Loading story…
Qilin ransomware-as-a-service emerged as the most prominent ransomware threat affecting UK organizations in the first half of 2026, with 37 UK victims named on its Tor leak site—more than DragonForce and TheGentlemen. Reporting says the group averaged seven to nine UK disclosures per month and primarily hit SMEs across construction, manufacturing, legal services, technology, education, and healthcare. The campaign’s impact continued to reverberate from the 2024 Synnovis attack, after Bedfordshire Hospitals NHS Foundation Trust disclosed that more than 32,000 patient records linked to Synnovis tests had been exfiltrated.
Researchers and incident trackers also tied Qilin to fresh victim disclosures outside the UK, including INTERTRUST AUSTRALIA PTY LTD, a professional services firm in Australia associated with the domain www.seedoutsourcing.com. Prior reporting on Qilin’s operations describes a mature affiliate model and an extortion cycle of roughly six weeks from intrusion to public naming, with common tactics including exploitation of VPN gateways and BYOVD techniques to disable or evade EDR and antivirus tools. Separate reporting noted Salford City College appeared on both Qilin’s and DragonForce’s leak sites within days, raising the possibility of affiliate overlap or multiple compromises.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
INTERTRUST AUSTRALIA PTY LTD was identified as a ransomware victim attributed to the Qilin group. The incident was listed as a data breach affecting the professional services organization and associated with the domain www.seedoutsourcing.com.
On 1 June 2026, Bedfordshire Hospitals NHS Foundation Trust disclosed that more than 32,000 patient records related to Synnovis tests had been exfiltrated. The exposed data included names, patient numbers, dates of birth, postcodes, and test results.
Salford City College was also posted on DragonForce’s leak site on 10 March 2026, days after its appearance on Qilin’s site. The source says the reason for the dual listing was unknown.
Salford City College appeared on Qilin’s Tor data leak site on 6 March 2026. The later cross-posting was noted as unusual but not unprecedented.
Throughout the first half of 2026, Qilin had the highest number of UK-based victims on tracked leak sites, with 37 organizations listed. The source compares this with 21 for DragonForce and 18 for TheGentlemen.
The Qilin ransomware group attacked Synnovis in 2024, in an incident that later had downstream impact on NHS-related patient data. The reference identifies this as a 2024 attack but does not provide a more precise date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcehookphish.com
Open sourceransomware.live
Open sourceblog.bushidotoken.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Sep 1, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026