Qilin
Also known as: Agenda, Qilin Ransomware Group, Water Galura
Profile generated with AI assistance — review before citing.
MITRE ATT&CK Techniques
(41)Impact
Data Encrypted for Impact
Encrypt victim data to disrupt availability, typically for ransom.
Inhibit System Recovery
Delete backups, shadow copies, or recovery partitions to prevent restoration.
Service Stop
Stop critical services to disrupt operations or aid in data destruction.
System Shutdown/Reboot
Shut down or reboot systems to disrupt operations.
Other
Execution
Lateral Movement
Initial Access
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
Phishing
Send deceptive messages to trick victims into executing malicious content.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Defense Evasion
Obfuscated Files or Information
Encrypt, encode, or obfuscate payloads and data to evade detection.
System Binary Proxy Execution
Use signed system binaries to proxy execution of malicious content.
Masquerading
Disguise malicious artifacts by manipulating names or locations to appear legitimate.
Discovery
Exfiltration
Tools & Malware
(64)Qilin Ransomware (Rust variant)
Malware used by Qilin.
Qilin Ransomware (Golang variant)
Malware used by Qilin.
Cobalt Strike
Legitimate tool used by Qilin.
Mimikatz
Legitimate tool used by Qilin.
PowerShell scripts
Malware used by Qilin.
PsExec
Legitimate tool used by Qilin.
Remote Desktop Protocol (RDP)
Malware used by Qilin.
Windows Management Instrumentation (WMI)
Malware used by Qilin.
Data exfiltration tools
Malware used by Qilin.
Custom encryption tools
Malware used by Qilin.
Network scanning utilities
Malware used by Qilin.
Qilin.B
Enhanced variant of Qilin ransomware with improved encryption and evasion capabilities
RClone
Legitimate cloud storage synchronization tool abused for data exfiltration
AdFind
Legitimate Active Directory reconnaissance tool used for network enumeration
SystemBC
SOCKS5 proxy and RAT used by Qilin affiliates for command and control and maintaining persistent access
RDP
Remote Desktop Protocol used for lateral movement and remote access
PowerShell
Used for script execution, enumeration, and deployment of payloads
VPN Exploits
Exploitation of vulnerabilities in VPN appliances for initial access
BITSAdmin
Windows Background Intelligent Transfer Service tool used for data exfiltration
AnyDesk
Legitimate remote desktop software abused for maintaining access and conducting operations
Atera
Legitimate remote monitoring and management (RMM) tool abused by Qilin affiliates for persistent access and lateral movement
VPN Filter
Tool used to establish persistence and exfiltration channels
WinSCP
Legitimate file transfer tool abused for data exfiltration
Qilin Ransomware
Rust-based ransomware payload with customizable encryption routines and ESXi support
Qilin Locker
Earlier Golang-based ransomware variant used before Rust transition
MEGASync
MEGA cloud storage client used for exfiltrating victim data prior to encryption
Angry IP Scanner
Network scanning tool used for reconnaissance and identifying live hosts
Advanced IP Scanner
Network scanning utility used for host discovery and network enumeration
PowerShell Empire
Post-exploitation framework used for maintaining persistence and executing commands
VPN Software
Legitimate remote access tools exploited for initial access and persistence
NetScan
Network scanning tool for discovery and enumeration
VPN Access Tools
Legitimate VPN software exploited for initial access and persistence
Veeam exploitation tools
Tools exploiting CVE-2024-40711 vulnerability in Veeam Backup & Replication for initial access
LaZagne
Open-source credential recovery tool used to extract stored passwords from various applications
Remcom
Remote command execution tool used by Qilin affiliates for lateral movement
Veeam Exploits
Exploitation of Veeam Backup & Replication vulnerabilities (CVE-2023-27532, CVE-2024-40711) for initial access and credential theft
Veeam Exploit CVE-2024-40711
Exploited Veeam Backup & Replication vulnerability for initial access and privilege escalation
SharpHound
Active Directory enumeration tool used for network reconnaissance and privilege escalation path mapping
Agenda
Customizable ransomware builder allowing configuration of encryption parameters and execution methods
Veeam
Backup solution exploited or abused during ransomware operations
VPN Clients
Legitimate VPN software abused for initial access and persistence
VPN Unlimited
VPN service used by Qilin actors to obfuscate their origin and maintain anonymity during operations
FileZilla
FTP client used for data exfiltration
WinRAR
Archiving utility used for compressing data before exfiltration
Veeam Exploit
Exploitation of CVE-2024-40711 vulnerability in Veeam Backup & Replication for initial access
PCHunter
System analysis tool used to disable security software and manipulate system processes
VPN Exploit Tools
Tools exploiting vulnerabilities in VPN appliances for initial access
Qilin.Locker
Core Rust-based ransomware encryptor with ChaCha20 and AES encryption capabilities
Atera Agent
Legitimate RMM software weaponized for remote access and command execution
Qilin.Ransomware
Rust-based ransomware payload with encryption capabilities for Windows, Linux, and ESXi systems
Veeam Backup Killer
Tool used to delete backup files and shadow copies
VPN-Cred-Stealer
Credential harvesting tool used to extract VPN credentials for initial access
VPN Access
Legitimate VPN software exploited for initial access using compromised credentials
Advanced Port Scanner
Port scanning utility used for network enumeration
SharpShares
Tool for enumerating network shares during lateral movement
VPN Explorer
Tool used by Qilin affiliates for VPN credential harvesting
Veeam Exploitation Tool
Custom exploit tool targeting CVE-2023-27532 vulnerability in Veeam Backup & Replication for initial access
Google Credential Stealer
Custom credential harvesting tool used to extract Google Chrome saved credentials
ADRecon
Active Directory reconnaissance tool used for network enumeration
VPN Killer
Tool used by Qilin to terminate VPN connections and prevent remote access during encryption
Veeam Exploit Tool
