Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Qilin still targets hospitals and critical infrastructure after an arrest

Synnovis fallout is still reaching NHS trusts, a Romanian pipeline operator confirmed Qilin data theft in 2026, and VPN zero-days now open the door. Patch edge gateways, enforce MFA and vet IT provider access.

Download the PDF, 875 KB Talk to the SOC
Part 2 of 2 · Qilin

At a glance

RW-02 · Ransomware group

  • 2,367 victims listed on Qilin's leak site since October 2022, as of October 13, 2026[2]
  • 1 patient death King's College Hospital linked to the Synnovis outage[24]
  • almost 33,000 Synnovis-related patient records reported by Bedfordshire Hospitals alone, June 2026[27]
  • 28 of 33 Korean Leaks victims still public of those Qilin listed[15]
Status
Active. Qilin listed new victims on October 13, 2026 and has posted 2,367 since October 2022, with the leak site operating after a suspected leading member was detained.[2]
Threat rating
Critical. The rating holds on October 2026 evidence.[1]
Initial access
Check Point VPN zero-day and Palo Alto VPN bypass in 2026, after FortiGate flaws in 2025[23]
Healthcare harm
King's College Hospital linked one patient death to the Synnovis outage; 170 harm cases recorded, 2 severe[24]
Critical infrastructure
Romania's national oil pipeline operator Conpet confirmed Qilin took company data in February 2026 and said operations were unaffected[30]
Supply chain
Korean Leaks: 33 victims posted (28 still public) after one IT provider compromise; Moonstone Sleet involvement only suspected[15]
Law enforcement
One suspected leading member detained in Osaka in May 2026 and sent to Germany; more than 450 victims listed since June[5]

What happened

Z7's January 2026 Part 2 scored Qilin on seven threat-actor dimensions and rated three signature cases: the June 2024 Synnovis outage, the March 2025 Malaysia Airports incident and the September 2025 Korean Leaks campaign. Nine months on, the Synnovis harm is still being counted in patient records, a suspected leading Qilin member is in German custody, and the group's way in has shifted to VPN zero-days. Part 1 of this series covers the group's volumes and the arrest in full; this part follows the three cases and the scores that rest on them.

  • King's College Hospital confirmed in June 2025 that a patient died unexpectedly during the Synnovis attack and that a long wait for a blood test result was one contributing factor; reported impact included 170 harm cases, 10,152 outpatient appointments and 1,710 elective procedures (Infosecurity Magazine).
  • Synnovis said its stolen-data review took more than a year and told NHS organizations by November 2025; it has published no patient total. In June 2026 Bedfordshire Hospitals reported almost 33,000 patient records caught up in the breach and Mid and South Essex about 2,380 (The Register).
  • Malaysia Airports said it detected a threat on March 23, 2025 and the prime minister said he refused a $10 million demand. Qilin claimed the attack on April 28, 2025, saying it took 2 TB, and the airport has not verified that claim, so the attribution rests on Qilin's own post.
  • Bitdefender counted 33 Korean Leaks victims posted in three waves between September 14 and October 4, 2025 (28 still public), with more than 1 million files and 2 TB documented in the cases it could measure. It does not name the IT provider, and it calls Moonstone Sleet involvement plausible and probable, not confirmed.
  • Microsoft said Moonstone Sleet began deploying Qilin at a limited number of organizations in late February 2025, the first time that actor used ransomware from a ransomware-as-a-service operator. CISA and the FBI had already reported in August 2024 that Iran-based actors worked directly with ALPHV, NoEscape and Ransomhouse affiliates.
  • In February 2026 Conpet, Romania's national oil pipeline operator, confirmed that Qilin took data from its corporate IT network, after Qilin claimed nearly 1 TB.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Enter through edge or supplier access

    MITRE ATT&CK T1190 (opens in a new tab)

    Affiliates exploit VPN and firewall flaws: PRODAFT tied a May to June 2025 campaign to FortiGate bugs CVE-2024-21762 and CVE-2024-55591, and in 2026 the entry points were Check Point and Palo Alto authentication bypasses. They also reach clients through a compromised IT provider, as in Korean Leaks.

