Loading threat actor…
Qilin is a Russia-associated, financially motivated ransomware and data-extortion group also known as Agenda, GOLD FEATHER, Water Galura, and Phantom Mantis. Its victims span numerous countries, with the United States and United Kingdom particularly prominent. Targeted organizations include healthcare providers, financial institutions, manufacturers, transportation companies, technology businesses, retailers, utilities, and educational institutions. Qilin conducts ransomware attacks and steals sensitive information, maintaining a public leak site where it posts evidence of compromises. Its operations expose personal, financial, insurance, and medical information. In the May 2025 breach of Covenant Health, attackers accessed patient data, and Qilin subsequently claimed responsibility and published purported evidence on its leak site. The breach affected 478,188 individuals following an expanded forensic review of approximately 1.35 million stolen files. Qilin's victim base demonstrates broad geographic and sectoral targeting rather than a narrowly focused campaign.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
19 malware families attributed to this actor across reporting.
14 additional families tracked in Mallory.
18 CVEs this actor has used in observed campaigns. 18 of them exploited in the wild.
In June this year, Qilin was exploiting a critical authentication bypass vulnerability in Check Point VPN and firewall products, tracked as CVE-2026-50751.
The third one, suspected to be the work of a Qilin ransomware operator, starts with the attackers logging in with the static credentials (CVE-2026-20316), then performing network and endpoint reconnaissance, stealing credentials, establishing additional access, deploying AV killers, and delivering the ransomware.
L’attaccante provvede allo sfruttamento di vulnerabilità specifiche - tra cui la CVE-2023-27532 presente in Veeam Backup & Replication - per l’estrazione di credenziali e la successiva neutralizzazione preventiva delle infrastrutture di backup online.
FortiOS e FortiProxy: identificata tramite la CVE-2024-21762 di tipo “Out-of-bounds Write” e con score CVSS v3.1 pari a 9.8.
FortiOS e FortiProxy: identificata tramite la CVE-2024-55591 di tipo “Authentication Bypass” e con score CVSS v3.1 pari a 9.8.
13 more CVEs tied to this actor tracked in Mallory.
161 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The report attributes a ransomware attack against Peru-based Belcorp, in the retail and e-commerce sector, to Qilin. The breach reportedly occurred on October 18, 2026, at 21:04 UTC and was discovered one minute later. No technical details or supporting attribution evidence are provided.
Qilin lists Belcorp in Peru as a victim, with a discovery date of October 18, 2026. The post lists eight photos and a publication countdown of 229 hours and 18 minutes, but specifies no stolen-data volume or ransom amount.
Reportedly conducted a ransomware attack against Llano Independent School District in the United States. The report lists both the breach and discovery time as October 18, 2026, at 13:49 UTC, but provides no technical details.
Reportedly conducted a ransomware attack against Mastelli S.r.l., an Italian organization identified as operating in manufacturing. The incident was discovered on October 18, 2026, at 09:46 UTC. The content provides no technical details or supporting attribution evidence.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.