Ransomware.live: qilin

| Active

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Victims

2178

First Victim

2022-10-08

(est. attack date)

Discovery Date

2022-10-08

Last Seen

2026-08-18

Inactive Since

days

Avg Delay

45.0

days

Infostealer

37.5%

victims with domain

Countries

101

hit

Uptime

76.8% avg (30d)

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months (based on attack estimated date if available)

-29% vs last month

Exclusive interview with the ransomware group qilin from the CyberSecurityIL Telegram Channel — ransomware-interviews.base44.app

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Qilin	No	2026-08-14T09:54:52		`ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion`
DDOS Protection	No	2026-08-14T09:55:05		`kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion`
Qilin blog	Yes	2026-08-18T13:57:47	nginx	`ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion`
Sign In	No	2026-08-14T09:54:04		`ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion`

Target

Heatmap

Ransom Notes (3)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Nmap Nping placeholder placeholder placeholder placeholder placeholder	NetSupport ScreenConnect placeholder placeholder placeholder placeholder placeholder	EDRSandBlast PCHunter PowerTool Toshiba power management driver (BYOVD) Updater for Carbon Black’s Cloud Sensor AV (upd.exe) YDArk Zemana Anti-Rootkit driver	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder	Cobalt Strike Evilginx Kali Linux NetExec SystemBC Tofsee placeholder	Proxychains placeholder placeholder placeholder placeholder placeholder placeholder	PowerShell PsExec WinRM fsutil placeholder placeholder placeholder	EasyUpload.io MEGA placeholder placeholder placeholder placeholder placeholder

Vulnerabilities Exploited (13)

This information is provided by Ransomware-Vulnerability-Matrix & Ransomware.live
Vendor	Product	CVE	Source
Apache	Apache bRPC	CVE-2025-60021	ctrlaltintel.com
Fortinet	FortiOS	CVE-2025-59718	ctrlaltintel.com
Fortinet	FortiOS & FortiProxy	CVE-2024-21762	checkpoint.com
Fortinet	FortiOS & FortiProxy	CVE-2024-55591	checkpoint.com
SmarterTools	SmarterMail	CVE-2026-24423	ctrlaltintel.com
Telnet	Telnetd in GNU Inetutils	CVE-2026-24061	ctrlaltintel.com
WatchGuard	WatchGuard Fireware OS	CVE-2025-9242	ctrlaltintel.com
WatchGuard	WatchGuard Fireware OS	CVE-2025-14733	ctrlaltintel.com
Check Point	VPN Remote Access and Mobile Access	CVE-2026-50751	blog.checkpoint.com
Palo Alto Networks	Cloud NGFW	CVE-2026-0257	Articwolf
Veeam	Backup & Replication	CVE-2023-27532	group-ib.com
SolarWinds	SolarWinds Web Help Desk	CVE-2025-40554	ctrlaltintel.com
Zemana	Zemana AntiLogger	CVE-2024-1853	binarydefense.com

TTPs Matrix (14)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact	Resource Development	Reconnaissance
Valid Accounts	Command and Scripting Interpreter: PowerShell	Boot or Logon Initialization Scripts	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping: LSASS Memory	Query Registry	Remote Services	Archive Collected Data: Archive via Utility	Exfiltration Over Other Network Medium	Data Obfuscation	Data Encrypted for Impact	Develop Capabilities: Malware	Gather Victim Network Information: Network Topology
Exploit Public-Facing Application	Command and Scripting Interpreter: Unix Shell	Scheduled Task/Job		Masquerading: Invalid Code Signature	Network Sniffing	Network Service Discovery	Remote Services: Remote Desktop Protocol	Network Device Configuration Dump	Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth	Data Obfuscation: Junk Data	Inhibit System Recovery
Phishing	System Services	Scheduled Task/Job: Scheduled Task		Access Token Manipulation: Parent PID Spoofing	Brute Force: Password Cracking	System Information Discovery	Remote Services: SMB/Windows Admin Shares		Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol	Application Layer Protocol: Web Protocols	Disk Wipe
Phishing: Spearphishing via Service	System Services: Service Execution	Account Manipulation: SSH Authorized Keys		Exploitation for Defense Evasion	Credentials from Web Browsers	System Location Discovery	Remote Services: SSH		Exfiltration Over Web Service: Exfiltration to Cloud Storage	Protocol Tunneling	Disk Wipe: Disk Content Wipe
		Create Account		Execution Guardrails			Lateral Tool Transfer
		Boot or Logon Autostart Execution		Virtualization/Sandbox Evasion: System Checks
				Subvert Trust Controls: Code Signing
				Disable or Modify Tools
				Impair Defenses: Disable or Modify System Firewall
				Hidden Artifacts
				Hidden Artifacts: Hidden Window

KQL Query (2)

Negotiation Chats (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (62)