  2. Harvest browser passwords by GPO

    MITRE ATT&CK T1555.003 (opens in a new tab)

    Sophos saw an intruder add a logon Group Policy Object that ran IPScanner.ps1 from SYSVOL, writing each machine's saved Chrome passwords into a SQLite file. Sophos cites a NordPass survey figure of 87 work passwords per user, so one harvest can reach third-party accounts.

  3. Reach backups and hypervisors

    Arctic Wolf saw intruders target Veeam backup infrastructure before running ransomware. Qilin's encryptors cover Windows, Linux and VMware ESXi, so a hypervisor and its backups can fall together.

  4. Exfiltrate and clear the logs

    MITRE ATT&CK T1567.002 (opens in a new tab)

    In June 2026 cases the intruders moved data with Rclone, FileZilla and Proton Drive, mostly to MEGA, cleared Windows event logs and sometimes switched off Defender real-time protection.

  5. Encrypt and add pressure

    MITRE ATT&CK T1486 (opens in a new tab)

    Halcyon describes Rust encryptors that pick AES-256-CTR or ChaCha20 and protect keys with RSA-4096, plus a leak site, a Call Lawyer feature, automated negotiation and DDoS added in 2025. No decryptor appears on the No More Ransom list.

Who is at risk

PRODAFT calls Qilin's target selection opportunistic, and its 2025 and 2026 victims include hospitals and their lab suppliers, a national pipeline operator and asset managers served by one IT provider. Any organization with an internet-facing VPN or firewall, or one outsourced IT provider, fits the pattern.

  • Health systems and the lab, imaging and records suppliers they depend on: ransomware.live lists 199 healthcare victims since 2022, and NCC Group put healthcare at 12 percent of August 2026 ransomware incidents.
  • Energy, transport and other critical infrastructure operators whose corporate IT is reachable from the internet, as Conpet showed in February 2026.
  • Clients of managed service providers and other shared IT vendors, since one compromised provider exposed dozens of Korean financial firms.
  • Organizations running Fortinet, Check Point or Palo Alto VPN gateways that are unpatched, lack MFA or still hold sessions opened before patching.
  • Public bodies and schools: Comparitech counted 40 government and 26 education claims in 2025 through October.

Sectors in scope

  • Healthcare and diagnostic suppliers
  • Energy and pipelines
  • Financial services and asset management
  • Transportation and logistics
  • Government
  • Education
  • Manufacturing
  • Professional services
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition7 changes

  1. Japan's National Police Agency confirmed on October 8, 2026 (The Record) that a 28-year-old Russian national suspected of being a leading Qilin member was detained in Osaka in May and sent to Germany, where SecurityWeek says he is wanted over a September 2024 attack on a logistics company with over $160,000 extorted. The January 2026 edition's 'no core arrests' evidence behind Persistence and Resilience no longer holds, and Part 1 covers the arrest and the group's continued activity.

    Source 4

  2. Synnovis says its stolen-data review took more than a year (17 months per HIPAA Journal) and it notified NHS organizations by November 2025; hospitals, not Synnovis, notify patients. In June 2026 Bedfordshire Hospitals reported almost 33,000 patient records caught up and Mid and South Essex about 2,380; no total has been published, and the 900,000 figure in the January 2026 edition is a third-party estimate.

    Source 27

  3. Romania's national oil pipeline operator Conpet confirmed on February 12, 2026 that Qilin stole company data, after Qilin claimed nearly 1 TB. Conpet says operations were unaffected and that it is working with Romania's national cyber security directorate.

    Source 30

  4. Initial access moved from FortiGate bugs (PRODAFT, May to June 2025) to VPN authentication bypasses: Check Point believes a Qilin affiliate exploited CVE-2026-50751, with the earliest observed exploitation on May 7, 2026, and Arctic Wolf traced June 2026 Qilin intrusions to PAN-OS CVE-2026-0257. CISA lists both in its Known Exploited Vulnerabilities catalog with ransomware use marked Known.