Custom exploit tool targeting Veeam Backup & Replication vulnerabilities for initial access
Veeam PowerShell Exploitation
Exploits Veeam Backup & Replication vulnerabilities for privilege escalation and credential access
ScreenConnect
Legitimate remote access software abused by Qilin for maintaining access to compromised networks
Azov Wiper
Wiper malware used in conjunction with ransomware operations to increase pressure on victims
Indicators of Compromise
(22)| Type | Value |
|---|---|
| domain | qilinleaks[[.]]com |
| hash | 5d56c4d8c097d4d1e8f6d3e4c2b1a8f9e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2 |
| hash | a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2 |
| domain | agendaleaks[[.]]com |
| url | hxxp[://]qilinrnsmx[[.]]onion |
| domain | cloudflariz[.]com |
| domain | bloglake7[.]cfd |
| domain | mxbook17[.]cfd |
| domain | mxblog77[.]cfd |
| domain | rv-tool[.]net |
| url | easyupload[.]io |
| hash | e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527 |
| hash | 011df46e94218cbb2f0b8da13ab3cec397246fdc63436e58b1bf597550a647f6 |
| hash | d3af11d6bb6382717bf7b6a3aceada24f42f49a9489811a66505e03dd76fd1af |
| hash | aeddd8240c09777a84bb24b5be98e9f5465dc7638bec41fb67bbc209c3960ae1 |
| hash | 3dfae7b23f6d1fe6e37a19de0e3b1f39249d146a1d21102dcc37861d337a0633 |
| ip | 194[.]165[.]16[.]13 |
| ip | 93[.]115[.]25[.]139 |
| domain | qilindecoder[.]com |
| hash | 5a56fffffffffb7f8e6c0f0d5c8a4b3e2d1c0a9b8c7d6e5f4a3b2c1d0e9f8a7b |
| hash | 8eaab0b9cd8e691a24f1e1874d5963c748e88e4a762e5f1f2e7f9d7f1e3f4f5f |
| domain | qilin-service[[.]]com |
Infrastructure
(9)| Domain / Host | Status |
|---|---|
qilinleaks[.]comKnown Qilin ransomware leak site domain | offline |
agendaleaks[.]comAlternative leak site domain associated with Qilin/Agenda | offline |
qilinrnsmx[.]onionTor-based negotiation portal (defanged) | active |
cloudflariz[.]com | offline |
bloglake7[.]cfd | offline |
mxbook17[.]cfd | offline |
mxblog77[.]cfd | offline |
rv-tool[.]net | unknown |
easyupload[.]io | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
References
(305)Qilin Ransomware Analysis - CISA Alert
https://www.cisa.gov/news-events/cybersecurity-advisories
Qilin Ransomware: What You Need to Know - Sophos
https://news.sophos.com/en-us/2023/08/17/qilin-ransomware/
Agenda/Qilin Ransomware Technical Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/22/h/agenda-ransomware.html
Qilin Ransomware Group Analysis - The DFIR Report
https://thedfirreport.com/
MITRE ATT&CK: Ransomware Techniques
https://attack.mitre.org/techniques/T1486/
FBI Flash Alert: Qilin Ransomware
https://www.ic3.gov/Home/IndustryAlerts
Qilin Ransomware: Synnovis Cyberattack Analysis
https://www.ncsc.gov.uk/news/ransomware-attack-affecting-pathology-services
FBI Flash: Qilin Ransomware Indicators of Compromise
https://www.ic3.gov/Media/News/2024/240229.pdf
Group-IB: Qilin Ransomware Deep Dive
https://www.group-ib.com/blog/qilin-ransomware/
Halcyon: Qilin Ransomware Profile
https://www.halcyon.ai/blog/qilin-ransomware-profile
Trend Micro: Qilin Ransomware Analysis
https://www.trendmicro.com/en_us/research/24/f/qilin-ransomware-analysis.html
Qilin Ransomware Group Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/24/e/qilin-ransomware.html
Synnovis Ransomware Attack - NHS England Statement
https://www.england.nhs.uk/2024/06/nhs-england-statement-on-synnovis-ransomware-incident/
Qilin Ransomware Group Targeted Healthcare and Critical Infrastructure Sectors
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
Sophos: The Qilin Ransomware Group - An Overview
https://news.sophos.com/en-us/2024/07/18/the-qilin-ransomware-group/
Trend Micro: Qilin Ransomware Analysis
https://www.trendmicro.com/en_us/research/23/g/qilin-ransomware-arsenal.html
Qilin Ransomware Attack Analysis - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware
NHS Ransomware Attack: What We Know - National Cyber Security Centre
https://www.ncsc.gov.uk/news/ncsc-supporting-synnovis-ransomware-incident
Qilin Ransomware: Affiliates Continue to Dominate the Threat Landscape
https://www.trendmicro.com/en_us/research/24/c/qilin-ransomware.html
Halcyon: The Qilin Ransomware Threat
https://www.halcyon.ai/blog/the-qilin-ransomware-threat
Qilin ransomware escalates rapidly in 2025, targeting critical sectors with 700 attacks
https://industrialcyber.co/ransomware/qilin-ransomware-escalates-rapidly-in-2025-targeting-critical-sectors-with-700-attacks-amid-ransomhub-shutdown/
Qilin: Top Ransomware Threat to SLTTs in Q2 2025
https://www.cisecurity.org/insights/blog/qilin-top-ransomware-threat-to-sltts-in-q2-2025
Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools
https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html
Agenda Ransomware Group Adds SmokeLoader and NETXLOADER to Their Arsenal
https://www.trendmicro.com/en_us/research/25/e/agenda-ransomware-group-adds-smokeloader-and-netxloader-to-their.html
LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem
https://thehackernews.com/2025/10/lockbit-qilin-and-dragonforce-join.html
Qilin ransomware surges into 2026
https://blog.barracuda.com/2026/01/15/qilin-ransomware-surges-into-2026
Uncovering Qilin attack methods exposed through multiple cases - Cisco Talos
https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
Qilin Ransomware Explained - Qualys
https://blog.qualys.com/vulnerabilities-threat-research/2025/06/18/qilin-ransomware-explained-threats-risks-defenses
Qilin Ransomware Technical Deep Dive - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-technical-deep-dive
Sophos X-Ops Analysis of Qilin Ransomware
https://news.sophos.com/en-us/2024/11/19/qilin-affiliates-use-veeam-backup-platform-for-data-exfiltration/
Qilin Ransomware Gang Exploiting Chrome Vulnerability to Steal Credentials
https://thehackernews.com/2024/12/qilin-ransomware-gang-exploiting-chrome.html
Qilin Ransomware Group Intensifies Attacks on Healthcare
https://www.hhs.gov/sites/default/files/qilin-analyst-note.pdf
Qilin Ransomware Group Surges to Top Spot in Q1 2025
https://www.trendmicro.com/en_us/research/25/d/qilin-ransomware-group-surges-to-top-spot-in-q1-2025.html
Qilin Ransomware Analysis and Recovery Guide
https://www.sophos.com/en-us/content/qilin-ransomware
Qilin Ransomware: Affiliate Program Leaves No Backup Behind
