File · qilin · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
qilin
sigil · no ATT&CK coverage stated
Last 30 days
last seen today- seen against
- United States · Japan · Spain · Thailand · United Kingdom
- sectors
- Manufacturing · Not Found · Technology · Agriculture and Food Production · Financial Services
What changed
ledger · newest first- —17 d agovictimsvictim count 346 → 365 (+19)
- —24 d agovictimsvictim count 320 → 346 (+26)
- —1 mo agovictimsvictim count 307 → 320 (+13)
- —1 mo agonew CVE1 new CVE: CVE-2026-20079
- —1 mo agovictimsvictim count 305 → 307 (+2)
- —1 mo agonew CVE1 new CVE: CVE-2026-0257
Analyst brief
ransomware.liveQilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Observed targets (as stated by the sources)
44 countries · 14 sectorsassessed originnot stated by sourcesobserved targets · 44
countries · 44
- United States
- Germany
- United Kingdom
- Italy
- Canada
- France
- Spain
- Australia
- Japan
- Mexico
- Argentina
- Chile
- Philippines
- Thailand
- Romania
- Ireland
- Finland
- Türkiye
- Singapore
- Malaysia
- Netherlands
- Belgium
- Austria
- Trinidad and Tobago
- +20
sectors · 14
- Manufacturing
- Not Found
- Technology
- Other
- Professional Services
- Financial Services
- Transportation
- Retail & E-Commerce
- Energy & Utilities
- Agriculture and Food Production
- Education
- Hospitality
- Healthcare
- Government & Defense
as stated by MISP galaxy / ransomware.live — not inferred
CVEs cited sources tie to qilin
1 on CISA KEV- CVE-2026-20079KEVEPSS 75% · 2026-09-11
“Qilin Ransomware Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attac … ting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079”
attributed by a report · named nearby · source: our dispatch · 2026-09-11
- CVE-2026-02572026-10-17
“Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware”
cited as exploiting · source: arcticwolf.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 252 | ≈ 63.0 / month | above the lifetime rate 67 |
- Victims observed
- 252
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 63.0 / month
- Last 30 days
- above the lifetime rate 67
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
On the wire
3 dispatches · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack qilin on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.