Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Qilin still tops most ransomware counts after a suspected member's arrest

Qilin still leads most ransomware counts and kept listing victims after Japan detained a suspected leading member in May 2026. Affiliates also exploit VPN authentication flaws. Patch VPN gateways and require MFA first.

Download the PDF, 934 KB Talk to the SOC
Part 1 of 2 · Qilin

At a glance

RW-01 · Ransomware group

  • 165 Qilin incidents ZeroFox counted in August 2026, the highest 2026 monthly figure for any group[4]
  • 17 months consecutive months as the most active group in ZeroFox's count, through August 2026[4]
  • 2,367 leak-site listings since October 2022, as of October 13, 2026[25]
  • 478,188 patients in Covenant Health's revised count for its May 2025 breach, which Qilin claimed[17]
Status
Active. Qilin listed new victims as recently as October 13, 2026, and Ransomware.live counts 2,367 leak-site listings since October 2022.[25]
Also known as
Agenda; launched July 2022, rebranded to Qilin in September 2022[23]
Model
Ransomware-as-a-service; affiliates keep 80 to 85 percent of each ransom[8]
Initial access
Stolen VPN credentials where MFA is missing; in 2026, authentication bypasses in Palo Alto PAN-OS and Check Point VPN gateways[13]
Platforms
Windows, Linux and VMware ESXi; the Linux encryptor is also run on Windows through WSL[11]
Leak-site listings
2,367 listed since October 2022, as of October 13, 2026[25]
Law enforcement
Japan detained a suspected leading member in May 2026 and extradited him to Germany; the leak site kept listing victims[2]

What happened

Qilin, a Russian-speaking ransomware-as-a-service operation that launched as Agenda in 2022, was the most active ransomware group of 2025 by leak-site claims and still led most 2026 counts, though The Gentlemen passed it in some periods. Japan's National Police Agency confirmed on October 8, 2026 that a 28-year-old Russian national, reported as a suspected leading Qilin member, was detained in Osaka in May 2026 and extradited to Germany. Qilin kept listing victims afterward, and its affiliates kept exploiting edge-device flaws.

  • ZeroFox counted at least 165 Qilin incidents in August 2026, a 2026 high for any single group, and 1,480 from September 2025 through August 2026 against 767 for The Gentlemen, the next group.
  • NCC Group counted 1,073 ransomware victims in August 2026 and attributed 164 incidents to Qilin and 116 to The Gentlemen, and said the two groups have regularly traded places as the most prolific this year.
  • In 2026 Qilin-linked intrusions also used VPN authentication bypasses: Arctic Wolf tied June 2026 intrusions to Palo Alto PAN-OS CVE-2026-0257, and Check Point assessed with medium confidence that the actor exploiting its CVE-2026-50751 uses Qilin ransomware. CISA's catalog marks both flaws as used in ransomware campaigns, and ReliaQuest said in advisories posted October 9, 2026 that Qilin and Settra were still exploiting the Palo Alto flaw.
  • Healthcare stayed in scope: Covenant Health raised its count to 478,188 patients after a May 2025 breach claimed by Qilin, and Bedfordshire Hospitals NHS Foundation Trust notified patients on June 1, 2026 about data stolen in the 2024 Synnovis attack.
  • Qilin listed the US Bureau of Alcohol, Tobacco, Firearms and Explosives on August 26, 2026; the ATF said a standalone system holding information about targets of its investigations was breached and designated the incident major.
  • Reports say Germany wants the extradited suspect over a September 2024 attack on a logistics company in which more than $160,000 in cryptocurrency was extorted. No conviction has been reported, and Japan did not release his name.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Get in through the VPN

    MITRE ATT&CK T1133 (opens in a new tab)

    Affiliates log in with stolen or leaked VPN credentials, including on portals without MFA, or exploit authentication-bypass flaws in Palo Alto GlobalProtect and Check Point remote access gateways to open sessions without a password.