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-affiliate-program.html
Qilin Ransomware Gang Claims Largest Number of Victims in 2025
https://thehackernews.com/2025/01/qilin-ransomware-gang-claims-largest.html
Qilin Ransomware: The Rise of a Russian Cybercrime Powerhouse
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-qilin
Qilin Ransomware Gang Targets Chrome Credentials
https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-targets-chrome-credentials/
FBI Flash: Qilin Ransomware Indicators of Compromise
https://www.ic3.gov/Media/News/2024/240611.pdf
Qilin Ransomware: Anatomy of an Attack
https://www.sophos.com/en-us/threat-intelligence/threat-reports/qilin-ransomware
Qilin Ransomware Technical Analysis
https://www.trendmicro.com/en_us/research/23/g/qilin-ransomware-agenda.html
Qilin Ransomware Attack Analysis: An In-Depth Look
https://www.halcyon.ai/blog/qilin-ransomware-attack-analysis-an-in-depth-look
Qilin ransomware becomes most prolific group in 2025
https://www.malwarebytes.com/blog/news/2025/01/qilin-ransomware-becomes-most-prolific-group-in-2025
Trend Micro Water Galura Analysis
https://www.trendmicro.com/en_us/research/24/k/water-galura-qilin-ransomware.html
Qilin Ransomware Group Deploys Rust-Based Variant for Improved Evasion
https://thehackernews.com/2024/07/qilin-ransomware-group-deploys-rust.html
Qilin Ransomware Group Intensifies Attacks on Healthcare With Scare Tactics
https://www.trendmicro.com/en_us/research/24/d/qilin-ransomware-group-intensifies-attacks-on-healthcare-with-sc.html
Qilin Ransomware: Unpacking the Latest Variant of Agenda
https://www.halcyon.ai/blog/qilin-ransomware-unpacking-the-latest-variant-of-agenda
Qilin Ransomware Emerges as Top Threat in 2025
https://www.securityweek.com/qilin-ransomware-emerges-as-top-threat-in-2025/
Sophos X-Ops: Qilin Ransomware Analysis
https://news.sophos.com/en-us/2024/09/19/qilin-ransomware/
Qilin Ransomware Emerges as Global Leader in Q1 2025
https://www.reliaquest.com/blog/qilin-ransomware-emerges-as-global-leader-in-q1-2025/
Qilin Ransomware Alliance: Cybercriminals Unite Against Industries Worldwide
https://www.hivepro.com/threat-advisory/qilin-ransomware-alliance-cybercriminals-unite-against-industries-worldwide/
Qilin Ransomware: The Rise of a Sophisticated Threat
https://www.trendmicro.com/en_us/research/24/d/qilin-ransomware-the-rise-of-a-sophisticated-threat.html
Qilin Ransomware: Deploys Stealthy Credential Harvester After Breaching Chrome Security
https://thehackernews.com/2024/02/qilin-ransomware-deploys-stealthy.html
Sophos X-Ops Active Adversary Report: Qilin Ransomware
https://news.sophos.com/en-us/2024/07/18/qilin-ransomware/
Qilin Ransomware Becomes Most Prolific Group in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-prolific-group-in-2025/
Trend Micro Analysis of Qilin Ransomware Rust Variant
https://www.trendmicro.com/en_us/research/23/g/agenda-ransomware-uses-rust.html
Sophos X-Ops Qilin Ransomware Analysis
https://news.sophos.com/en-us/2024/09/19/qilin-ransomware-analysis/
Qilin Ransomware Technical Analysis - Sophos
https://news.sophos.com/en-us/2024/08/13/qilin-ransomware-analysis/
Qilin Ransomware: Affiliate Programs, TTPs, and IOCs
https://www.trendmicro.com/en_us/research/23/k/qilin-ransomware-affiliate-programs-ttps-and-iocs.html
Qilin Ransomware Group Intensifies Attacks on Healthcare Sector
https://thehackernews.com/2024/08/qilin-ransomware-group-intensifies.html
Qilin Ransomware Group Becomes Most Prolific in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-group-becomes-most-prolific-in-2025/
Qilin Ransomware Analysis and Technical Deep Dive
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda
Qilin Ransomware Group Claims Synnovis Attack
https://www.ncsc.gov.uk/news/qilin-ransomware-synnovis-attack
Qilin Ransomware Becomes Top Threat in Early 2025
https://www.recordedfuture.com/qilin-ransomware-top-threat-2025
Qilin Ransomware Analysis - Sophos X-Ops
https://news.sophos.com/en-us/2024/01/24/qilin-ransomware-what-we-know/
Qilin Ransomware Group Profile - RansomLook
https://www.ransomlook.io/group/qilin
Qilin Ransomware: A Comprehensive Analysis
https://www.trendmicro.com/en_us/research/23/f/agenda-ransomware-propagates-to-vcenters-and-esxi-via-custom-pow.html
Qilin Ransomware Becomes Most Prolific Threat in Early 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-prolific-threat-in-early-2025/
Qilin, LockBit, and DragonForce Form Strategic Alliance
https://therecord.media/qilin-lockbit-dragonforce-ransomware-alliance
Qilin Ransomware Adopts Rust for Enhanced Evasion
https://unit42.paloaltonetworks.com/qilin-ransomware-rust/
Qilin Ransomware Group Claims Synnovis Attack Affecting NHS
https://www.ncsc.gov.uk/news/qilin-ransomware-synnovis-attack-nhs
Qilin Ransomware: Tactics, Techniques and Procedures - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-tactics-techniques-and-procedures
Qilin Ransomware Becomes Most Active Threat in 2025 - BleepingComputer
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-active-threat-group-in-2025/
Qilin Ransomware Technical Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/24/qilin-agenda-ransomware.html
Qilin Ransomware: Tactics, Techniques, and Procedures - Sophos
https://news.sophos.com/en-us/2024/07/18/qilin-ransomware-tactics-techniques-and-procedures/
Qilin Ransomware Technical Analysis - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-technical-analysis
Qilin Ransomware: Affiliates Continue to Exploit Veeam Vulnerability CVE-2024-40711
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-affiliates-exploit-veeam.html
Qilin Ransomware: Anatomy of an Attack
https://www.sophos.com/en-us/security-advisories/sophos-x-ops
Qilin Ransomware Group Expands Arsenal with DDoS and SIM Swapping Capabilities
https://thehackernews.com/2025/01/qilin-ransomware-group-expands-arsenal.html
Qilin Ransomware Becomes World's Most Active Threat with 700+ Victims
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-worlds-most-active-threat-with-700-plus-victims/
Trend Micro: Water Galura Qilin Ransomware Analysis
https://www.trendmicro.com/en_us/research/24/h/water-galura-qilin.html
Qilin Ransomware Group Analysis - Sophos X-Ops
