Exclusive: World's top ransomware group claims two more Aussie victims

The Qilin ransomware group recently listed the Zig Inge Group and Reddrop Group; however, details of each alleged hack are scant.

The Qilin ransomware-as-a-service operation is claiming to have picked up two more Australian victims: the Reddrop Group grocery store collective and the Zig Inge Group, which operates the Prospect Hill Camberwell retirement community.

Reddrop was listed in a 16 September leak post and Zig Inge a week later, on the 24th.

In both cases, the ransomware affiliate making the claim has declined to any further data. The scope of the alleged breaches remains unknown and the hackers have not shared any evidentiary data.

Similarly, no deadline for publication has been shared.

Neither the Reddrop Group nor the Zig Inge Group responded to Cyber Daily’s request for .

Qilin is the most active ransomware operation in the world at the moment, averaging 100 victim listings each month so far this year. Since it was first observed in 2022, the group has notched up 2,323 victims.

The group operates under a ransomware-as-a-service model, with affiliates gaining access to its ransomware infrastructure in return for a cut of any ransom payments. Networking giant Cisco recently warned of Qilin activity targeting a vulnerability in its Secure Firewall Management Center software.

Talos observed activity exploiting CVE-2026-20316 to log onto an FMC device with static credentials before the threat actor undertook network reconnaissance, credential theft and established a list of endpoints for encryption.

“The threat actor also staged a SOCKS proxy and reverse-SSH tunnel to forward ports from internal hosts back to their own infrastructure,” Talos said at the time .

“Once all these preliminary actions were completed, the operator began conducting additional probes within the compromised network, deploying antivirus (AV) killers and ultimately the Qilin ransomware family.”

The group’s most recent Australian victim was the not-for-profit Thorndale Foundation, which confirmed it was investigating an incident earlier in September .

Who is the Reddrop Group?

Based in Alexandra, Victoria, the Reddrop Group employs more than 1,300 people and operates 27 supermarkets under several brands, including Foodworks and IGA franchises.

Who is the Zig Inge Group?

The Zig Inge Group describes itself as “family-owned, diversified investment business built on the values of quality, innovation, and integrity”.

Alongside the Palisade Group, Zig Inge operates IPLiving, which in turn operates three Victorian retirement villages: Prospect Hill Village, Pinetree Donvale, and Richfield Village.

Prospect Hill, in the suburb of Camberwell, was specifically mentioned by Qilin in its leak post.

David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.