  2. Steal credentials across the domain

    MITRE ATT&CK T1003 (opens in a new tab)

    Operators dump LSASS memory and the Active Directory database (Arctic Wolf, 2026), and have pushed a Group Policy logon script that harvests passwords saved in Chrome on the machines that run it (Sophos, 2024).

  3. Plant redundant remote access

    MITRE ATT&CK T1219 (opens in a new tab)

    AnyDesk, Ngrok, LogMeIn and MeshAgent (Arctic Wolf, 2026) and ScreenConnect (Talos and Trend Micro, 2025) give the intruder more than one way back in; registry Run keys and scheduled tasks keep it.

  4. Exfiltrate before encrypting

    MITRE ATT&CK T1567.002 (opens in a new tab)

    Rclone, FileZilla and Proton Drive (Arctic Wolf) and Cyberduck (Talos) move data to cloud storage such as MEGA, though some intrusions skipped data theft and only encrypted.

  5. Blind defenses and kill recovery

    MITRE ATT&CK T1685 (opens in a new tab)

    Vulnerable signed drivers such as eskle.sys terminate EDR, event logs are cleared, shadow copies are deleted and Defender real-time protection is switched off in some cases. Veeam backup infrastructure is attacked before encryption: Trend Micro saw credentials harvested from backup databases, and Arctic Wolf saw it targeted to remove recovery options.

  6. Encrypt and extort

    MITRE ATT&CK T1486 (opens in a new tab)

    Encryptors target Windows, Linux and ESXi, and some affiliates run the Linux build on Windows through WSL to dodge Windows-focused EDR. Talos measured ransomware execution about six days on average after initial compromise across its Qilin cases.

Who is at risk

Any organization that exposes a VPN or remote access gateway and runs Windows, Linux or VMware estates is in the target set. Qilin disproportionately hits North America and has repeatedly listed hospitals and government agencies.

  • Manufacturers, construction firms, professional services and retailers, the top sectors in ZeroFox's count.
  • Healthcare providers and their diagnostic vendors: the 2024 Synnovis pathology attack contributed to the death of a patient, per a UK government statement, and Covenant Health was still revising its Qilin-claimed breach count in January 2026.
  • State and local agencies, courts and school districts: Comparitech logged 40 government and 26 education claims for 2025 through October 23.
  • Managed service providers and their clients: Bitdefender's most probable explanation for the Korean Leaks campaign is a compromise of an upstream IT provider, with 33 South Korean victims, mostly asset managers.
  • Organizations running unpatched Palo Alto, Check Point or Fortinet VPN appliances, or any VPN without MFA.

Sectors in scope

  • Manufacturing
  • Construction
  • Professional services
  • Retail
  • Healthcare
  • Government
  • Education
  • Financial services
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. A suspected leading member was arrested: Japan's National Police Agency confirmed on October 8, 2026 that a 28-year-old Russian national, described by BleepingComputer as suspected of being a leading Qilin member, was detained at an Osaka hotel in May 2026 on a German arrest warrant and extradited to Germany. SecurityWeek says Germany wants him over a September 2024 attack on a logistics company. BleepingComputer reports Qilin has listed more than 450 victims since June.

    Source 1

  2. Volume stayed high: ZeroFox counted 190 Qilin incidents in October 2025, 179 in December 2025 and 165 in August 2026, the highest figure of 2026 for any group, and 1,480 from September 2025 through August 2026 against 767 for The Gentlemen.

    Source 4

  3. Leadership became contested: ReliaQuest counted The Gentlemen ahead of Qilin, 300 to 289, from March to May 2026, and Check Point has The Gentlemen outpacing Qilin in June 2026 even though Qilin led the quarter with 279 victims to 269. ZeroFox and NCC Group still show Qilin first in August 2026.

    Source 22

  4. Palo Alto VPN flaw: Arctic Wolf traced multiple June 2026 Qilin intrusions to PAN-OS CVE-2026-0257, an authentication bypass in GlobalProtect that let attackers open VPN sessions without credentials.

    Source 13

  5. Check Point VPN zero-day: Check Point said CVE-2026-50751 was exploited from at least May 7, 2026, about a month before its June 8 advisory and hotfixes, against a few dozen organizations, and assessed with medium confidence that the actor behind it uses Qilin ransomware. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8 with ransomware use marked Known.

