Most ransomware brands burn bright and disappear within a year. Qilin did the opposite. A mid-sized operation in 2023, it became the single most active ransomware group in the world in 2025 and stayed at the top through 2026, listing more organisations on its leak site than any rival.
For security teams, Qilin matters for two reasons. First, its volume means almost every industry and region is in range, from factories and hospitals to city councils. Second, nearly every Qilin attack leaves traces on the dark web before and after the encryption starts: stolen credentials, access listings and, finally, a public post on the group's leak site. This guide explains how Qilin operates and where those early signals appear.
What Is Qilin Ransomware?
Qilin is a ransomware-as-a-service (RaaS) operation. A core team builds and maintains the ransomware, runs the negotiation portal and hosts the leak site. Independent criminals, called affiliates, rent that toolkit, break into victim networks and deploy the payload. The core team takes a cut of every ransom paid.
The group first appeared in mid-2022 under the name Agenda and rebranded as Qilin within a few months. Security vendors also track it as Gold Feather and Water Galura. Its ransomware was originally written in Go and was later rebuilt in Rust, which makes it fast and easy to compile for different targets. Current versions run on Windows, Linux and VMware ESXi, so a single affiliate can encrypt both office laptops and the virtual servers that run a company's core systems.
Why affiliates choose Qilin
RaaS brands compete for skilled affiliates the way software companies compete for customers. Qilin has been generous: reporting cited by the Center for Internet Security says affiliates keep around 80 to 85 percent of each ransom, with the rest going to Qilin's operators. When the rival RansomHub operation collapsed in spring 2025, many of its affiliates needed a new home, and Qilin's victim count jumped sharply in the months that followed.
How Big Is Qilin in 2026?
By almost every tracker, Qilin is the largest ransomware operation currently running. The numbers below come from separate research teams, which count slightly differently, but they all point the same way.
To put that in context, Searchlight Cyber counted a record 7,458 victims across all ransomware leak sites in 2025. Qilin alone accounted for roughly one in seven of them. ZeroFox has described Qilin as the leading ransomware collective for an unbroken run starting in the second quarter of 2025.
Volume is not the same as profit. GuidePoint's researchers note that a large share of Qilin's victims refuse to pay, which is one reason the group posts so many names publicly: the leak site is its main pressure tool.
How Qilin Affiliates Get In
Because each affiliate runs its own intrusions, there is no single Qilin playbook. Incident reports from Cisco Talos, Check Point, ThreatLocker and the US health sector's HC3 team show the same handful of entry points again and again.
1. Valid credentials on remote access systems
The most common route is simply logging in. Affiliates use usernames and passwords for VPNs, remote desktop gateways and cloud portals that were stolen earlier, often by infostealer malware on an employee's or contractor's device. If that account has no multi-factor authentication, the attacker walks straight in. Cisco Talos lists valid credentials on remote access systems as a primary initial access vector in the Qilin incidents it investigated.
2. Exploiting edge devices
Firewalls, VPN appliances and remote support tools sit on the internet by design, which makes unpatched ones an easy target. Qilin affiliates have exploited Fortinet firewall vulnerabilities and flaws in remote access software such as ConnectWise ScreenConnect. When a critical bug in an edge device is published, the window between disclosure and exploitation is often just days.
3. Phishing and business email compromise
Spear-phishing emails with malicious links or attachments remain part of the toolkit, particularly to capture credentials or install a first piece of remote access malware.
4. Buying access from brokers
Some affiliates skip the break-in entirely and buy a ready-made foothold from an initial access broker on a dark web forum. These listings typically describe the victim's country, sector, revenue and access level without naming the company. For defenders, this is one of the earliest warning signs available, because the listing appears before any ransomware is deployed.
Three of the four entry points depend on information that circulates on the dark web first: leaked credentials, exploit discussion, or an access listing. That is why credential and access monitoring belongs in any Qilin defence plan, alongside patching and MFA.
Inside a Qilin Intrusion
Once inside, Qilin affiliates usually spend several days quietly expanding their access before triggering encryption. The typical sequence looks like this:
- Reconnaissance. Mapping the network, Active Directory and file shares. Talos has documented affiliates using ordinary Windows tools to browse for sensitive documents, which helps them blend in with normal admin activity.
- Persistence and remote control. Installing legitimate remote monitoring and management (RMM) software or frameworks such as Cobalt Strike so they can return even if the first account is reset.
- Privilege escalation and defence evasion. Harvesting administrator credentials and, in some cases, loading vulnerable signed drivers to switch off endpoint security, a technique known as bring your own vulnerable driver (BYOVD).
- Data theft. Copying large volumes of files to attacker-controlled storage. In the April 2025 attack on SK Inc., more than 1 TB of files ended up on the leak site.
- Encryption. Deleting shadow copies and backups, then encrypting Windows machines, Linux servers and ESXi hosts. Encrypting the hypervisor takes down every virtual machine running on it at once.
- Extortion. Leaving a ransom note that points to a negotiation portal, with a deadline before the stolen data is published.
Qilin's Leak Site and Dark Web Footprint
Qilin uses double extortion: it encrypts systems and threatens to publish stolen data. Its data leak site is hosted on Tor, and according to reporting cited by CIS, the group has also run a version on the open internet to make leaks easier for journalists, customers and regulators to find. That visibility is deliberate. A listing on the site is meant to embarrass the victim into paying.
A typical listing moves through stages: a company name and logo, a countdown timer, sample files as "proof", and finally a full data dump if no payment is made. Qilin often posts victims in batches, sometimes more than a dozen in a few days, which is why its monthly totals swing so sharply.
