Qilin
Qilin is a financially motivated ransomware-as-a-service (RaaS) group active since at least March 2022. Known aliases in the provided content include Agenda, Gold Feather, Qilin, Qilin Gang, Qilin Ransomware, Qilin Ransomware Gang, Qilin Ransomware Group, Qirin, and Water Galura. The group is described as having high scalability, with multiple personas including @Haise promoting Qilin on the RAMP forum. The content places Qilin within a broader ransomware ecosystem that includes affiliates, access brokers, and cooperation or overlap with other crews. Symantec, Carbon Black, and related reporting link the initial access broker Woodgnat, also known as KongTuke, to attacks involving Qilin; Woodgnat has been observed using ModeloRAT and Mistic to obtain and sell access to ransomware operators including Qilin. ModeloRAT was separately observed in attacks that deployed Qilin ransomware. The content also states that DragonForce attempted public cooperation with Qilin and LockBit, and that VX-Underground reported DragonForce, LockBit, and Qilin attempted to establish communication channels. Group-IB reported that Gentlemen was founded by hastalamuerte, described as a former Qilin affiliate. Qilin has broad victim reach. Black Kite’s 2026 European Cyber Risk Report states Qilin operated in 26 of 31 analyzed European countries, giving it the widest geographic reach among the ransomware groups covered. S2W ranked Qilin among the top five highest-risk ransomware groups in H1 2025 and reported that Qilin carried out the most attacks against government agencies in that period, with 12 cases. The content specifically identifies Qilin as highly active in healthcare. It states that Qilin remained one of the most active ransomware groups affecting the healthcare sector in June 2026. A notable incident attributed to Qilin was the June 2024 attack on Synnovis, in which the group targeted the company’s internal network and exfiltrated about 394.1 GB of sensitive patient data shared by several NHS foundation trusts for pathology testing. Reporting in the content states that more than 90,000 NHS patients’ records were affected and that the disruption impacted pathology, blood testing, and diagnostic services across multiple NHS organizations. Based on the provided content, Qilin should be characterized as a major ransomware operation with wide geographic reach, active affiliate or ecosystem relationships, and observed links to initial access brokers and tooling used to facilitate ransomware deployment.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
CVE-2026-50751 is a critical vulnerability (CVSS 9.3) in Check Point Remote Access VPN, Mobile Access, and Spark Firewall products using the deprecated IKEv1 key exchange protocol. The flaw is due to a logic error in certificate validation during the IKEv1 handshake that enables unauthenticated attackers to bypass user authentication entirely and initiate VPN connections.
Known Exploited Vulnerabilities: CVE-2023-27532 — Missing Authentication for Critical Function Vulnerability — Veeam Backup & Replication Cloud Connect — CVSS 7.5
Known Exploited Vulnerabilities: CVE-2024-21762 — Out-of-Bound Write Vulnerability — Fortinet FortiOS — CVSS 9.8
Known Exploited Vulnerabilities: CVE-2024-55591 — Authentication Bypass Vulnerability — Fortinet FortiOS — CVSS 9.8
13 февраля 2026 года CISA дала организациям три дня на устранение CVE-2026-1731 - pre-authentication RCE в BeyondTrust Remote Support с CVSS 9.9. Три дня. Эксплуатация шла в активных ransomware-кампаниях ещё до того, как большинство команд успели скачать патч...
Observables
30 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a downstream ransomware operation that may purchase access from Woodgnat.
Ransomware operations across Europe with the widest geographic reach among the groups covered in the report, operating across 26 of 31 analyzed countries.
Named as a ransomware crew that purchases or uses access brokered by KongTuke/Woodgnat.
Ransomware actor associated in this content with attacks where ModeloRAT was observed, suggesting use of brokered access or follow-on ransomware deployment.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.