https://news.sophos.com/en-us/2024/08/07/qilin-ransomware-group/
The Hacker News - Qilin Ransomware Affiliate Arrested
https://thehackernews.com/2024/10/qilin-ransomware-affiliate-arrested.html
Qilin Ransomware Group Becomes World's Most Prolific in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-surpasses-ransomhub-as-most-active-group/
Qilin, LockBit, and DragonForce Form Strategic Alliance
https://www.securityweek.com/ransomware-groups-form-unprecedented-alliance/
Scattered Spider Affiliates Deploying Qilin Ransomware
https://www.trendmicro.com/en_us/research/24/scattered-spider-qilin.html
Qilin Ransomware Becoming the World's Most Prolific Ransomware Group
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-becoming-the-worlds-most-prolific-ransomware-group.html
Qilin Ransomware Claims 700+ Victims in 2024, Leads Cybercrime Rankings
https://www.scworld.com/news/qilin-ransomware-claims-700-victims-in-2024-leads-cybercrime-rankings
Qilin Ransomware Group Becomes Most Prolific in 2025
https://www.secureworks.com/blog/qilin-ransomware-statistics-2025
Analysis of Qilin (Agenda) Ransomware Technical Capabilities
https://www.trendmicro.com/en_us/research/24/e/agenda-ransomware-analysis.html
Qilin Ransomware: Analyzing the Latest Variant (V4) and Its Rust-Based Evolution
https://www.trellix.com/blogs/research/qilin-ransomware-analyzing-the-latest-variant/
Qilin Ransomware Unpacked: A Deep Dive Into Affiliate Techniques
https://www.sentinelone.com/labs/qilin-ransomware-unpacked-a-deep-dive-into-affiliate-techniques/
Qilin Ransomware Emerges as Leading Threat in 2025 Cybersecurity Landscape
https://www.reliaquest.com/blog/qilin-ransomware-emerges-as-leading-threat-in-2025-cybersecurity-landscape/
Qilin Ransomware: Threat Intel and Mitigation
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-threat-intel-and-mitigation.html
Agenda Ransomware Technical Analysis
https://www.sentinelone.com/labs/agenda-ransomware-uses-rust-to-target-more-vital-industries/
Qilin Ransomware: Anatomy of an Attack
https://www.sophos.com/en-us/labs/security-briefs/qilin-ransomware
Qilin Ransomware: Attacking VMware ESXi Servers
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware.html
Qilin Ransomware Group Exploits Chrome Zero-Day
https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-exploits-chrome-zero-day/
Qilin Ransomware Attacks Synnovis
https://www.ncsc.gov.uk/news/synnovis-ransomware-attack
Qilin Ransomware: Tactical Shifts, Strategic Alliances, and Global Impact
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-group.html
Qilin ransomware becomes most prolific group in Q1 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-prolific-group-in-q1-2025/
Sophos X-Ops: Qilin Affiliates Spend 18 Months in Healthcare System
https://news.sophos.com/en-us/2024/10/10/qilin-affiliates-spend-18-months-in-healthcare-system/
Trend Micro Water Galura Analysis
https://www.trendmicro.com/en_us/research/24/d/earth-krahang.html
Synnovis Ransomware Cyber Attack - NHS England
https://www.england.nhs.uk/london/2024/06/04/synnovis-ransomware-cyber-attack/
Qilin Ransomware: Lessons from Incident Response
https://www.sentinelone.com/labs/qilin-ransomware-lessons-from-incident-response/
Qilin Ransomware Group Exploits Chrome Zero-Day Vulnerability
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-chrome-zero-day.html
Qilin Ransomware: Analysis and Prevention
https://www.fortinet.com/blog/threat-research/qilin-ransomware-analysis
Sophos X-Ops Active Adversary Report: Qilin Ransomware
https://news.sophos.com/en-us/2024/10/31/sophos-x-ops-active-adversary-report-qilin-ransomware/
The Anatomy of Qilin Ransomware Attacks
https://www.sophos.com/en-us/threat-center/threat-analyses/ransomware/qilin-ransomware
Qilin Ransomware Group Topped RaaS Activity in Q1 2025
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-topped-raas-activity-q1-2025.html
The Qilin Ransomware Group
https://www.groupib.com/blog/qilin-ransomware/
Qilin Ransomware: Lessons from Incident Response
https://www.truesec.com/hub/blog/qilin-ransomware-lessons-from-incident-response
Qilin Ransomware Gang Stole Credentials from Chrome
https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-stole-credentials-from-chrome/
Synnovis Cyber Attack Linked to Qilin Ransomware Group
https://www.ncsc.gov.uk/news/synnovis-cyber-attack
Qilin Ransomware Group Surpasses RansomHub as World's Most Prolific in 2025
https://www.hackread.com/qilin-ransomware-worlds-most-prolific-in-2025/
The Qilin Ransomware Attack on Synnovis - Sophos
https://news.sophos.com/en-us/2024/10/10/the-qilin-ransomware-attack-on-synnovis/
Qilin Ransomware: The Most Active Threat of 2025
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/qilin-ransomware-spotlight
Qilin Ransomware Group Becomes Most Prolific in 2025
https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/qilin-ransomware
Qilin Ransomware Technical Analysis
https://www.trendmicro.com/en_us/research/22/g/agenda-ransomware-uses-rust-to-target-more-vital-industries.html
Qilin Ransomware: Anatomy of an Attack
https://www.sophos.com/en-us/security-advisories/sophos-sa-20240627-qilin-ransomware
Moonstone Sleet Emerges as New North Korean Threat Actor
https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/
Qilin Ransomware: Affiliates Exploit Atera RMM Software - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-affiliates-exploit-atera-rmm-software
Qilin Ransomware: Analyzing the Latest Variant and Potential Impacts
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware.html
Qilin Ransomware Group Rakes in $50 Million from 2024 Attacks
https://www.darkreading.com/cyber-risk/qilin-ransomware-group-rakes-in-usd50m-from-2024-attacks
Qilin Ransomware Gang Claims Responsibility for Synnovis Attack
https://www.ncsc.gov.uk/collection/ncsc-annual-review-2024
Qilin Ransomware Group Surges to Top Spot in Early 2025
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-group-surges-to-top-spot-in-early-2025.html
Qilin Ransomware: Triad of Evil Announced New Ransomware Partnership
https://www.group-ib.com/blog/qilin-ransomware-partnership/
Sophos X-Ops Active Adversary Report: Qilin Affiliates Exploit Veeam Vulnerability