Two facts make that pressure effective. As of August 2026 there is no free decryptor for any Qilin variant, and no arrest, indictment or sanction has been announced against the group's operators. Without a decryptor or law enforcement disruption, victims who lack clean backups face a hard choice.
Who Qilin Targets
Qilin is opportunistic. Affiliates hit whoever they can access, so the victim list cuts across almost every sector. Some patterns stand out:
- Manufacturing is the most affected sector, at around 23 percent of leak-site victims in Cisco Talos's analysis. Production downtime makes manufacturers more likely to pay quickly. See our dark web monitoring for manufacturing page.
- Healthcare has suffered some of Qilin's most damaging attacks. The June 2024 attack on Synnovis, a pathology provider for London hospitals, disrupted blood tests and procedures across the NHS for months. See dark web monitoring for healthcare.
- Local government is a frequent target, with Qilin responsible for nearly a quarter of ransomware incidents against US state and local entities in Q2 2025.
- Large brands and public bodies appear too. In October 2025 Qilin claimed attacks on Japanese brewer Asahi and the Texas city of Sugar Land, and in March 2026 it claimed an attack on the German political party Die Linke.
Geographically, around half of Qilin's victims are in the United States, with France, Canada, South Korea and Spain also appearing regularly.
Leak-site listings are claims made by criminals. Some are exaggerated, recycled or posted to pressure a company during negotiations. Treat a listing as a serious signal to investigate, not as proof of what was stolen.
Dark Web Warning Signs Before a Qilin Attack
Qilin attacks rarely come out of nowhere. The chain usually leaves marks in places that dark web monitoring can see. The earlier you catch them, the more options you have.
DarkThreat monitors infostealer logs, criminal forums, Telegram channels and ransomware leak sites for exactly these signals, so security teams are alerted when their domains, credentials or brand appear. Learn more about DarkThreat plans.
How to Reduce Your Qilin Risk
No single control stops a determined affiliate, but the following steps remove the easy paths Qilin relies on most:
- Enforce phishing-resistant MFA on every remote access path, including VPNs, RDP gateways, remote support tools and admin portals. Stolen passwords are far less useful without it.
- Patch internet-facing devices first. Track the CISA Known Exploited Vulnerabilities catalogue and treat any listed flaw in your firewalls, VPNs or remote access tools as an emergency.
- Control remote management tools. Allow only approved RMM software and alert on any new installation.
- Protect your hypervisors. Keep ESXi management off the general network, restrict who can log in, and monitor for mass virtual machine shutdowns.
- Keep offline, tested backups. Qilin deletes shadow copies and targets backup systems. Immutable or offline copies are what let you recover without paying.
- Monitor for leaked credentials continuously. Resetting an exposed account the day it appears in a stealer log closes the door before an affiliate uses it.
- Rehearse your response. Decide in advance who handles negotiations, regulators, customers and the press if your name appears on a leak site.
Key Takeaways
- Qilin has been the most active ransomware group since 2025, with over 1,000 victims that year alone.
- Its affiliates mostly get in with stolen credentials, unpatched edge devices, phishing or purchased access.
- It encrypts Windows, Linux and ESXi systems and uses a public leak site to pressure victims. No free decryptor exists.
- Manufacturing, healthcare and local government are among the hardest-hit sectors.
- Leaked credentials and access listings often appear on the dark web before an attack, which gives monitored organisations time to act.
Frequently Asked Questions
Is Qilin the same as Agenda ransomware?
Yes. The operation launched as Agenda in 2022 and rebranded as Qilin within months. Many security tools still use both names.
Is there a free Qilin decryptor?
No. As of August 2026 no free decryptor exists for any Qilin variant. Recovery depends on clean backups or, if a victim pays, on the attackers providing a working key, which is never guaranteed.
Who is behind Qilin?
Researchers describe Qilin as a Russian-speaking criminal operation. Its individual operators have not been publicly identified, and no arrests or sanctions have been announced.
Should a company pay a Qilin ransom?
Paying funds further attacks, may breach sanctions rules in some cases, and does not guarantee data deletion or a working decryptor. Most authorities advise against paying. Any decision should involve legal counsel, your insurer and law enforcement.
How can dark web monitoring help against Qilin?
It finds the early signals: employee credentials in stealer logs, access for sale on forums, and your name on a leak site. Acting on those alerts quickly can stop an intrusion before encryption, or speed up your response if data has already been taken.
Related Resources
- Ransomware-as-a-Service Affiliate Programs: How the Business Model Works
- Initial Access Brokers on the Dark Web: The Hidden Attack Enablers
- How Infostealer Malware Enables Ransomware: The Attack Kill Chain
- Leaked VPN Credentials on the Dark Web: Monitoring and Response
- Monitoring Ransomware Leak Sites: A Security Team's Guide
- Double Extortion Ransomware: Monitoring Leak Sites for Your Data
Sources
- Cisco Talos: Uncovering Qilin attack methods exposed through multiple cases
- GuidePoint Security: GRIT 2026 Ransomware and Cyber Threat Report
- Center for Internet Security: Qilin Top Ransomware Threat to SLTTs in Q2 2025
- Comparitech: Ransomware roundup, October 2025
- CybelAngel: Qilin Ransomware Attack Methods and 2026 Status
- Adaptive Security: Qilin Ransomware
- ZeroFox: Qilin Claims Record Number of Monthly Attacks for 2026
- The Record: Qilin ransomware gang hits hundreds of organisations in 2025
- HHS HC3: Qilin, aka Agenda Ransomware threat profile
- Check Point: Qilin Ransomware (Agenda) deep dive
