QilinMalware
- agendacrypt
Ransomware written in Go.From MISP Galaxy
Last reported yesterday, by The Hacker News100 reports
ATT&CK techniques
6 of 128 · each with the sentence it comes from- T1684Social Engineering
“PREY-0059 social engineering campaign: A threat actor is currently involved in a social engineering campaign that impersonates internal IT help-desk staff over Microsoft Teams, delivering Windows update-related files that infect users with a Java-based RAT.”
- T1021.001Remote Desktop Protocol
“After gaining initial access, the criminals move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned.”
- T1053.005Scheduled Task
“T1053.005”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1685Disable or Modify Tools
“T1562.001 Impair Defenses: Disable or Modify Tools”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
100 reports · the newest 20, newest first · the exact sentence from each-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials“The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“With these numbers, n0n would have been the third-most active ransomware group in Q3, right behind Qilin and The Gentlemen (PDF), which is quite the achievement for a newly launched operation.”
-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“The most successful ransomware groups were The Gentlemen (342 claimed incidents) and Qilin (339).”
-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy“During the reporting period, the two most prolific ransomware groups were The Gentlemen and Qilin.”
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June“On October 19, Unit 42 updated its threat brief on the flaw, naming Qilin and Inc among the ransomware operators exploiting it.”
-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“From our investigation we also note victim overlaps with several ransomware groups such as Qilin and The Gentlemen, suggesting a possible relationship with ransomware operators or an Initial Access Broker (IAB) role However at this point of the investigation, the relationship bet…”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“The bug was patched in June and had been incorporated in attacks by the Qilin group in July.”
-
Palo Alto's firewall OS has been under attack from multiple ransomware groups since June“Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks' PAN-OS, with Unit 42 investigating attacks since early June across numerous industries, such as finance, healthcare, and manufacturing.”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA”
-
Ransom & Dark Web Issues Week 4, October 2026“… Brazil DarkWeb DataBreach DataLeak DDW DeepWeb 랜섬웨어 데이터유출 데이터탈취 미국 개인정보유출 개인정보탈취 브라질 금융 딥웹 다크웹 HYFLOCK IT 일본 의료 호주 사우디아라비아 Japan Leaked Qilin Ransom Ransomware SaudiArabia TheSevenDeadlySins USA”
-
Japan Data Breaches 2026: Inside the October Surge“-Ransomware stayed steady: leak sites named 6 to 17 Japanese victims a month in 2026, and The Gentlemen overtook Qilin as the most active group against Japan”
-
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)“…r 19 Update: Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc).”
-
Risky Bulletin: PwnEscape vulnerability lets you escape KVM“Arrested Qilin member linked to Synnovis hack: A Russian national currently in German police custody is believed to be behind the ransomware attack that crippled UK blood testing company Synnovis in 2024.”
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More“Qilin and Settra Exploit PAN-OS Flaw”
-
September 2026 CVE Landscape“…and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“The most prolific gangs were Qilin and The Gentlemen.”
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups“The cyber threat detection provider warned in a social media advisories posted on October 9 that multiple groups, including the Qilin and Settra ransomware operations, are actively targeting CVE-2026-0257 to establish unauthorized VPN sessions and gain initial access to internal…”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“Qilin member arrested in Japan: Japanese police have arrested a Russian national believed to be a key member of the Qilin ransomware.”
-
September 2026 Threat Trend Report on Ransomware“In terms of the number of affected companies by the top 10 ransomware groups, Gentlemen ranked first with 102 incidents, followed by the Qilin group in second place with 78 incidents.”
Indicators in its reports
named in the reports above- infosec[.]exchangein 2 reports
- railway[.]comin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.