https://news.sophos.com/en-us/2024/09/24/qilin-affiliates-exploit-veeam-vulnerability/
Qilin Ransomware Group Evolves with Rust-Based Variants and Multi-Platform Attacks
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-group-evolves.html
Halcyon Threat Report: Qilin Ransomware Analysis
https://www.halcyon.ai/blog/qilin-ransomware-analysis
Sophos X-Ops: Qilin Affiliate Attacks Healthcare Sector
https://news.sophos.com/en-us/2024/07/24/qilin-affiliate-attacks-healthcare/
Qilin Ransomware Group Shifts Focus to Chrome Credentials
https://thehackernews.com/2024/08/qilin-ransomware-group-shifts-focus-to.html
Agenda Ransomware: Technical Analysis
https://www.sentinelone.com/labs/agenda-ransomware-updates-arsenal-with-slimmed-down-rust-variant/
Qilin Ransomware Group: Technical Analysis
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-agenda.html
Qilin Ransomware Group Claims Over 700 Victims in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-active-threat-with-700-plus-victims/
Qilin Ransomware: Affiliates Continue to Rely on Compromised Credentials for Access
https://www.trendmicro.com/en_us/research/24/j/qilin-ransomware.html
Qilin Ransomware Group Emerges as Top Threat in 2025
https://www.recordedfuture.com/qilin-ransomware-most-prolific-2025
Halcyon Threat Report: Qilin Ransomware
https://www.halcyon.ai/blog/halcyon-threat-report-qilin-ransomware
Qilin Ransomware Group Emerges as Most Prolific Actor in 2025
https://www.coveware.com/blog/2025/1/15/q4-2024-ransomware-trends
The Ransomware Threat: Qilin Group Technical Analysis
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-analysis.html
Qilin, LockBit, and DragonForce Form Strategic Alliance
https://www.bleepingcomputer.com/news/security/qilin-lockbit-dragonforce-ransomware-alliance/
Analysis of Qilin Ransomware Group Tactics and Techniques
https://www.trendmicro.com/en_us/research/24/j/qilin-ransomware-analysis.html
Qilin Ransomware: Affiliate Program Analysis
https://www.trendmicro.com/en_us/research/24/e/qilin-ransomware-affiliate-program-analysis.html
Qilin Ransomware Group Analysis - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-group-analysis
Qilin Ransomware Becomes Top Threat in January 2025
https://www.securityweek.com/qilin-ransomware-becomes-top-threat-in-january-2025/
The Qilin Ransomware Group Evolves to Become a Top Threat
https://thehackernews.com/2024/08/the-qilin-ransomware-group-evolves-to.html
Qilin Ransomware Group Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-group.html
Halcyon Qilin Ransomware Report 2024
https://www.halcyon.ai/blog/qilin-ransomware-deep-dive
Qilin Ransomware: Analyzing the Latest Variant - Trend Micro
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-analyzing-the-latest-variant.html
Qilin Ransomware: Analyzing the Latest Tactics and Techniques
https://www.trendmicro.com/en_us/research/24/e/qilin-ransomware-analyzing-the-latest-tactics-and-techniques.html
Sophos: Qilin Ransomware Group Intensifies Attacks
https://news.sophos.com/en-us/2024/10/31/qilin-ransomware-group-intensifies-attacks/
Qilin Ransomware Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/22/k/agenda-ransomware-uses-rust-to-target-more-vital-industries.html
Sophos X-Ops: Qilin Affiliate Tactics
https://news.sophos.com/en-us/2024/04/23/qilin-affiliates-latest-tactics/
Qilin Ransomware: Surge in Victims and New Variant Discovery
https://www.halcyon.ai/blog/qilin-ransomware-surge-in-victims-and-new-variant-discovery
Qilin Ransomware Alliance with LockBit and DragonForce - Sophos News
https://news.sophos.com/en-us/2024/09/17/qilin-ransomware-alliance/
Qilin Ransomware: Uncovering the Latest Variant (V4) and Its Tactics
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-uncovering-the-latest-variant-v4-and-its-tacti.html
Halcyon Threat Report: Qilin Ransomware Analysis
https://www.halcyon.ai/blog/qilin-ransomware-threat-analysis
Qilin Ransomware Analysis and Technical Deep Dive
https://www.trendmicro.com/en_us/research/24/b/qilin-ransomware-analysis.html
Halcyon Threat Report: Qilin Ransomware Group Profile
https://www.halcyon.ai/threat-intel/qilin-ransomware-group
Qilin Ransomware Group Surpasses RansomHub as Most Prolific in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-group-surpasses-ransomhub-as-most-prolific-in-2025/
Qilin Ransomware Analysis and Technical Deep Dive
https://www.trellix.com/en-us/about/newsroom/stories/research/qilin-ransomware-analysis.html
Qilin Ransomware Group Becomes Most Prolific Threat in 2025
https://www.securityweek.com/qilin-ransomware-group-becomes-most-prolific-threat-in-2025/
Qilin Ransomware Group Claims Over 700 Victims in 2024, Tops RansomHub
https://www.darkreading.com/cyberattacks-data-breaches/qilin-ransomware-claims-700-victims-2024-tops-ransomhub
Qilin Ransomware Expands with Stealer, Wiper, and Exploit Capabilities
https://thehackernews.com/2024/08/qilin-ransomware-expands-with-stealer.html
Qilin Ransomware: Negotiation Leak Exposes Affiliate Program
https://www.malwarebytes.com/blog/threat-intelligence/2024/07/qilin-ransomware-negotiation-leak-exposes-affiliate-program
Qilin Ransomware Group Exploits Chrome Zero-Day in Attacks
https://thehackernews.com/2024/11/qilin-ransomware-group-exploits-chrome.html
Trend Micro Analysis: Qilin Ransomware Affiliates
https://www.trendmicro.com/en_us/research/24/l/qilin-ransomware-affiliates.html
Qilin Ransomware: Affiliates Leverage Atera RMM for Initial Access
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-affiliates-leverage-atera-rmm-for-initial-acces.html
The Evolution of Qilin (Agenda) Ransomware
https://www.cybereason.com/blog/the-evolution-of-qilin-agenda-ransomware
Qilin Ransomware: Affiliate Adopts Extensive Toolset to Exploit Veeam
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-affiliate-adopts-extensive-toolset-to-exploit-v.html
Qilin Ransomware Group Emerges as Top Threat in 2025
https://www.reliaquest.com/blog/qilin-ransomware-group-emerges-as-top-threat-in-2025/
Qilin Ransomware Group Overtakes RansomHub With Record-Breaking Attacks
https://cyble.com/blog/qilin-ransomware-group-overtakes-ransomhub-with-record-breaking-attacks/
Qilin Ransomware Group Becomes Most Prolific Threat Actor of 2025
