Skip to content
Leak site of qilin, captured by ThreatCluster

qilin

Active

25 tracked victims · First seen Oct 8, 2022 · Last seen Oct 17, 2026

About

Written by ThreatCluster from 111 stories

Qilin is a ransomware group that encrypts victim data to extort payments and has been observed gaining access by exploiting a Palo Alto VPN vulnerability to create unauthorized VPN sessions. Victims total more than 2,000, with hits across sectors including Healthcare, Manufacturing, Technology, Business Services, and Financial Services, and in the United States, Canada, France, the United Kingdom, and Germany. Recent reporting shows a pattern of disruptive attacks on healthcare and cross-border operations, exemplified by the UK Synnovis attack that disrupted services across hospitals in June 2024 and was linked to a patient's death. A key individual linked to Qilin was extradited to Germany; he is suspected of extorting $165,000 in Bitcoin from a German logistics company after encrypting its data in September 2024.

Sectors: Manufacturing, Business Services, Technology · Countries: US, CA, FR

Recent victims

View all →
VictimSectorCountryFilesViewsPostedStatus
WalkingTree Technologies
alkingtree.tech
Business ServicesIN——Oct 19, 2026published
SkyWorld Air Cargo
skyworldaircargo.com
Business ServicesAE——Oct 19, 2026published
Johnson & Pace
johnsonpace.com
Architecture, Engineering & DesignGB——Oct 19, 2026published
Dental Team FL
dentalteamfl.com
Healthcare ServicesUS——Oct 19, 2026published
Grupo Cronica
grupocronica.com.ar
Business ServicesAR——Oct 16, 2026countdown
Salauno
salauno.com.mx
Not FoundMX——Oct 19, 2026published
CREDIN
credin.pt
Food & BeveragePT——Oct 19, 2026published
Belcorp
belcorp.biz
Business ServicesPE—346Oct 18, 2026countdown
Llano Independent School District
llanoisd.org
EducationUS—868Oct 18, 2026countdown
BRUTRA Logistek
brutra-logistiek.nl
Business ServicesNL——Oct 18, 2026published
Pengurusan Aset Air Berhad
paab.my
Energy, Utilities & WasteMY——Oct 18, 2026published
Pergande
www.pergande.de
Industrial Machinery & EquipmentDE—28Oct 18, 2026published
Mastelli S.r.l.
mastelli.com
Healthcare ServicesIT—27Oct 18, 2026published
First Brothers Co., Ltd
firstbrothers.com
Business ServicesTH——Oct 17, 2026countdown
Via Credit Union
viacu.org
BankingUS——Oct 16, 2026published
Keio CorporationBusiness ServicesJP——Oct 15, 2026countdown
Kemlows Diecasting Products Limited
kemlows.co.uk
Business ServicesGB——Oct 15, 2026countdown
Telcoe Federal Credit Union
telcoe.com
BankingUS303,108Oct 15, 2026published
Segres Systec
segres.com
Office Products Retail & DistributionES——Oct 15, 2026countdown
Shield Wall Systems of Florida
shieldwsfl.com
Business ServicesUS17—Oct 15, 2026countdown
The Excalibur Group
theexcalibur-group.com
Business ServicesUS——Oct 15, 2026countdown
KD Corp
kdcorporation.co.kr
Automotive PartsKR—3,203Oct 15, 2026countdown
Hocon Gas
hocongas.com
Electricity, Oil & GasNG—2,989Oct 15, 2026countdown
HyperGen
hypergeninc.com
Business ServicesUS——Oct 15, 2026countdown
Chattanooga Shooting Supplies
chattanoogashooting.com
Retail · PennsylvaniaUS——Oct 15, 2026countdown

Found by ThreatCluster

188 total from our crawl

Listed on this group's leak site and not present in the aggregated feeds.

Keller Williams Real Estate - Exton
Real Estate
Oct 11, 2026
Law Office of Steven R Smith
www.newyorkattorneyatlaw.com · Law Firms & Legal Services
Oct 11, 2026
Advanced Laundry Systems
www.advlaundry.com · Consumer Services
Oct 10, 2026
Foxstone Financial
foxstonefinancial.com · Finance
Oct 10, 2026
WikileaksV2
wikileaks2.com
Sep 9, 2026

All ransomware groups · Dark web intelligence