qilin

November 1, 2026

• Qilin listed Community Medical Center in Falls City, Nebraska after the critical-access hospital disclosed an intrusion over the Oct 17–18 weekend; staff reverted to paper, appointments slipped, and ambulances diverted critical patients because imaging could not reach radiologists (DailyDarkWeb). DarkFeed's 2026 leak-site tally puts Qilin first with 1,131 claimed victims, ahead of The Gentleman (929) and Akira (418). · Nov 1 · observed · Threat Activity

Oct 12 – October 21, 2026 · 2 reports

• Qilin and INC ransomware operators continue exploiting PAN-OS CVE-2026-0257. The May-patched authentication bypass lets attackers establish unauthorized GlobalProtect VPN sessions and bypass MFA. Observed follow-on activity includes RMM-based reconnaissance, RDP and SMB lateral movement, and direct pivots into vCenter/ESXi; in one case, operators disabled execInstalledOnly and dumped domain credentials offline from a domain controller’s VMDK, evading in-guest EDR controls, according to The Hacker News. · Oct 21 · observed · via exposed service · as inc · Vulnerabilities & Exploits
• Ransomware crews are exploiting CVE-2026-0257 for unauthorized GlobalProtect access. Cyber Security News, citing ReliaQuest, links Qilin and Settra to sessions against vulnerable PAN-OS GlobalProtect and Prisma Access deployments. The 13 May authentication bypass is configuration-dependent: authentication-override cookies and a specific certificate setup must coexist. Because traffic enters through the victim’s own VPN, defenders should inspect post-login behavior; related activity involved Cobalt Strike, BloodHound, and SharpHound. Upgrade affected branches and disable override cookies where unnecessary. · Oct 12 · observed · as settra · Vulnerabilities & Exploits

October 11, 2026

• Germany arrested a Russian national suspected of being a core Qilin member after extradition from Japan, where he was detained in May at an Osaka hotel while travelling as a tourist. Japan's National Police Agency has now officially confirmed the extradition. Qilin has hit more than 2,350 known organisations across 62 countries and has listed over 450 victims on its leak site since June — the arrest did not slow it. BleepingComputer · Oct 11 · observed · Law Enforcement & Industry

Oct 7 – October 10, 2026 · 2 reports

• Japan's NPA confirmed the Qilin extradition timeline: a 28-year-old Russian national was detained at an Osaka hotel in May after officials learned he planned a holiday in Japan, and handed to Germany in June over an attack on a German company (The Record; earlier coverage). Qilin's leak-site output continues regardless — FalconFeeds reported Finnish electronics manufacturer TEPCOMP listed on 9 October. · Oct 10 · observed · Ransomware & Law Enforcement
• Japan extradited a suspected core Qilin member to Germany. Japanese police located and detained a Russian national wanted by German authorities over a ransomware attack on a German company and handed him over at Germany's request. Qilin claimed the 2025 Asahi Group outage; Japan's NPA logged 123 ransomware attacks in H1 2026, a half-year record (The Japan Times). · Oct 7 · observed · Ransomware & Law Enforcement

September 21, 2026

• Qilin added four victims to its leak site on 20 September: Turkish conglomerate Zorlu Holding, Vietnamese Apple reseller ShopDunk, German building-services firm KMLS, and Touring Club Suisse — the Swiss mobility club with 1.65 million members and ~2,200 staff (Dark Web Informer, ransomware.live). No initial-access vector, ransom demand or data volume has been published for either listing; the Zorlu entry carries Hudson Rock infostealer telemetry (69 compromised employees, 101 users, 223 third-party credentials) with no evidence linking those credentials to the intrusion. · Sep 21 · claimed · Threat Activity

Jul 31 – September 11, 2026

• Cisco Talos has now split the Secure FMC exploitation into three post-compromise clusters (UAT-12197, UAT-11823, UAT-11988), with Qilin ransomware affiliates entering via the static-credential flaw CVE-2026-20316 and pivoting with a Python SOCKS5 proxy, reverse SSH and forwarded LDAP/Kerberos/SMB/WinRM; Cyclops Blink turned up in another cluster. Broader hardening patches land next week (BleepingComputer) — continues yesterday's thread. · Sep 11 · observed · as cyclops blink · Exploitation in the Wild