    Source 39

  6. A US federal law enforcement agency was hit: Qilin listed the ATF on August 26, 2026, and the ATF said a standalone system containing information about targets of its investigations was breached. It designated the incident major and is investigating with the Department of Justice.

    Source 19

  7. Healthcare harm continued: Covenant Health revised the count for its May 2025 breach, which Qilin claimed in June 2025, from 7,864 to 478,188 patients and began mailing notification letters on December 31, 2025.

    Source 17

  8. Talos's April 2026 analysis found ransomware execution about six days after initial compromise on average across its Qilin cases, stolen credentials as Qilin's main way in (obtained through Telegram, BreachForums and other platforms), and an affiliate EDR killer able to disable more than 300 EDR drivers.

    Source 10

What to do now

In priority order, highest impact first.

  1. Do firstPatch and audit every VPN gateway now: Check Point CVE-2026-50751 (hotfix per sk185033; disable IKEv1 and legacy clients), Palo Alto PAN-OS CVE-2026-0257 (then terminate active GlobalProtect sessions), and any other exposed VPN such as Fortinet SSL-VPN.

    Both flaws are authentication bypasses linked to Qilin, and Arctic Wolf and Rapid7 advise ending existing sessions and hunting for compromise even after patching.

  2. Require phishing-resistant MFA on VPN, RDP and every remote management tool, and remove local VPN accounts.

    In the Sophos case and one Talos case, attackers used compromised credentials on a VPN portal that had no MFA.

  3. Disable browser password storage by policy and move staff to an enterprise password manager.

    Qilin has used a Group Policy logon script that harvests passwords saved in Chrome from every machine that runs it.

  4. Turn on the Microsoft vulnerable driver blocklist and alert on driver loads, Defender tamper events and event-log clearing (Event ID 1102).

    Affiliates load signed vulnerable drivers to kill EDR before encrypting.

  5. Keep immutable, offline backups and lock down Veeam: separate credentials, MFA on the console, and no domain-joined backup servers.

    Trend Micro saw Qilin harvest credentials from Veeam backup databases, and Arctic Wolf saw Veeam backup infrastructure targeted before the ransomware ran.

  6. Block or alert on unsanctioned AnyDesk, ScreenConnect, Ngrok, LogMeIn, MeshAgent, Rclone, Cyberduck and MEGA traffic.

    These tools carried Qilin remote access and exfiltration in the 2025 and 2026 cases.

  7. Monitor WSL installation and Linux ELF execution on Windows servers, and alert on writes to C:\PerfLogs and on PsExec service creation.

    Qilin runs its Linux encryptor inside WSL and stages win.exe in PerfLogs to slip past Windows-only detections.

  8. If nobody is watching VPN logs and driver loads overnight, Z7's 24/7 SOC and Microsoft 365 posture review are built for that gap.