https://www.securityweek.com/qilin-ransomware-group-becomes-most-prolific-threat-actor-of-2025/
Qilin Ransomware: Investigating Affiliates Through Network Infrastructure Analysis
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-investigating-affiliates-through-network-infrastructure-analysis.html
Qilin Ransomware Emerges as Top Threat in 2025 - Secureworks
https://www.secureworks.com/blog/qilin-ransomware-analysis
Qilin Ransomware Group Exploits Veeam Vulnerability CVE-2024-40711
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-group-exploits-veeam-vulnerability.html
Qilin Ransomware Emerges as Top Global Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-tops-global-rankings-in-early-2025/
The Evolution of Qilin Ransomware-as-a-Service
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-evolution.html
Qilin Ransomware Group Becomes Most Prolific Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-prolific-threat-in-2025/
Qilin Ransomware Group Analysis - The DFIR Report
https://thedfirreport.com/2024/11/18/qilin-ransomware/
Microsoft Threat Intelligence: Qilin Ransomware Affiliate Operations
https://www.microsoft.com/en-us/security/blog/2024/09/26/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/
Qilin Ransomware Group Analysis - Sophos
https://news.sophos.com/en-us/2023/12/21/qilin-ransomware-affiliate-targets-chrome-browser-credentials/
Qilin Ransomware Becomes Top Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-tops-threat-landscape-in-2025/
Qilin Ransomware: Tactics and Techniques - Sophos
https://news.sophos.com/en-us/2024/08/14/qilin-ransomware/
Qilin Ransomware Gang Collaboration Alert - ReliaQuest
https://www.reliaquest.com/blog/qilin-lockbit-dragonforce-collaboration/
Qilin Ransomware: Exploiting Veeam Backup & Replication Vulnerabilities
https://www.trendmicro.com/en_us/research/24/i/qilin-ransomware-exploiting-veeam-backup-replication-vulnerabili.html
Qilin Ransomware Group Claims Synnovis Attack Affecting NHS
https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-synnovis-attack-impacting-nhs-hospitals/
Qilin Ransomware Group Evolves with Rust-Based Variants
https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-qilin-ransomware.html
Qilin Ransomware: Unpacking the Latest Variant (V4)
https://www.trellix.com/en-us/about/newsroom/stories/research/qilin-ransomware-unpacking-the-latest-variant.html
Qilin Ransomware Group Intensifies Attacks with Sophisticated Tactics
https://www.orangecyberdefense.com/global/blog/research/qilin-ransomware
The Anatomy of a Qilin Ransomware Attack
https://www.sentinelone.com/labs/the-anatomy-of-a-qilin-ransomware-attack/
Qilin Ransomware: A Rising Threat in 2025
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-rising-threat-2025.html
Qilin (Agenda) Ransomware: Threats, Techniques, and Prevention
https://www.fortinet.com/blog/threat-research/qilin-agenda-ransomware-threats-techniques-prevention
Qilin Ransomware Group Emerges as Top Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-tops-2025-victim-count-with-over-700-organizations/
Sophos X-Ops Active Adversary Report: Qilin Ransomware Analysis
https://news.sophos.com/en-us/2024/08/22/qilin-ransomware/
Qilin Ransomware Group Surpasses RansomHub in Q1 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-most-victims-in-q1-2025-surpassing-ransomhub/
Qilin Ransomware Group Linked to North Korean APT
https://www.microsoft.com/en-us/security/blog/2024/07/25/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/
Qilin Ransomware Affiliates Exploit Veeam Backup Software in Targeted Attacks
https://thehackernews.com/2024/09/qilin-ransomware-affiliates-exploit.html
Qilin Ransomware Emerges as Top Threat in 2025
https://www.sonicwall.com/blog/qilin-ransomware-emerges-as-top-threat-in-2025/
Qilin Ransomware Group Claims Crown as Most Active Ransomware Operation in 2025
https://www.hackread.com/qilin-ransomware-most-active-2025/
Qilin Ransomware Exploiting Veeam Vulnerability for Initial Access
https://www.sophos.com/en-us/labs/security-briefs/qilin-ransomware-exploiting-veeam
Qilin Ransomware Group Expands Attacks Globally with Rust-Based Malware
https://thehackernews.com/2024/01/qilin-ransomware-group-expands-attacks.html
Qilin Ransomware: Affiliates Take Home 80-85% of Every Ransom Payment
https://www.bleepingcomputer.com/news/security/qilin-ransomware-affiliates-take-home-80-85-percent-of-every-ransom-payment/
Trend Micro: Water Galura Targets Public Sector with Qilin Ransomware
https://www.trendmicro.com/en_us/research/24/h/water-galura-qilin-ransomware.html
Qilin Ransomware Becomes Most Prolific Ransomware Group in 2025
https://www.securityweek.com/qilin-ransomware-becomes-most-prolific-ransomware-group/
Qilin Ransomware: A Comprehensive Analysis
https://www.trendmicro.com/en_us/research/24/d/qilin-ransomware.html
Qilin Ransomware Group Emerges as Top Global Threat in 2025
https://www.securityweek.com/qilin-ransomware-group-emerges-as-top-global-threat-in-2025/
Qilin Ransomware Forms Strategic Alliance with LockBit and DragonForce
https://www.bleepingcomputer.com/news/security/qilin-lockbit-dragonforce-ransomware-gangs-form-strategic-alliance/
Qilin Ransomware Gang Claims Attacks on 700+ Companies in 2024-2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-claims-attacks-on-700-plus-companies/
Qilin Ransomware: Affiliate Program Leaves No Stone Unturned
https://unit42.paloaltonetworks.com/qilin-ransomware-affiliate-program/
Trend Micro Analysis: Water Galura Qilin Ransomware
https://www.trendmicro.com/en_us/research/24/l/water-galura-qilin-ransomware.html
Qilin Ransomware: Uncovering the Latest Affiliate TTPs
https://unit42.paloaltonetworks.com/qilin-ransomware-affiliate-ttps/
Qilin Ransomware Group's Emerging Tactics
https://www.trendmicro.com/en_us/research/24/g/qilin-ransomware-groups-evolving-tactics.html
Agenda Ransomware Affiliates Deploy New Rust-Based Variant
https://thedfirreport.com/2024/01/29/agenda-ransomware-affiliates-deploy-new-rust-based-variant/
Qilin Ransomware Group Surpasses RansomHub in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-group-surpasses-ransomhub-in-2025/
The Qilin Ransomware Group - Analyst1
https://analyst1.com/ransomware-diaries/qilin-ransomware/
