Organisation

Qilin

Ransomware-as-a-service crew; led May 2026 victim tally and exploiting Check Point VPN zero-day for initial access.

Qilin posted files attributed to Keio Corporation on 15 October 2026 as Japanese police counted 53 domestic victims linked to the ransomware operation since April 2023.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

How is Qilin using a VPN zero-day to break into organisations before patches exist?

Timeline for Qilin

#15 14 Oct

Posted 27 images from Keio Corporation files

Cybersecurity: Threats and Defences: SiteGuard hit; Qilin posts Keio files

#15 12 Oct

Mentioned in: N0n claims 38 firms, mostly maritime

Cybersecurity: Threats and Defences

#14 30 Sept

Fell to 74 claims from 162

Cybersecurity: Threats and Defences: Ransomware crews' claims fall to 815

#13 31 Aug

Claimed 165 August victims to take first place

Cybersecurity: Threats and Defences: Ransomware claims rose 11 per cent in August

#12 2 Aug

Qilin's own affiliate now outposts it

Cybersecurity: Threats and Defences

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

Qilin is a ransomware-as-a-service operation active since 2023. It supplies encryption tools, negotiation infrastructure and a leak site to affiliates, who Conduct intrusions and share proceeds with the service. The model spreads operational risk across Independent crews while keeping a common public brand.

Qilin uses double extortion: affiliates encrypt systems and threaten to publish stolen data. Its targets have included healthcare, manufacturing and professional services. The 2024 attack on Synnovis, a pathology provider serving London hospitals, made the group widely known because the disruption forced blood-test cancellations.

Affiliates can obtain access through stolen credentials and vulnerable internet-facing systems. The service therefore competes for affiliates as well as victims. Group-IB assessed that The Gentlemen developed from ArmCorp, an operation previously inside Qilin's programme, after a dispute over revenue sharing. Leak-site entries remain criminal claims unless victims or investigators confirm them.

Key Issues

Affiliate rivalry

Qilin loses volume to a breakaway

Qilin remained active in Japan in October 2026. It posted files attributed to Keio Corporation on 15 October, after the company disclosed a ransomware attack affecting group sales systems and Keio Plaza Hotel servers. Japanese police counted 53 Qilin victims in the country since April 2023.

Its leak-site volume had nevertheless fallen sharply. In September, ransomware.live counted 74 Qilin claims, less than half its August tally, while The Gentlemen led with 106. Group-IB assessed that The Gentlemen emerged from Qilin's affiliate programme after a revenue-share dispute. For a ransomware service that depends on Independent affiliates, losing activity to a former member tests the value of its brand and infrastructure.

Common Questions

Reference

What happened in the Qilin attack on the NHS in 2024?

In June 2024 Qilin attacked Synnovis, a pathology service provider for NHS Trusts in London. Blood-test services at King's College Hospital, Guy's and St Thomas' and other sites were severely disrupted, forcing thousands of appointment and operation cancellations and an emergency appeal for O-negative blood donations.Source: event

Is Qilin ransomware linked to a specific country or government?

No confirmed state attribution has been made. Qilin operates as a commercially structured RaaS programme with Independent affiliates. Its operators are not publicly identified and no government has formally attributed the group to a nation-state sponsor.

Is Qilin the same as Agenda ransomware?

Yes. Qilin ransomware is also tracked under the name Agenda by some security vendors. It was initially written in the Go programming language before being rewritten in Rust, and both names refer to the same operator group and RaaS platform.Source: Trend Micro / cybersecurity research

Why does Qilin target hospitals and healthcare providers?

Healthcare cannot tolerate extended system downtime: patient care, diagnostics and drug dispensing depend on real-time IT access. Ransomware groups including Qilin target hospitals because operational pressure to restore services quickly makes healthcare organisations more likely to pay ransoms faster and at higher amounts than most other sectors.Source: BlackFog State of Ransomware May 2026

What is the Qilin ransomware group?

Qilin is a ransomware-as-a-service operation in which a core developer team leases ransomware tooling to Independent affiliates, who Conduct attacks and split ransom proceeds with the developers. It has been active since 2023 and targets healthcare, manufacturing and professional services globally, using double-extortion tactics that combine file encryption with threatened data publication.Source: BlackFog / cybersecurity reporting

How did Qilin get into systems via the Check Point VPN vulnerability?

A Qilin affiliate exploited CVE-2026-50751, a CVSS 9.3 authentication bypass in Check Point Remote Access VPN using a deprecated IKEv1 code path. The flaw allowed attackers to bypass credential checks entirely. Exploitation ran for approximately one month before a hotfix was available, during which post-compromise activity was confirmed at a number of organisations.Source: Check Point / CISA KEV

How many ransomware attacks did Qilin carry out in 2026?

Qilin claimed 11 victims in May 2026 alone, leading all tracked ransomware crews that month. Across 2026 it has been consistently among the top five most active groups by public leak-site postings.Source: BlackFog

What is Qilin ransomware and who does it target?

Qilin is a ransomware-as-a-service operation active since 2023 that leases attack tooling to Independent affiliates. It targets healthcare, manufacturing, professional services and education globally, gaining notoriety from the 2024 NHS Synnovis attack and leading May 2026's disclosed ransomware tally with 11 claimed victims.Source: BlackFog monthly report

How many victims did Qilin claim in May 2026?

Qilin claimed 11 victims in May 2026, leading all active ransomware groups that month. BlackFog's monthly tracking recorded 95 publicly disclosed ransomware attacks worldwide in May, with 37 active groups and healthcare taking the heaviest sector hit at 28 incidents.Source: BlackFog State of Ransomware May 2026

Source Material

The State of Ransomware May 2026