Threat Group Profile

qilin

● Active — last 30 days

Victim claims 533

First seen Mar 2026

Last activity 25 Aug 2026

Tracked since Oct 2022

Group overview

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Preferred targets

Manufacturing · 82 Business Services · 67 Consumer Services · 37 Healthcare · 35 Agriculture and Food Production · 33 Technology · 32

Most targeted countries

US · 188 GB · 34 DE · 31 CA · 24 IT · 18 FR · 18

Tactics & techniques (MITRE ATT&CK)

Initial Access

Valid Accounts Exploit Public-Facing Application Phishing Phishing: Spearphishing via Service

Execution

Command and Scripting Interpreter: PowerShell Command and Scripting Interpreter: Unix Shell System Services System Services: Service Execution

Persistence

Boot or Logon Initialization Scripts Scheduled Task/Job Scheduled Task/Job: Scheduled Task Account Manipulation: SSH Authorized Keys Create Account Boot or Logon Autostart Execution

Privilege Escalation

Exploitation for Privilege Escalation

Defense Evasion

Obfuscated Files or Information Masquerading: Invalid Code Signature Access Token Manipulation: Parent PID Spoofing Exploitation for Defense Evasion Execution Guardrails Virtualization/Sandbox Evasion: System Checks Subvert Trust Controls: Code Signing Disable or Modify Tools

Credential Access

OS Credential Dumping: LSASS Memory Network Sniffing Brute Force: Password Cracking Credentials from Web Browsers

Discovery

Query Registry Network Service Discovery System Information Discovery System Location Discovery

Lateral Movement

Remote Services Remote Services: Remote Desktop Protocol Remote Services: SMB/Windows Admin Shares Remote Services: SSH Lateral Tool Transfer