Qilin, LockBit, and DragonForce Form Strategic Alliance
https://www.securityweek.com/qilin-lockbit-dragonforce-ransomware-groups-form-alliance/
Qilin Ransomware Group Surpasses RansomHub as Most Prolific in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-surpasses-ransomhub-as-most-prolific-in-2025/
Qilin Ransomware: Rust-Based Malware Targets Critical Industries
https://www.trendmicro.com/en_us/research/24/f/qilin-ransomware.html
Qilin Ransomware: Surging Attacks and Evolving Tactics in 2025
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-2025.html
Qilin Ransomware Group Weaponizes Chrome Browser in Sophisticated Enterprise Attacks
https://thehackernews.com/2024/10/qilin-ransomware-group-weaponizes.html
Qilin Ransomware: Affiliates Making Millions with Custom Encryptors
https://www.trendmicro.com/en_us/research/24/j/qilin-ransomware-affiliates-making-millions.html
Qilin Ransomware Group Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-group.html
Qilin Ransomware Technical Analysis - Sophos
https://news.sophos.com/en-us/2023/12/21/qilin-ransomware-technical-analysis/
Qilin Ransomware Affiliates Exploit Google Chrome Vulnerability
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-affiliates-exploit-google-chrome-vulnerability.html
The Evolution of Qilin (Agenda) Ransomware
https://www.group-ib.com/blog/qilin-agenda-ransomware/
Qilin Ransomware: Examining the Latest Techniques and Tools Used by the Threat Actor
https://www.trendmicro.com/en_us/research/24/b/qilin-ransomware.html
Qilin Ransomware: Triple Alliance Threat Insights
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-triple-alliance-threat-insights.html
Qilin Ransomware: Inside the Triple Extortion Threat
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-inside-the-triple-extortion-threat.html
Qilin (Agenda) Ransomware - CISA Advisory
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-284a
The Qilin Ransomware Group - Sophos X-Ops Analysis
https://news.sophos.com/en-us/2024/08/20/qilin-ransomware/
Qilin Ransomware Technical Analysis and TTPs
https://www.trendmicro.com/en_us/research/24/e/qilin-ransomware-technical-analysis.html
Qilin ransomware attackers steal credentials from Google Chrome browsers
https://www.bleepingcomputer.com/news/security/qilin-ransomware-attackers-steal-credentials-from-google-chrome-browsers/
Qilin Ransomware Group Surpasses RansomHub as Most Prolific Threat Actor
https://www.securityweek.com/qilin-ransomware-group-surpasses-ransomhub-as-most-prolific-threat-actor/
Qilin Ransomware Gang Becomes Top Global Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-becomes-top-global-threat-in-2025/
Qilin, LockBit, and DragonForce Form Alliance
https://www.securityweek.com/qilin-lockbit-and-dragonforce-ransomware-groups-form-alliance/
Qilin Ransomware: Techniques and Evolution Analysis
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-techniques.html
Qilin Ransomware: Affiliates Continue to Dominate the Threat Landscape
https://www.trendmicro.com/en_us/research/24/l/qilin-ransomware.html
Qilin Ransomware Group Expands with Credential Stealer and Remote Access Tool
https://thehackernews.com/2024/11/qilin-ransomware-group-expands-with.html
Qilin Ransomware Deploys Stealer and RAT in Latest Attacks
https://www.bleepingcomputer.com/news/security/qilin-ransomware-adds-stealer-and-remote-access-trojan-tools/
Qilin Ransomware: Proven Encryption, Advanced Tactics | Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-proven-encryption-advanced-tactics
Qilin Ransomware - The DFIR Report
https://thedfirreport.com/2024/10/28/qilin-ransomware/
Sophos X-Ops: Qilin Ransomware Analysis
https://news.sophos.com/en-us/2024/08/20/qilin-affiliates-deploy-stealth-tactics/
CISA Advisory: Qilin Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
Qilin Ransomware: The Rising Threat in 2025
https://www.trellix.com/blogs/research/qilin-ransomware-the-rising-threat-in-2025/
Qilin Ransomware: Analyzing the Growing Threat - Cyble
https://cyble.com/blog/qilin-ransomware-analyzing-the-growing-threat/
Qilin Ransomware Attack Analysis - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-attack-analysis
Qilin Ransomware Group Analysis - The DFIR Report
https://thedfirreport.com/2024/07/15/qilin-ransomware/
Qilin Ransomware Surpasses RansomHub in 2025 - Recorded Future
https://www.recordedfuture.com/threat-intelligence/qilin-ransomware-surge
Qilin Ransomware: Affiliates Favor Atera RMM for Stealthy Attacks
https://www.trendmicro.com/en_us/research/24/l/qilin-ransomware-atera-rmm.html
Symantec Analysis of Qilin Ransomware Operations
https://symantec-enterprise-blogs.security.com/threat-intelligence/qilin-ransomware-affiliate
Qilin Ransomware: Affiliate Leverages Veeam Vulnerability to Breach Network
https://www.trendmicro.com/en_us/research/24/j/qilin-ransomware-affiliate-leverages-veeam-vulnerability.html
Qilin Ransomware Gang Claiming Attack on Synnovis
https://www.ncsc.gov.uk/news/qilin-ransomware-gang-claiming-attack-on-synnovis
Qilin Ransomware Group Extorted Over $50 Million in 2024
https://www.bleepingcomputer.com/news/security/qilin-ransomware-group-extorted-over-50-million-in-2024/
Qilin Ransomware Becomes Most Active Threat in 2025
https://therecord.media/qilin-ransomware-most-active-2025
Qilin Ransomware Analysis and Detection
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-analysis.html
Qilin Ransomware Group Emerges as Top Global Threat
https://www.securityweek.com/qilin-ransomware-group-named-most-prolific-in-q1-2025/
Qilin Ransomware: A Deep Dive Into Affiliate Tooling and Tactics
https://www.trendmicro.com/en_us/research/24/h/qilin-ransomware-deep-dive.html
Qilin Ransomware Group Becomes Most Prolific Threat Actor
https://www.securityweek.com/qilin-ransomware-group-becomes-most-prolific-threat-actor/
Qilin Ransomware Technical Analysis
https://www.sophos.com/en-us/threat-center/threat-reports/qilin-ransomware
Qilin Ransomware Group Expands with Affiliate Program
https://www.trendmicro.com/en_us/research/24/d/qilin-ransomware-group-expands-with-affiliate-program.html
Qilin Ransomware Analysis and Detection
https://www.sophos.com/en-us/threat-intelligence/threat-research/adversaries/qilin
Qilin Ransomware: Surge in Activity and Evolving Tactics