    Source 23

  5. Correction: the January 2026 edition described the March 2025 Malaysia Airports incident as a Qilin attack. The airport and Malaysian authorities named no attacker, Qilin claimed it on April 28, 2025, and the airport has not verified the claim; no later confirmation was found, so the case is Qilin-claimed.

    Source 10

  6. Correction: the '$50 million+ in ransom payments in 2024' headline could not be sourced. The only $50 million figure in the sources checked is the demand made of Synnovis, which Synnovis did not pay.

    Source 9

  7. Correction: Microsoft described Moonstone Sleet's use of Qilin as the first time that actor used ransomware from a ransomware-as-a-service operator, not the first state-linked adoption of one. CISA and the FBI reported Iran-based actors working directly with ALPHV, NoEscape and Ransomhouse affiliates in August 2024.

    Source 14

What to do now

In priority order, highest impact first.

  1. Do firstPatch and audit every internet-facing VPN and firewall gateway now (Fortinet, Check Point, Palo Alto), then terminate existing VPN sessions and rotate credentials that passed through them.

    Qilin affiliates used FortiGate flaws in 2025 and VPN authentication bypasses in 2026, and Arctic Wolf advises ending active GlobalProtect sessions after patching so unauthorized sessions are invalidated.

  2. Require phishing-resistant MFA on VPN, RDP and every remote management tool, and remove local VPN accounts.

    In the Sophos case the intruder entered through a VPN portal that had no MFA.

  3. Disable browser password storage by policy, deploy an enterprise password manager, and alert on edits to the default domain policy and new .ps1 or .bat files in SYSVOL.

    Qilin's logon GPO turns one domain compromise into every saved Chrome password across the estate.

  4. Keep Veeam on a current supported release, with separate credentials, MFA on the console, immutable or offline copies and monthly restore tests.

    CISA lists four Veeam flaws with known ransomware use, and Arctic Wolf saw Qilin intruders target Veeam infrastructure before encrypting.

  5. Isolate ESXi and other hypervisor management on a dedicated network, keep SSH off unless in use, and alert on new administrator sessions.

    Qilin's encryptors target VMware ESXi, so hypervisor access decides how much encrypts at once.

  6. Treat IT providers and lab or diagnostic suppliers as part of your attack surface: MFA, least privilege, segmented access, log sharing, quarterly access reviews and a contract clause for breach notice and data inventory.

    One provider compromise reached dozens of Korean firms, and Synnovis needed more than a year to scope what was stolen.

  7. Write and rehearse downtime procedures for outsourced critical services such as pathology, billing and dispatch.

    The Synnovis outage left clinicians waiting on blood test results, and King's College Hospital named that wait as a contributing factor in a patient death.

  8. If nobody watches VPN, identity and log-clearing alerts overnight, Z7's 24/7 SOC and Microsoft 365 posture review cover that gap.

