Qilin

Qilin is a Russian-speaking ransomware-as-a-service operation also tracked under aliases including Agenda, Gold Feather, Water Galura, Qirin, and Qiling. The operation uses an affiliate model in which operators lease ransomware tooling to partners in exchange for a share of ransom payments. Qilin has been one of the most active ransomware threats in Europe and the United Kingdom, and has also heavily targeted organizations in North America. Qilin is known for double-extortion operations that combine data theft with encryption and subsequent pressure via a leak site. Victims have been publicly named on the group’s data leak infrastructure, and the operation has repeatedly been associated with data-breach activity in addition to disruptive ransomware deployment. Reported victimology spans construction, manufacturing, professional services, healthcare, financial services, technology, education, energy and utilities, and other small and mid-sized enterprises. The group has been linked to the 2024 attack on Synnovis, which disrupted NHS services in the United Kingdom, and later disclosures tied that incident to large-scale patient-data exfiltration. In 2026, Qilin was assessed as the most active ransomware group in Europe during the first half of the year and the leading ransomware actor affecting UK organizations by number of published victims. Observed tradecraft includes initial access through exploitation of internet-facing systems and VPN gateways, including abuse of known vulnerabilities and, in at least one reported case, claimed zero-day exploitation. Qilin has also been associated with the use of stolen credentials as an intrusion vector. For defense evasion, the group has been reported to use BYOVD techniques to disable or bypass endpoint security controls such as EDR and antivirus. Its operations reflect a mature affiliate-driven intrusion lifecycle with rapid exploit weaponization, data exfiltration, encryption, and public extortion through leak-site publication.