    Talos measured ransomware execution about six days after initial compromise on average, which leaves time to catch the earlier steps if someone is watching.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
behavior GlobalProtect VPN sessions from client hostname kali, often from hosting or VPS address ranges [13]
file C:\PerfLogs\win.exe (Qilin payload staging path; also \\host\c$\Windows\Temp\win.exe) [13]
registry Run key value named with an asterisk followed by six random lowercase letters, pointing to C:\PerfLogs\win.exe [13]
ip 108.61.229[.]217 [13]
ip 108.61.75[.]232 [13]
ip 2.188.33[.]52 [13]
ip 199.247.22[.]193 [13]
ip 70.34.205[.]43 [13]
file eskle.sys vulnerable signed driver, followed by sideloaded rwdrv.sys and hlpdrv.sys [11]
behavior Linux ELF encryptor copied with WinSCP and launched through Splashtop SRManager.exe inside WSL on a Windows host [11]
file IPScanner.ps1 and logon.bat deployed from a SYSVOL directory by a logon GPO; per-host LD SQLite database and temp.log written back to SYSVOL [35]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    Japan confirms arrest of Russian Qilin operative, extradition to Germany (opens in a new tab) The Record (Recorded Future News), reporting Japan's National Police Agency release · October 9, 2026 · therecord.media
  2. [2]
    Germany arrests alleged core Qilin ransomware member after extradition (opens in a new tab) BleepingComputer · October 9, 2026 · bleepingcomputer.com
  3. [3]
  4. [4]
  5. [5]
    Ransomware Attacks Reach Record High for 2026 (opens in a new tab) Infosecurity Magazine, reporting NCC Group's August 2026 Cyber Threat Intelligence Report · September 23, 2026 · infosecurity-magazine.com
  6. [6]
    Qilin ransomware surges into 2026 (opens in a new tab) Barracuda Networks · January 15, 2026 · blog.barracuda.com
  7. [7]
    Qilin ransomware: stats on attacks, ransoms, data breaches (opens in a new tab) Comparitech · updated October 23, 2025 · comparitech.com
  8. [8]
    The State of Ransomware, Q3 2025 (opens in a new tab) Check Point Research · November 13, 2025 · research.checkpoint.com
  9. [9]
    Uncovering Qilin attack methods exposed through multiple cases (opens in a new tab) Cisco Talos · October 26, 2025 · blog.talosintelligence.com
  10. [10]
  11. [11]
    Qilin ransomware abuses WSL to run Linux encryptors in Windows (opens in a new tab) BleepingComputer, reporting Trend Micro research · October 28, 2025 · bleepingcomputer.com
  12. [12]
    Qilin Ransomware Combines Linux Payload with BYOVD Exploit in Hybrid Attack (opens in a new tab) The Hacker News, reporting Trend Micro research · October 27, 2025 · thehackernews.com
  13. [13]
  14. [14]
    Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) (opens in a new tab) Help Net Security, reporting Check Point's advisory · June 8, 2026 · helpnetsecurity.com
  15. [15]
    Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751) (opens in a new tab) Rapid7 · June 8, 2026, updated June 11, 2026 · rapid7.com
  16. [16]
  17. [17]
    Covenant Health says May data breach impacted nearly 478,000 patients (opens in a new tab) BleepingComputer, reporting Covenant Health's Maine Attorney General notice · January 2, 2026 · bleepingcomputer.com
  18. [18]
    ATF confirms major incident after recent Qilin breach claims (opens in a new tab) BleepingComputer, reporting the ATF press release · August 27, 2026 · bleepingcomputer.com
  19. [19]
  20. [20]
    Asahi says ransomware incident exposed data of about 1.5 million customers (opens in a new tab) The Record (Recorded Future News), reporting Asahi Group's disclosure · November 28, 2025 · therecord.media
  21. [21]
    FBI Takes Down RAMP Ransomware Forum (opens in a new tab) Infosecurity Magazine · January 29, 2026 · infosecurity-magazine.com
  22. [22]
    The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat (opens in a new tab) Infosecurity Magazine, reporting ReliaQuest research · July 17, 2026 · infosecurity-magazine.com
  23. [23]
    Qilin threat group profile (opens in a new tab) Halcyon · updated August 25, 2026 · halcyon.ai
  24. [24]
    21 months, $100 million, one Qilin suspect in custody (opens in a new tab) Barracuda Networks · October 13, 2026 · blog.barracuda.com
  25. [25]
    Qilin group page, victim listings (opens in a new tab) Ransomware.live · checked October 13, 2026 · ransomware.live
  26. [26]
    Written ministerial statement HCWS1046 on cyber security (Synnovis cost and patient impact) (opens in a new tab) UK Parliament · November 12, 2025 · questions-statements.parliament.uk
  27. [27]
    Synnovis Cyber Incident (opens in a new tab) Portsmouth Hospitals University NHS Trust · December 2025 entries · porthosp.nhs.uk
  28. [28]
  29. [29]
    Summer 2025 update (amber alert on blood stocks stood down) (opens in a new tab) NHS Blood and Transplant · Summer 2025 · blood.co.uk
  30. [30]
    UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026 (opens in a new tab) BushidoToken (Will Thomas), citing Bedfordshire Hospitals NHS Foundation Trust · August 5, 2026 · blog.bushidotoken.net
  31. [31]
    Drug R&D Firm Facing Costs, Lawsuits in Alleged Qilin Attack (opens in a new tab) GovInfoSecurity (ISMG), reporting Inotiv's SEC filings and Maine AG notice · December 10, 2025 · govinfosecurity.com
  32. [32]
  33. [33]
    Microsoft: North Korean hackers now deploying Qilin ransomware (opens in a new tab) BleepingComputer, reporting Microsoft Threat Intelligence · March 7, 2025 · bleepingcomputer.com
  34. [34]
  35. [35]
    Qilin ransomware caught stealing credentials stored in Google Chrome (opens in a new tab) Sophos X-Ops · August 2024 (activity observed July 2024) · sophos.com
  36. [36]
    Qilin ransomware gang hits hundreds of orgs in 2025 (opens in a new tab) The Record (Recorded Future News), reporting Comparitech and Cisco Talos · October 28, 2025 · therecord.media
  37. [37]
    Qilin Ransomware Group Publishes Over 40 Cases Monthly (opens in a new tab) Infosecurity Magazine, reporting Cisco Talos · October 27, 2025 · infosecurity-magazine.com
  38. [38]
    Decryption Tools (no Qilin or Agenda entry) (opens in a new tab) No More Ransom · checked October 13, 2026 · nomoreransom.org
  39. [39]
  40. [40]
    Q3 2026 Sets New Record for Ransomware Attacks (opens in a new tab) Infosecurity Magazine, reporting Comparitech's Q3 2026 analysis · October 9, 2026 · infosecurity-magazine.com
  41. [41]
    The State of Ransomware Q2 2026 (opens in a new tab) Check Point Research · August 13, 2026 · research.checkpoint.com
  42. [42]
    The State of Ransomware Q1 2026 (opens in a new tab) Check Point Research · May 11, 2026 · research.checkpoint.com
  43. [43]
    Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups (opens in a new tab) Infosecurity Magazine, reporting ReliaQuest · October 12, 2026 · infosecurity-magazine.com
  44. [44]
    Notification, Synnovis Cyber Incident (opens in a new tab) Bedfordshire Hospitals NHS Foundation Trust · June 1, 2026 · bedfordshirehospitals.nhs.uk