    Arctic Wolf saw Qilin clear event logs and disable Defender real-time protection before encrypting.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
file IPScanner.ps1 and logon.bat in a new SYSVOL directory, run by a logon Group Policy Object added to the default domain policy [17]
file Per-host SQLite database named LD and a text file temp.log written back to SYSVOL at each user logon [17]
behavior Event logs cleared estate-wide and Microsoft Defender real-time protection disabled shortly before ransomware deployment [22]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
  2. [2]
    Qilin group page, victim listings (opens in a new tab) Ransomware.live · checked October 13, 2026 · ransomware.live
  3. [3]
    Japan confirms arrest of Russian Qilin operative, extradition to Germany (opens in a new tab) The Record (Recorded Future News), reporting Japan's National Police Agency release · October 9, 2026 · therecord.media
  4. [4]
  5. [5]
    Germany arrests alleged core Qilin ransomware member after extradition (opens in a new tab) BleepingComputer · October 9, 2026 · bleepingcomputer.com
  6. [6]
  7. [7]
    Ransomware Attacks Reach Record High for 2026 (opens in a new tab) Infosecurity Magazine, reporting NCC Group's August 2026 Cyber Threat Intelligence Report · September 23, 2026 · infosecurity-magazine.com
  8. [8]
    Qilin threat group profile (opens in a new tab) Halcyon · page checked October 13, 2026 (lists activity through September 28, 2026) · halcyon.ai
  9. [9]
    Qilin ransomware: stats on attacks, ransoms, data breaches (opens in a new tab) Comparitech · updated October 23, 2025 · comparitech.com
  10. [10]
  11. [11]
  12. [12]
  13. [13]
    Microsoft: North Korean hackers now deploying Qilin ransomware (opens in a new tab) BleepingComputer, reporting Microsoft Threat Intelligence · March 7, 2025 · bleepingcomputer.com
  14. [14]
    Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations (advisory AA24-241A) (opens in a new tab) CISA, FBI and Department of Defense Cyber Crime Center · August 28, 2024 · cisa.gov
  15. [15]
  16. [16]
  17. [17]
    Qilin ransomware caught stealing credentials stored in Google Chrome (opens in a new tab) Sophos X-Ops · August 2024 (activity observed July 2024) · sophos.com
  18. [18]
    Critical Fortinet flaws now exploited in Qilin ransomware attacks (opens in a new tab) BleepingComputer, reporting PRODAFT · June 6, 2025 · bleepingcomputer.com
  19. [19]
  20. [20]
    NVD record for CVE-2025-31324 (SAP NetWeaver) (opens in a new tab) NIST National Vulnerability Database · checked October 13, 2026 · nvd.nist.gov
  21. [21]
    KB4424: CVE-2023-27532 (opens in a new tab) Veeam · checked October 13, 2026 · veeam.com
  22. [22]
  23. [23]
    Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) (opens in a new tab) Help Net Security, reporting Check Point's advisory · June 8, 2026 · helpnetsecurity.com
  24. [24]
    Patient Death Linked to NHS Cyber-Attack (opens in a new tab) Infosecurity Magazine · June 26, 2025 · infosecurity-magazine.com
  25. [25]
  26. [26]
  27. [27]
  28. [28]
  29. [29]
    Written ministerial statement HCWS1046 on cyber security (Synnovis cost and patient impact) (opens in a new tab) UK Parliament · November 12, 2025 · questions-statements.parliament.uk
  30. [30]
    Romania's oil pipeline operator Conpet confirms data stolen in attack (opens in a new tab) BleepingComputer · February 12, 2026 · bleepingcomputer.com
  31. [31]
    Decryption Tools (no Qilin or Agenda entry) (opens in a new tab) No More Ransom · checked October 13, 2026 · nomoreransom.org

The series: Qilin

2 parts

  1. Part 1 of 2 · read firstQilin still tops most ransomware counts
  2. Part 2 of 2 · you are readingQilin still hits hospitals and infrastructure

Z7 Weekly Intelligence

One email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • RW-03Ransomware group active

    LockBit 5.0 returns after Operation Cronos

    TakeawayPatch edge devices and protect hypervisors now.

    • 163 victims posted by LockBit in Q1 2026 (Check Point)
    • 7,000+ attacks built with LockBit services (NCA)
    • LockBit
    • Ransomware group
    • Business services
    PDF849 KB
  • RW-04Ransomware group active

    Akira still exploits SonicWall VPNs in 2026

    TakeawayPatch, reset VPN credentials, require MFA and watch failed logins.

    • $244.17M ransomware proceeds Akira had claimed as of late September 2025
    • 750 Akira leak-site claims in 2025 (ransomware.live)
    • Akira
    • Ransomware group
    • Manufacturing
    PDF884 KB
  • RW-05Ransomware group dormant

    ALPHV BlackCat dormant, Change breach 192.7M

    TakeawayRequire MFA on remote access and vet your vendors.

    • 192.7M people in the Change Healthcare breach, final estimate
    • $395.3M ALPHV/BlackCat ransom payments reported to FinCEN
    • ALPHV BlackCat
    • Ransomware group
    • Healthcare and health insurance
    PDF849 KB

Want this threat watched in your environment?

Talk to the team that runs the Z7 SOC about what this brief means for you. We will tell you what applies to your environment and what does not.

Talk to the SOCContact Z7 Call 844-974-8669
Ask Zeus AI assistant