Threat Group Profile
qilin
● Active — last 30 days
Victim claims
533
First seen
Mar 2026
Last activity
25 Aug 2026
Tracked since
Oct 2022
Group overview
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Preferred targets
Manufacturing · 82
Business Services · 67
Consumer Services · 37
Healthcare · 35
Agriculture and Food Production · 33
Technology · 32
Most targeted countries
US · 188
GB · 34
DE · 31
CA · 24
IT · 18
FR · 18
Tactics & techniques (MITRE ATT&CK)
Initial Access
Valid Accounts
Exploit Public-Facing Application
Phishing
Phishing: Spearphishing via Service
Execution
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: Unix Shell
System Services
System Services: Service Execution
Persistence
Boot or Logon Initialization Scripts
Scheduled Task/Job
Scheduled Task/Job: Scheduled Task
Account Manipulation: SSH Authorized Keys
Create Account
Boot or Logon Autostart Execution
Privilege Escalation
Exploitation for Privilege Escalation
Defense Evasion
Obfuscated Files or Information
Masquerading: Invalid Code Signature
Access Token Manipulation: Parent PID Spoofing
Exploitation for Defense Evasion
Execution Guardrails
Virtualization/Sandbox Evasion: System Checks
Subvert Trust Controls: Code Signing
Disable or Modify Tools
Credential Access
OS Credential Dumping: LSASS Memory
Network Sniffing
Brute Force: Password Cracking
Credentials from Web Browsers
Discovery
Query Registry
Network Service Discovery
System Information Discovery
System Location Discovery
Lateral Movement
Remote Services
Remote Services: Remote Desktop Protocol
Remote Services: SMB/Windows Admin Shares
Remote Services: SSH
Lateral Tool Transfer