Ransomware Intelligence / Groups / qilin
Ransomware group
qilin
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
- 29claims, 7 days
- 128claims, 30 days
- 352claims, 90 days
- 2026-03-31first seen
- 2026-11-03last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
In the news
Recent stories in the security press that name qilin, newest first.
- Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
- Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
- Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
- ATF confirms cyberattack hit system containing info on its investigation targets
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Sectors claimed, last 90 days
- Manufacturing 59
- Professional services 54
- Unclassified 46
- Construction 25
- Retail 24
- Financial services 20
- Critical infrastructure 18
- Transportation and logistics 18
- Other 17
- Technology 17
- Healthcare 16
- Government 10
- Hospitality 8
- K-12 education 6
- Higher education 5
- Media and entertainment 5
- Nonprofit 4
Countries claimed, last 90 days
- United States 93
- Germany 25
- Spain 20
- United Kingdom 20
- Italy 16
- Mexico 16
- Unknown 12
- Argentina 11
- Canada 11
- Australia 10
- France 10
- Japan 10
- Chile 8
- Philippines 6
- Malaysia 5
Vulnerabilities qilin exploits
CVEs attributed to qilin by Ransomware.live, most severe first. Patch these first if this group is in your threat model.
| CVE | Vendor / product | CVSS | CISA KEV |
|---|---|---|---|
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) | 10.0 Critical | Listed 2026-09-09 |
| CVE-2025-31324 | SAP NetWeaver Visual Composer | 10.0 Critical | Listed 2025-04-29, ransomware use |
| CVE-2026-24423 | SmarterTools SmarterMail | 9.8 Critical | Listed 2026-02-05, ransomware use |
| CVE-2026-24061 | Telnet Telnetd in GNU Inetutils | 9.8 Critical | Listed 2026-01-26 |
| CVE-2025-9242 | WatchGuard WatchGuard Fireware OS | 9.8 Critical | Listed 2025-11-12 |
| CVE-2025-60021 | Apache Apache bRPC | 9.8 Critical | Not listed |
| CVE-2025-59718 | Fortinet FortiOS | 9.8 Critical | Listed 2025-12-16 |
| CVE-2025-40554 | SolarWinds SolarWinds Web Help Desk | 9.8 Critical | Not listed |
| CVE-2025-14733 | WatchGuard WatchGuard Fireware OS | 9.8 Critical | Listed 2025-12-19, ransomware use |
| CVE-2024-55591 | Fortinet FortiOS & FortiProxy | 9.8 Critical | Listed 2025-01-14, ransomware use |
| CVE-2024-21762 | Fortinet FortiOS & FortiProxy | 9.8 Critical | Listed 2024-02-09, ransomware use |
| CVE-2026-50751 | Check Point VPN Remote Access and Mobile Access | 9.3 Critical | Listed 2026-06-08, ransomware use |
| CVE-2026-0257 | Palo Alto Networks Cloud NGFW | 7.8 High | Listed 2026-05-29, ransomware use |
| CVE-2023-27532 | Veeam Backup & Replication | 7.5 High | Listed 2023-08-22, ransomware use |
| CVE-2026-50752 | Check Point Quantum Security Gateway | 7.4 High | Not listed |
| CVE-2024-1853 | Zemana Zemana AntiLogger | 5.5 Medium | Not listed |
| CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | 5.3 Medium | Listed 2026-07-29, ransomware use |
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Tactics and techniques
MITRE ATT&CK techniques reported for qilin by Ransomware.live, in attack order.
Remote encryption risk. The techniques reported for qilin include encrypting data (T1486) and spreading over SMB / Windows admin shares (T1021.002): the building blocks of remote encryption, where files on protected servers are encrypted over the network from a device the attacker controls.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
-
- Obfuscated Files or Information
- Masquerading: Invalid Code Signature
- Access Token Manipulation: Parent PID Spoofing
- Exploitation for Defense Evasion
- Execution Guardrails
- Virtualization/Sandbox Evasion: System Checks
- Subvert Trust Controls: Code Signing
- Disable or Modify Tools
- Impair Defenses: Disable or Modify System Firewall
- Hidden Artifacts
- Hidden Artifacts: Hidden Window
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Track qilin in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology