Krebs identifies a St. Petersburg man as Qilin ransomware admin
Leaked records and forum pivots name 36-year-old Aleksey Yakovtsev; Qilin claims 365 victims in three months.
Stories per day · 30 days
4 RSS
Relatedransomware12pan-os7globalprotect6palo-alto4authentication-bypass3extortion3kev3inc-ransomware2mfa-bypass2prisma-access2rapid72active-directory1akira1apt1attribution1badcandy1cve-2026-02571ddos1
49 stories, newest first · one card per story
Stories tagged #qilin
Kaspersky: Qilin led Q3 2026 ransomware leak-site victims
Opted-in detections blocked over 311 million online attacks, while 81,556 users encountered ransomware and 4,470 new variants appeared.
Qilin Ransomware Admin Haise Allegedly Unmasked
Dark web reports claim to have unmasked Qilin ransomware administrator Haise.
15 min readqilin
1
Talos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
2
Unit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
1
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
4
Nord Security counts 2,894 ransomware attacks in third quarter
The July–September total is up 50% year over year and 8.6% from the prior quarter, led by The Gentlemen and Qilin.
1
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
2
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
2
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
2
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
1
Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
7
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
9
Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families
Semperis says 37% of successful ransomware attacks included threats against employees’ friends or relatives.
4
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability
Qilin and Settra ransomware gangs actively exploit Palo Alto GlobalProtect auth bypass CVE-2026-0257 to hijack VPN sessions and breach networks.
11
Security Affairs newsletter Round 599 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs round 599 collects weekly headlines on breaches, arrests, ransomware, and exploited flaws.
9
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Qilin and Settra are exploiting Palo Alto GlobalProtect CVE-2026-0257 for unauthorized VPN access.
10
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention
Germany arrested a suspected Qilin leader extradited from Japan, while the gang kept listing new victims.
4
Germany arrests alleged core Qilin ransomware member after extradition
Germany arrested an alleged core Qilin ransomware member, a Russian national extradited from Japan, over a ransomware attack in Germany.
4
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.
11