Hash MD5 54 IP Address 5 ftp 2 tox 1

Type	IOC
`Hash MD5`	`08a2405cd32f044a69737e77454ee2da`
`Hash MD5`	`0d68a310f4265821900249bec89364c2`
`Hash MD5`	`11d795baafa44b73766e850d13b8e254`
`Hash MD5`	`144183a4217ae0914ba0c865858d07cd`
`Hash MD5`	`19ff6488a259d750ec18902fe75a713b`
`Hash MD5`	`1bde76f3197123dcc2ecd0bfef567484`
`Hash MD5`	`1c4bea81c0da22badd9b7eab574c51cd`
`Hash MD5`	`2020979e080d7ac9c0403172573c7de8`
`Hash MD5`	`24a8fcd08d9e40d32929b57de9b15385`
`Hash MD5`	`2bb209ccfc5103eccab523c875050cfa`
`Hash MD5`	`2f76a29d4e4292d7f29a29345717812c`
`Hash MD5`	`3158a3849ea2695d6ec5aea6512fd030`
`Hash MD5`	`348b0ce6af4698061678c8e92b4b2675`
`Hash MD5`	`37155f0bca29ccd6b6d4f5b2bc42eb4d`
`Hash MD5`	`3b10127e65fa3e215d21e0a2e7fd32be`
`Hash MD5`	`417ad60624345ef85e648038e18902ab`
`Hash MD5`	`420a2c53386678396f972f09cc7f3a5c`
`Hash MD5`	`4a3f22021e4415e8211633fb3735a046`
`Hash MD5`	`4ea8adecc5bd45a76cc61430c560924f`
`Hash MD5`	`53c8a4f0497929de4a5039b2c14bf426`
`Hash MD5`	`575b26c1cc06609722f98e2beaed6a8a`
`Hash MD5`	`5862f9fc9c9a0d766eba29eb4945f619`
`Hash MD5`	`59d756280b06cf113ca43abc0050edd5`
`Hash MD5`	`5cffa3126b9effc279d32b2cf4ef2278`
`Hash MD5`	`64a590760fdbb84356544cc90ac3d50f`
`Hash MD5`	`670fe8faaede4e2e033311fb662d2a4a`
`Hash MD5`	`6f893b1cc5cf534c59eabe932c1bf21e`
`Hash MD5`	`6fc6164b3a08669992acad3764fb1922`
`Hash MD5`	`826a8e8c05983aa3a884d7abcfa473ac`
`Hash MD5`	`88630916b0c6633ca28c8896416a93ee`
`Hash MD5`	`88bb86494cb9411a9692f9c8e67ed32c`
`Hash MD5`	`8ca5c9745e8a0e18167a9b932821645a`
`Hash MD5`	`964c13b68dc6b6b918b66a9a10469d2a`
`Hash MD5`	`996c394d0f6d6967df9542c52f6f4661`
`Hash MD5`	`9befad1d56d2bd8195813aea1f37f921`
`Hash MD5`	`9ea321b6a0f069caab7092cfe1cbbde0`
`Hash MD5`	`9f510626c7327a7c2328bc5131726638`
`Hash MD5`	`a6302fdb63e2244c1246a73a7d65d09e`
`Hash MD5`	`a7ab0969bf6641cd0c7228ae95f6d217`
`Hash MD5`	`a7e7d00d531cb7ca27d0f3bee448573f`
`Hash MD5`	`ab05a1925fee8334a2114811d5283364`
`Hash MD5`	`b04e8ee43aba85fa5c585b9335c953c2`
`Hash MD5`	`b4a6152514919a637c22a58bea316fc7`
`Hash MD5`	`bed0f34673cc93560c17e3ab04ea5d19`
`Hash MD5`	`d1c331c17ddd4abe0d53755461c1ec9a`
`Hash MD5`	`d309e3d77ed6a336eb3ad263ddf9db90`
`Hash MD5`	`d6e7547ad7dfd1fbc62e8282aebcc391`
`Hash MD5`	`dd42c3e017889c107a81da78d87dc8af`
`Hash MD5`	`e01776ec67b9f1ae780c3e24ecc4bf06`
`Hash MD5`	`e4c1add9f7606e3fa57976b908b4b375`
`Hash MD5`	`ea1f8794c73b26724314e5356f1f4128`
`Hash MD5`	`f588802958c35fe18eb87bc36651a3d1`
`Hash MD5`	`f982da00c547913fd0ae7d0da0fc77e7`
`Hash MD5`	`fdc6848dad660414bed9ad1b381cf6e3`
`IP Address`	`176.113.115.209`
`IP Address`	`176.113.115.97`
`IP Address`	`188.119.66.189`
`IP Address`	`31.41.244.100`
`IP Address`	`85.209.11.49`
`ftp`	`ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@176.113.115.209`
`ftp`	`ftp://dataShare:nX4aJxu3rYUMiLjCMtuJYTKS@176.113.115.97`
`tox`	`7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68`