiliency, ecological restoration, contamination studies, water supp ... |
| MALAYSIA AIRPORTS HOLDINGS BERHAD | · Apr 28, 2025 | Malaysia Airports Holdings Berhad: A Looming Catastrophe for Asia’s Air Travel Critical infrastructure data of a major airport operator in the Asian region has been leaked — over 2TB of sensitive information is now publicly available. ... |
| Whitley Law Firm | · Apr 28, 2025 | All data from that law office (approx. 2800 clients for 10 years) will be published 5-7 MAY 2025. When you have been injured, there are laws that protect your rights and interests. At Whitley Law Firm in North Carolina, we have a great resp ... |
| RC Manubhai | · Apr 28, 2025 | R.C. Manubhai & CO. PTE LTD, known as the best hardware in town has been providing Fiji and the Pacific with Hardware, Building Materials and Steel for over 100 years. We have financial data, personal data, and confidential internal data. |
| www.southlandscs.com | · Apr 27, 2025 | Southlands Christian Schools is a top tier K-12th private Christian school that boasts academics that consistenly rank in the top 10% of schools in the nation. |
| liftsolutionsinc.net | · Apr 27, 2025 | For over 40 years, we at Lift Solutions have prided ourselves on providing our customers with the best products and services available. For our team of highly trained and experienced material handling experts, there is no project too big or t ... |
| Penderels Trust | · Apr 27, 2025 | Penderels Trust offers advice, guidance and practical solutions to enable people with disabilities to live independently in their own homes, to achieve their goals in life and help them to play an active part in their community. We are a not- ... |
| www.unitedcaps.com | · Apr 23, 2025 | UNITED CAPS enables Total Packaging Solutions with the help of innovation, differentiated design, pioneering use of technology and services. They are based in Luxembourg.UNITED CAPS is a visionary, international pioneer in the packaging indus ... |
| parrishleasing.com | · Apr 22, 2025 | The files will be published on 1/05/2025.We are a third-generation family owned and operated business, founded in 1968 by Don Parrish Sr. We currently have two locations in Fort Wayne, IN, and specialize in: Outstanding customer service. ... |
| Richmond СPA | · Apr 21, 2025 | All data (around 300Gb) of Richmond Company CPA will be published fully on 28 Arpil, if Richomnd CPA refuse to pay ransom. We are a full-service Accounting firm licensed in WV. We offer a broad range of services for business owners, executive ... |
| Dominion Lending Centres | · Apr 21, 2025 | Whether you are a first-time buyer or an experienced buyer with excellent credit, Dominion Lending Centres has access to the very best products and rates available across Canada. Give us a call we think youll be pleasantly surprised! Our Inte ... |
| The Michelson Organization | · Apr 21, 2025 | Michelson Commercial Realty and Development L.L.C. and Knapp Development have managed the development of Sumner Park since its inception. The development team has extensive experience in developing real estate on a national basis. Since 1927, ... |
| www.monaghan.eu | · Apr 18, 2025 | Monaghan Group is a company that operates in the Grocery Retail industry. It employs 250to499 people and has 100MMto250M of revenue. The company is headquartered in Monaghan, Ulster, Ireland.At Monaghan, we're driven by a passion for sharing ... |
| farma | · Apr 18, 2025 | Farmacias Del Pueblo is a company that operates in the Drug Stores & Pharmacies industry. It employs 250to499 people and has 10Mto25M of revenue. The company is headquartered in Neuquen, Neuquen Province, Argentina. |
| 1sthealthinc.com | · Apr 18, 2025 | 1st Health Inc provides world-class care to individuals involved in automobile accidents. We provide prompt, professional medical care, from X-Rays and massage to therapeutic modalities. To make your life easier after an accident, we'll even ... |
| accesssmt.com | · Apr 17, 2025 | Founded in 1964, AccessSMT Holdings is a leading supplier, installer, and project management company that offers hardware, doors, frames, and building materials for the commercial, residential sectors. AccessSMT Holdings is located in Canada. ... |
| universalwindow.com | · Apr 17, 2025 | Universal Window and Door, LLC engages in the design, manufacture, and supply of custom window solutions for historic restoration and new commercial construction projects. The company offers steel replica, historic, projected/casement, double ... |
| bertie.k12.nc.us | · Apr 17, 2025 | Bertie County Public Schools is committed to ensuring that every child in our community receives the best possible education. We are dedicated to nurturing and supporting our students from Pre-K to 12th grade, providing them with the resource ... |
| yankeetrails.com | · Apr 17, 2025 | In 1957, Yankee Trails opened its doors with the goal of providing safe, affordable motor coach transportation to patrons in and around Upstate New York. Shuttle service between Albany and Vermont put the company on the map and continues to o ... |
| www.nelson.edu | · Apr 16, 2025 | Data from Nelson University contains thousands of personal employee and students records. All data will be published fully on 24 April 2024. If management of University will not pay ransom .Nelson is a publisher of educational products. They ... |
