qilin
ransomware group · aka Qilin, Agenda, Water Galura (Microsoft designation) · Unknown; vendors believe the operation is Russian-speaking, though this is unconfirmed · active since Mid-2022 (initially tracked as Agenda; the Qilin branding emerged in 2023)
Victims · 7d
30▲18 vs prev. week
Victims · 30d
114active targets
Victims · 90d
364
All-time (tracked)
2.3Ksince 2022-10-08
Last post
09-18 13:53UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Qilin is a ransomware-as-a-service and data-extortion group first observed in mid-2022 and initially tracked as Agenda, with the Qilin name appearing in 2023. It operates a double-extortion model, encrypting systems and publishing stolen data from non-paying victims, and targets organizations across a broad range of sectors and geographies, including critical infrastructure. Publicly reported incidents include optical manufacturer Hoya (2023), Toyota Financial Services (2023), Nissan's Australian dealer association via a third-party compromise (2023), US newspaper publisher Lee Enterprises (2025), and a 2023 supply-chain intrusion through a Yamaha motorcycle dealer affecting Philippine customers. The group has exploited vulnerable public-facing software such as Zimbra and Cisco IOS XE, and uses both Windows and Linux/ESXi encryptors. Vendor tracking consistently ranked Qilin among the most active ransomware brands through 2024-2025, and it remains active as of late 2025.
Tactics & tooling
- RaaS affiliate operation with double extortion; victim data posted to a leak site if no ransom is paid
- Initial access via stolen VPN/RDP credentials, frequently in environments lacking MFA, per incident reporting
- Exploitation of unpatched public-facing services, including Zimbra and Cisco IOS XE
- BYOVD technique using vulnerable drivers to disable or evade security tooling, per Sophos incident analysis
- Metasploit/Meterpreter stager (TinyMet) used for tool delivery and privilege escalation
- Go- and later Rust-based Windows encryptors, with separate Linux/ESXi builds used in some attacks
- Supply-chain access through compromised service providers, dealers, or third-party platforms
- Published affiliate rules and 'legal agreements' governing affiliate conduct, per 2024-2025 reporting
Targeted sectors
manufacturingautomotivefinancial servicesIT serviceslegalmedia and publishinghealthcareeducation
Notable public victims
Hoya Corporation (2023), Toyota Financial Services (2023), Nissan Dealer Association Australia (2023, via third-party compromise), Yamaha Motor Philippines customers (2023, via dealer supply-chain intrusion), Synoptek (2025), Lee Enterprises (2025), Philippine Ports Authority, Jouvet SAS, G&S Technologies, Colonial Hyundai
Estimated earnings
No public figure.
Leak-site victims2,262 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| KH OneStop | · Mar 9, 2025 | — |
| www.cdg.us | · Mar 7, 2025 | — |
| Ministry of Foreign Affairs of Ukraine | · Mar 6, 2025 | — |
| Chicago Doorways, LLC | · Mar 5, 2025 | — |
| PFS Grupo - Plan de igualdad, Sostenibilidad | · Mar 4, 2025 | — |
| rockhillwc.com | · Mar 4, 2025 | — |
| bpmmicro.com | · Mar 4, 2025 | — |
| peruzzi.com | · Mar 4, 2025 | — |
| Utsunomiya Central Clinic | · Mar 4, 2025 | — |
| Ministry of Health of Palau | · Feb 28, 2025 | — |
| ctpomd | · Feb 28, 2025 | — |
| Houston Symphony | · Feb 28, 2025 | — |
| Lee Enterprises | · Feb 27, 2025 | — |
| Soco systems | · Feb 27, 2025 | — |
| Sound Ideas | · Feb 26, 2025 | — |
| Surface 678 | · Feb 26, 2025 | — |
| Metro Supply Chain Group. | · Feb 24, 2025 | — |
| l.warsemann.fr | · Feb 21, 2025 | — |
| Crossroads Trading Company, Inc | · Feb 21, 2025 | — |
| palauhealth | · Feb 20, 2025 | — |
| Andover Family Medicine | · Feb 20, 2025 | — |
| Access2Jobs | · Feb 20, 2025 | — |
| DBK | · Feb 19, 2025 | — |
| traffic-advertising-llc | · Feb 19, 2025 | — |
| dr-elizabeth-bjornson | · Feb 19, 2025 | — |
| lake-washington-vascular | · Feb 19, 2025 | — |
| Bulverde Glass, Inc. | · Feb 17, 2025 | — |
| Bethany Lutheran Church | · Feb 14, 2025 | — |
| F.TECH R&D NORTH AMERICA INC. | · Feb 14, 2025 | — |
| vadatech.com | · Feb 13, 2025 | — |
| tomsmithindustries.com | · Feb 12, 2025 | — |
| Erie Management Group, LLC | · Feb 12, 2025 | — |
| TJKM | · Feb 12, 2025 | — |
| Quality Home Health Care | · Feb 12, 2025 | — |
| Spectrum Solutions | · Feb 9, 2025 | — |
| HARADA | · Feb 7, 2025 | — |
| nldappraisals.com | · Feb 7, 2025 | — |
| renmarkfinancial.com | · Feb 7, 2025 | — |
| McCORMICK TAYLOR | · Feb 5, 2025 | — |
| rablighting.com | · Feb 5, 2025 | — |
| kksp.com | · Feb 4, 2025 | — |
| Denton Regional Suicide Prevention Coalition | · Feb 3, 2025 | — |
| GOVirtual-it.com ( VIRTUAL IT ) | · Feb 3, 2025 | — |
| Alford Walden Law | · Feb 3, 2025 | — |
| Pasco Systems | · Feb 3, 2025 | — |
| MPP Group of Companies | · Feb 3, 2025 | — |
| Elslaw.com ( EARLY , LUCARELLI , SWEENEY & MEISENKOTHEN LAW ) | · Feb 3, 2025 | — |
| DRI Title & Escrow | · Feb 3, 2025 | — |
| DPA Auctions | · Feb 3, 2025 | — |
| Altair Travel | · Feb 3, 2025 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .