WikiLeaksV2

WikiLeaksV2 is a data-leak and extortion brand associated with the Qilin ransomware ecosystem. It has been linked to Qilin through overlap in published victims and cross-promotion between Qilin leak postings and the WikiLeaksV2 leak page. Qilin, also known as Agenda, is a ransomware-as-a-service operation first observed in 2022 that conducts double extortion by combining file encryption with theft of victim data and threats to publish stolen information. Through this association, WikiLeaksV2 is tied to a criminal extortion model centered on leak-site publication and ransomware affiliate activity. Qilin operations have targeted both Windows and Linux environments and have used malware variants written in Golang and Rust. Reported intrusion methods used by the broader Qilin ecosystem include phishing with malicious attachments, use of valid or stolen credentials, exploitation of public-facing vulnerabilities, and abuse of external remote services. Post-compromise activity has included credential harvesting, modification of domain policy to deploy logon scripts, termination of security-related services, event log clearing, self-deletion, DLL sideloading, and use of tools intended to disable endpoint defenses, including BYOVD-style tradecraft. Qilin is widely characterized as a financially motivated ransomware-as-a-service program with affiliates and a leak-site component, and WikiLeaksV2 appears to function as part of that extortion and publicity infrastructure rather than as a distinct nation-state intrusion set. The most directly supported relationship is operational alignment with Qilin via victim overlap and cross-promotion.