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-evolving-tactics.html
Qilin Ransomware Deepens Ties with Other Groups
https://www.bleepingcomputer.com/news/security/qilin-ransomware-deepens-ties-with-lockbit-dragonforce/
Qilin Ransomware Group Becomes Most Prolific Globally in 2025
https://www.securityweek.com/qilin-ransomware-group-becomes-most-prolific-globally/
Qilin Ransomware: Analysis and Mitigation Strategies
https://www.trendmicro.com/en_us/research/23/k/qilin-ransomware-agenda.html
Qilin Ransomware Group Surpasses RansomHub as World's Most Prolific Cybercrime Operation - January 2025
https://www.darkreading.com/cyberattacks-data-breaches/qilin-ransomware-surpasses-ransomhub-prolific-cybercrime-operation
Sophos X-Ops Active Adversary Report: Qilin Affiliates Exploit Gootloader and Other Initial Access Methods
https://news.sophos.com/en-us/2024/10/31/sophos-x-ops-active-adversary-report-qilin-affiliates-exploit-gootloader-and-other-initial-access-methods/
Qilin Ransomware Group Surpasses RansomHub as Most Prolific Threat Actor in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-group-surpasses-ransomhub-as-most-prolific-threat-actor/
Scattered Spider Deploying Qilin Ransomware in Recent Attacks
https://www.scworld.com/news/scattered-spider-deploying-qilin-ransomware
Qilin Ransomware Group Becomes Most Prolific Attacker in 2025
https://www.helpnetsecurity.com/2025/01/28/qilin-ransomware-most-prolific-2025/
Water Galura Exploits Veeam Vulnerability to Deploy Qilin Ransomware
https://www.trendmicro.com/en_us/research/24/h/water-galura-exploits-veeam-vulnerability.html
Qilin Ransomware Group Emerges as Most Prolific Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-overtakes-ransomhub-as-top-threat-in-2025/
Sophos X-Ops: The Qilin Ransomware Group
https://news.sophos.com/en-us/2024/05/28/the-qilin-ransomware-group/
Trend Micro: Water Galura (Qilin) Ransomware Analysis
https://www.trendmicro.com/en_us/research/24/k/water-galura-qilin.html
Qilin Ransomware: Most Active Threat of 2025
https://www.flashpoint.io/blog/qilin-ransomware-most-active-threat-2025
Qilin Ransomware Group Analysis - Halcyon
https://www.halcyon.ai/blog/qilin-ransomware-group
Qilin Ransomware: A Deep Dive into Tactics, Techniques, and Procedures
https://www.trendmicro.com/en_us/research/24/e/qilin-ransomware-a-deep-dive.html
Qilin Ransomware Group Ramps Up Attacks With Stolen VPN Credentials
https://thehackernews.com/2024/07/qilin-ransomware-group-ramps-up-attacks.html
Qilin Ransomware Becomes Most Prolific Threat of 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-prolific-threat-of-2025/
Qilin Ransomware Alliance with LockBit and DragonForce
https://www.securityweek.com/qilin-lockbit-dragonforce-form-ransomware-alliance/
Qilin Ransomware: Affiliate Adoption and Weaponization of Veeam Vulnerabilities
https://www.trendmicro.com/en_us/research/24/j/qilin-ransomware-affiliate-adoption-veeam.html
Qilin Ransomware Group Intensifies Attacks on Healthcare Sector
https://thehackernews.com/2024/06/qilin-ransomware-group-intensifies.html
Halcyon Qilin/Agenda Ransomware Profile
https://www.halcyon.ai/blog/qilin-agenda-ransomware
Qilin Ransomware: Most Active Ransomware Group of Q1 2025
https://www.trellix.com/blogs/research/qilin-ransomware-most-active-ransomware-group-of-q1-2025/
Qilin Ransomware Analysis
https://www.cybereason.com/blog/threat-analysis-qilin-ransomware
Sophos X-Ops Active Adversary Report: Qilin Analysis
https://news.sophos.com/en-us/2024/10/31/sophos-x-ops-active-adversary-report/
Qilin Ransomware: Agenda Becomes Most Active Ransomware Group
https://www.trendmicro.com/en_us/research/23/k/qilin-ransomware-agenda-becomes-most-active-ransomware-group.html
Qilin Ransomware: Most Prolific Threat Actor of 2025
https://www.malwarebytes.com/blog/news/2025/01/qilin-ransomware-most-prolific-threat-actor-of-2025
Qilin Ransomware Group Partners with LockBit and DragonForce
https://www.bleepingcomputer.com/news/security/qilin-ransomware-group-partners-with-lockbit-and-dragonforce/
Qilin Ransomware Technical Analysis - Trend Micro
https://www.trendmicro.com/en_us/research/24/k/qilin-ransomware-technical-analysis.html
Qilin Ransomware Becomes Top Global Threat in Early 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-becomes-most-active-group-in-early-2025/
Qilin Ransomware: Agenda Attacks Through VEEAM Exploits
https://www.trendmicro.com/en_us/research/24/b/qilin-ransomware-agenda.html
Qilin Ransomware Deploys Stealth with Credential Dumping and Cloud Storage
https://www.trellix.com/blogs/research/qilin-ransomware-deploys-stealth-with-credential-dumping-and-cloud-storage/
Qilin Ransomware: Surging to the Top of the Ransomware Landscape in 2025
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-surging-to-the-top-of-the-ransomware-landscape.html
Qilin Ransomware Group Rakes in $50 Million from Nearly 1,000 Attacks
https://thehackernews.com/2025/01/qilin-ransomware-group-rakes-in-50.html
RansomHub, Qilin Continue to Lead Ransomware Victims in 2025
https://www.darkreading.com/cyberattacks-data-breaches/ransomhub-qilin-lead-ransomware-victims-2025
Sophos X-Ops: Qilin Ransomware Technical Analysis
https://news.sophos.com/en-us/2024/08/22/qilin-ransomware-technical-analysis/
Qilin Ransomware Group Emerges as Major Threat in 2024
https://www.sophos.com/en-us/threat-center/threat-analyses/adversaries/qilin-ransomware
Halcyon Qilin.B Ransomware Analysis
https://www.halcyon.ai/blog/qilin-b-ransomware-analysis
Qilin Ransomware Group Surpasses RansomHub as Most Active Ransomware Operation
https://www.trendmicro.com/en_us/research/25/a/qilin-ransomware-group-surpasses-ransomhub.html
Qilin Ransomware Technical Analysis and Threat Intelligence
https://www.fortinet.com/blog/threat-research/qilin-ransomware-technical-analysis
Qilin Ransomware Group Emerges as Top Threat in 2025
https://www.bleepingcomputer.com/news/security/qilin-ransomware-is-2025s-most-active-ransomware-operation/
Secureworks Analysis of Qilin Ransomware
https://www.secureworks.com/research/threat-profiles/gold-feather
Sophos Investigation: Qilin Affiliates Exploit Veeam Vulnerability
https://news.sophos.com/en-us/2024/08/20/qilin-affiliates-veeam-vulnerability/