| govonisabbiatrici | · Apr 16, 2025 | Company designs and manufactures machines and systems of sandblasting, as well as dust extraction systems, Sorting and conveying devices for metal abrasives and silica sands, partial and total recovery devices for large cabins and soundproofi ... |
| a-1freeman | · Apr 15, 2025 | A company is only as strong as its roots, and A-1 Freeman Moving Group's roots are firmly planted in a culture of honesty, integrity, and hard work. In 1974, Jim Freeman founded A-1 Freeman Moving Group in Oklahoma City, OK on a belief that h ... |
| www.clubcar.com | · Apr 15, 2025 | Club Car boasts a 60+ year history of industry-leading innovation and design, initially focused on golf cars and then expanding to commercial utility vehicles and personal-use transportation. Every detail of design, fabrication and assembl ... |
| NL Olson & Associates | · Apr 15, 2025 | Company has 24 hours to contact us . N.L. Olson & Associates maintains at all times, $1,000,000 E & O insurance and $1,000,000 general liability insurance. Careful consideration must be given to the selection of a firm to perform design an ... |
| FEELFOUR | · Apr 13, 2025 | FeelFour ===================Pwn3d========================== By Qilin & Devman ================================================= Feel Four S.L is an online fashion and footwear retailer offering a wide variety of products for men, women, ... |
| MS SUPPLY CHAIN SOLUTIONS (MALAYSIA) SDN. BHD | · Apr 12, 2025 | All data will be published online on Apr.20. MS Supply Chain Solutions (Malaysia) Sdn Bhd – (MSCSM) is Subsidiary of MITSUI-SOKO Supply Chain Solutions, Inc. This company provides integrated high quality logistics services such as factory ... |
| Mapaex | · Apr 12, 2025 | All data will be published online on Apr.20. Mapaex, now in its third generation of a family-owned business, comprising independent centres for excellence specialising in oral care, consumer products, health solutions, vitamins and supplement ... |
| Algas Engineering Pte Ltd - Algas Engineering | · Apr 10, 2025 | Algas Engineering Algas Engineering Pte Ltd is a gas pipe contractor, established in early 2007, with the core capability of dealing with gas pipe installation for both new and alteration & addition (A&A) of residential and commercial develo ... |
| sk.com | · Apr 10, 2025 | Over 1 TB of files downloaded from their servers . Company has 48 hours to contact us before we publish the data . In the U.S., SK is investing in businesses and expanding our local operations in electric vehicle batteries, life sciences, tec ... |
| SPEEDFAM | · Apr 9, 2025 | SFIN is a company established in Joint Venture techno-commercial collaboration with Speedfam Co. Ltd., Japan who is a world leader in Flat Surface Lapping and Polishing equipment manufacturing. Speedfam India started manufacturing in Techno-c ... |
| Blink Photo | · Apr 9, 2025 | Blink Photo Content is a passionate group of creative thinkers and content creators, specializing in Photography, CGI, Video, Design, and Digital services in the UK and China. They excel in solving commercial and strategic challenges for vari ... |
| North Platte Natural Resources District | · Apr 9, 2025 | The North Platte Natural Resources District is committed to protecting Nebraska's natural resources, focusing on water quality, forestry, soil management, and conservation practices. Serving the local community, they provide resources and pro ... |
| Galvatech | · Apr 9, 2025 | Galvatech is a family-owned business that has been servicing the steel industry in Sydney Central West for 40 years, specializing in hot dip galvanizing to the AS/NZS 4680:2006 standard. Known for its efficiency and reliability, the company o ... |
| Helitek Company Ltd. | · Apr 9, 2025 | Helitek Company Ltd. manufactures silicon wafers. The Company's products include prime wafers, single and double side polished wafers, test wafers, silicon ingots, dopants, and backside treatments. Helitek sells its products in the United Sta ... |
| Bangkok Electronics Co., Ltd | · Apr 9, 2025 | Bangkok Electronics Co., Ltd ========================Pwn3d=================================== By Qilin & Devman ================================================================ p.s sorry guys did not count the number of files allot of them.. ... |
| Dinaksa Pesaje | · Apr 9, 2025 | Dinaksa pesaje offers a rental service of different weighing equipment at the disposal. Its' customers require having a high number of machines to facilitate the process in certain moments such as inventories. Dinaksa pesaje has a wide range ... |
| Sasszemklinika | · Apr 9, 2025 | Laser eye surgery at the country's largest clinic with 110,000 Eagle Eye Treatments. Eagle Eye Clinic. Medical Guarantee, installment payments. The company didn't enter to the chat room. |
| MHT Partners | · Apr 9, 2025 | MHT Partners is a leading national middle market investment bank focused on representing industry leaders in growth markets. The team at MHT Partners assists clients with seller advisory, acquisition advisory, corporate finance and strategic ... |
| www.gchd.org | · Apr 8, 2025 | — |
| averasia | · Apr 8, 2025 | — |
| American Air Conditioning & Heating | · Apr 7, 2025 | — |
| Dhoot Transmission | · Apr 7, 2025 | — |
| Privat-Spitex Schweiz GmbH | · Apr 7, 2025 | — |
| Cambridge Fluid Systems | · Apr 7, 2025 | — |
| The Komec | · Apr 7, 2025 | — |
| Spring Creek Golf & Country Club | · Apr 7, 2025 | — |
| JKC Australia LNG | · Apr 7, 2025 | — |
| St Edmund's College | · Apr 7, 2025 | — |
| Hewsco.com | · Apr 7, 2025 | — |
| Wertex Group | · Apr 7, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .