Loading story…
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a federal major cybersecurity incident after the Qilin ransomware group listed the agency on its dark-web leak site. The compromised asset was a standalone system containing information on targets of ATF investigations; Qilin has not published samples or other evidence that data was stolen, nor disclosed whether it sought a ransom.
ATF said the affected system was isolated from its enterprise environment and was promptly shut down, with connections to the environment terminated. The agency and Department of Justice have launched incident-response, forensic, and investigative work. ATF reported no evidence that its enterprise network, case-management, laboratory, eForms, or other systems were affected, and said mission operations remain uninterrupted.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Agenda, also known as Qilin or Water Galura, saw increased activity beginning in December 2023. Trend Micro reported a Rust-based variant that propagates to VMware vCenter and ESXi hosts through a custom in-memory PowerShell script and can alter ESXi root passwords and terminate VM clusters.
After ransom negotiations reportedly failed, Qilin published 6.3 GB of data it claimed to have stolen from ATF. The purported leak included investigation-target names, phone numbers, IP addresses, iCloud data, and Cellebrite phone extractions.
After discovering the compromise, ATF terminated connections to the affected environment, shut down the system, and initiated incident-response and forensic activities. The Department of Justice began investigating the incident.
ATF confirmed that a standalone system containing information about targets of ATF investigations was compromised and classified the breach as a federal major incident. The agency said the system was isolated from its enterprise, case-management, laboratory, and eForms systems, with no impact to mission operations.
The Qilin ransomware gang added the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives to its leak portal. The group did not provide data samples or state whether it had exfiltrated files or demanded a ransom.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
19 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecuritymagazine.com
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceatf.gov
Open sourcetrendmicro.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Qilin** ransomware operators claimed to have breached Oklahoma’s **Tulsa International Airport**, publishing more than a dozen files as proof of data theft. Reporting citing Cybernews said analysis of **18 leaked samples** included documents dated **2022–2025**, such as emails containing the airport CFO’s contact details and correspondence with banking officials, employee ID copies, and a range of sensitive business records (e.g., NDAs, budgets and revenue spreadsheets, insurance files, telehealth reports, tenant databases, governance minutes, court case files, and vendor revenue sheets). Tulsa International Airport had not publicly acknowledged the incident at the time of reporting. Separate ransomware/dark web reporting also highlighted **Qilin activity targeting a South Korean public broadcaster**, indicating continued operational tempo by the group across multiple sectors and geographies. The same weekly roundup additionally referenced unrelated dark web activity (including alleged sales/leaks involving a U.S. aerospace composites manufacturer and U.S. private universities), but the common thread relevant here is Qilin’s ongoing ransomware-driven data theft and leak-site pressure tactics.
Jun 29, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
The ransomware-as-a-service group **Qilin** claimed to have breached Spain's tax authority, *Agencia Tributaria*, and exfiltrated 60 gigabytes of sensitive data, listing the agency on its darkweb leak site. However, Spanish officials and a review of the leaked data confirmed that the information did not originate from the tax agency, and there was no evidence of a successful compromise. Authorities stated that the posted data samples were linked to a third-party business management firm and not to the tax agency itself. Spanish state newswire and agency spokespeople categorically denied any connection between the Qilin leak and the tax authority, emphasizing that the extortion group's claims were unfounded. The incident highlights the growing trend of ransomware groups making false or exaggerated breach claims to pressure organizations and attract attention, underscoring the importance of thorough verification before responding to extortion attempts or publicizing alleged breaches.
Jul 12, 2026