Aug 27 – September 4, 2026 · 4 reports

• ShinyHunters started publishing data after its extortion deadlines lapsed, marking McKesson (321GB+ compressed), Neogen (313GB+, claimed 5M+ Salesforce records), Swedish medtech Elekta AB and Jack Henry & Associates for download (Daily Dark Web, Dark Web Informer). Separately, Qilin is extorting the US ATF (vx-underground), following ATF's own "major incident" confirmation (earlier coverage). · Sep 4 · observed · as shinyhunters · Threat Activity
• Qilin briefly published 6.3 GB of data stolen from the US ATF after a 72-hour countdown expired, reportedly including criminal investigation target names, phone numbers, IP addresses, iCloud data and Cellebrite phone dumps, per Gun Owners of America (earlier coverage). · Sep 1 · observed · Threat Activity
• ATF confirmed a "major incident" following Qilin's claims (earlier coverage), saying the compromised system is standalone, eForms was unaffected, and connections to the environment were terminated (BleepingComputer). · Aug 28 · claimed · Breaches & Incidents
• Qilin listed the US Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site with no claimed data volume or file listing (Dark Web Informer). ATF has confirmed a "major incident" and says it terminated connections to the affected environment, while denying that registration systems including NFA eForms were touched (Gun Owners of America). · Aug 27 · claimed · Threat Activity

August 31, 2026

• Leak-site activity: DireWolf listed Austrian publisher THQ Nordic (claimed 335 GB) alongside hospitals in Türkiye and Chile (DarkWebInformer, FalconFeeds). A new group, ZaWoo, appeared with its own onion portal and initial victims (DarkWebInformer). Qilin led August volume with roughly 160 posted victims by DarkFeed's count, with fresh listings including a UK consultancy and a US biotech (FalconFeeds). · Aug 31 · claimed · as direwolf, zawoo · Threat Activity

August 24, 2026

• Leak-site churn over the weekend: Qilin added Black Cat Engineering (Qatar), Difor Chile and Clear Align (FalconFeeds), plus Italian victims Euroflora and Studio Boldrin (FalconFeeds); Metaencryptor listed Factory Five Racing and Corona Corporation (FalconFeeds). · Aug 24 · claimed · as metaencryptor · Threat Activity & Cybercrime

Jun 17 – July 22, 2026 · 4 reports

• Qilin (Agenda) ransomware is exploiting Palo Alto PAN-OS auth bypass CVE-2026-0257 (CVSS 7.8) for initial access. Arctic Wolf investigated multiple June intrusions through the GlobalProtect portal/gateway flaw, followed by credential theft, lateral movement, and distinctive persistence before ransomware deployment. The Hacker News, Arctic Wolf. · Jul 22 · observed · Threat Activity
• Ransomware roundup: Qilin claimed eight new victims including a Bay Area private school and a Mississippi catfish processor (DarkWebInformer); The Gentlemen listed Colombian oil-and-gas firm Ecopetrol and the U.S. Navy's Military Sealift Command (FalconFeeds); LockBit 5.0 added six victims across India, Singapore, Argentina and the UK (FalconFeeds). · Jul 19 · claimed · as the gentlemen, lockbit · Threat Activity
• Unit 42 profiled The Gentlemen, a high-tempo RaaS operation evolved from Qilin that leans on sophisticated tooling and zero-day exploits; the group's leak site claimed 18 new victims across construction, finance, pharma, and physical-security sectors worldwide. Unit 42, Dark Web Informer · Jul 12 · claimed · as the gentlemen · Threat Activity
• Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen · Jul 11 · none · as the gentlemen, akira, inc, dragonforce · Threat Intelligence

July 20, 2026

• Qilin added 14+ new victims across the US, France, Italy, Peru, Argentina and beyond over two days, spanning food producers, a school, ambulance and air-navigation services (FalconFeedsio). · Jul 20 · claimed · Threat Activity

June 30, 2026

• Qilin kept up a high publishing tempo, adding victims across Japan, Thailand, the US, France, Peru and Germany to its leak site. FalconFeeds · Jun 30 · observed · Threat Activity

June 29, 2026

• Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer) · Jun 29 · observed · as safepay, ralord, settra, redact, play · Threat Activity

Jun 19 – June 25, 2026 · 2 reports

• Mistic, a stealthy new RAT, is the entry point for initial-access broker Woodgnat (aka KongTuke), who feeds ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, hitting insurance, education, IT, and professional-services targets. BleepingComputer, SecurityWeek · Jun 25 · observed · as woodgnat, kongtuke, interlock, rhysida, akira, 8base, black basta · Threat Intelligence
• INC has grown into one of 2026's most prolific RaaS operations with 830+ victims since August 2023, absorbing affiliates after the LockBit and BlackCat disruptions (The Hacker News). Current leaderboard tracking puts Qilin at 651 attacks, The Gentlemen at 430, and Akira at 282 (DarkFeed). · Jun 21 · observed · as inc, the gentlemen, akira · Ransomware & EDR Evasion

June 22, 2026

• Qilin named a Taiwanese machinery maker, a Bangkok hotel, and a US lighting distributor; LockBit 5.0 posted four new victims across Italy, the Dominican Republic, the US, and Vietnam. Qilin, LockBit. · Jun 22 · claimed · as lockbit · Ransomware & Hacktivism