🕵️ Qilin

The items that name it 17

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas classification.key entities2026-10-29
• Unwrapping Retail Peak Season Cyber Threats
  articleas classification.key entities2026-10-28
• High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
  articleas threat actors2026-10-21It is written here as Qilin (ransomware group, 339 claimed incidents in Q3 2026).

  ransomware group, 339 claimed incidents in Q3 2026

• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated Oct 20)
  advisoryas classification.key entities2026-10-20
• Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
  articleas threat actors2026-10-07It is written here as Qilin (also known as Agenda).

  One of the most prolific RaaS operations; hit hundreds of organizations worldwide; listed 400 victims on its Tor-based leak site throughout 2025; blamed for hacking Synnovis and disrupting multiple London NHS hospitals in 2024; claimed responsibility for hacking Asahi Group last year, compromising p

• Check Point Research — 28th September Threat Intelligence Report
  articleas threat actors2026-09-28

  Ransomware ecosystem used by Storm-2570 affiliate.

• Trust and the enticing consultancy offer
  articleas threat actors2026-09-24

  Ransomware group ranked second most active in Japan in H1 2026, appeared to use AI.

• Should you care about an “AI slowdown?”
  articleas threat actors2026-09-17

  Ransomware group leveraging generative AI (large language models) to generate destructive scripts and streamline attacks, accelerating attack speed and lowering barrier to entry; targets small- and medium-sized enterprises with double-extortion tactics.

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  articleas threat actors2026-09-17

  Second-highest ransomware group by observed incidents in Japan in 2026 (after The Gentlemen), with seven incidents; caused the highest number of incidents in Japan the previous year; found to be leveraging AI (LLM-generated code) to improve operational efficiency, including a deadman.py destructive

• SETTRA RANSOMWARE
  writeupas threat actors2026-09-14

  Mentioned as another ransomware group that adopted a mythological/game character name.

• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeupas threat actors2026-09-09
• Every Ransomware Attack Has a Backstory
  articleas threat actors2026-07-15
• 5 Modern Threats You Need to Watch
  articleas threat actors2026-07-14

  Ransomware case where attacker installed remote access software disguised with a name almost identical to a legitimate commonly used tool, pulled in credential-stealing tools, disabled antivirus, and launched ransomware from a different machine on the network. Huntress was brought in after the fact

• How the RaaS Business Model Actually Works
  articleas threat actors2026-07-01
• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeupas threat actors2026-05-21

  Ransomware group associated with workstation WIN-8OA3CCQAE4D per FalconFeeds

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas threat actors2026-05-20

  Maintains ransomware, recruits affiliates, provides infrastructure including leak sites, payment portals, and legal support functions

• The Evolving Linux Threat Landscape
  articleas threat actors2026-03-03

  Ransomware designed to abuse VMware ESXi; reports indicate it has added support for WSL abuse