The series: Qilin

2 parts

  1. Part 1 of 2 · you are readingQilin still tops most ransomware counts
  2. Part 2 of 2 · read nextQilin still hits hospitals and infrastructure

Z7 Weekly Intelligence

One email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • RW-03Ransomware group active

    LockBit 5.0 returns after Operation Cronos

    TakeawayPatch edge devices and protect hypervisors now.

    • 163 victims posted by LockBit in Q1 2026 (Check Point)
    • 7,000+ attacks built with LockBit services (NCA)
    • LockBit
    • Ransomware group
    • Business services
    PDF849 KB
  • RW-04Ransomware group active

    Akira still exploits SonicWall VPNs in 2026

    TakeawayPatch, reset VPN credentials, require MFA and watch failed logins.

    • $244.17M ransomware proceeds Akira had claimed as of late September 2025
    • 750 Akira leak-site claims in 2025 (ransomware.live)
    • Akira
    • Ransomware group
    • Manufacturing
    PDF884 KB
  • RW-05Ransomware group dormant

    ALPHV BlackCat dormant, Change breach 192.7M

    TakeawayRequire MFA on remote access and vet your vendors.

    • 192.7M people in the Change Healthcare breach, final estimate
    • $395.3M ALPHV/BlackCat ransom payments reported to FinCEN
    • ALPHV BlackCat
    • Ransomware group
    • Healthcare and health insurance
    PDF849 KB

Want this threat watched in your environment?

Talk to the team that runs the Z7 SOC about what this brief means for you. We will tell you what applies to your environment and what does not.

Talk to the SOCContact Z7 Call 844-974-8669
Ask Zeus AI assistant