Ransomware.live: qilin

| Active

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Victims

2017

First Discovered

2022-10-08

victim

Last Discovered

2026-07-15

victim

Inactive Since

day

Avg Delay

45.6

days

Infostealer

22.3%

victims with domain

Countries

100

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

-29% vs last month

Exclusive interview with the ransomware group qilin from the CyberSecurityIL Telegram Channel — ransomware-interviews.base44.app

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Qilin	No	2026-04-28T07:25:49		`ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion`
DDOS Protection	No	2026-04-28T07:28:21		`kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion`
Qilin blog	No	2026-07-16T10:39:53	Apache	`ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion`
Sign In	No	2026-04-28T07:30:53		`ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion`

Target

Heatmap

Ransom Notes (3)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Nmap Nping placeholder placeholder placeholder placeholder placeholder	NetSupport ScreenConnect placeholder placeholder placeholder placeholder placeholder	EDRSandBlast PCHunter PowerTool Toshiba power management driver (BYOVD) Updater for Carbon Black’s Cloud Sensor AV (upd.exe) YDArk Zemana Anti-Rootkit driver	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder	Cobalt Strike Evilginx Kali Linux NetExec SystemBC Tofsee placeholder	Proxychains placeholder placeholder placeholder placeholder placeholder placeholder	PowerShell PsExec WinRM fsutil placeholder placeholder placeholder	EasyUpload.io MEGA placeholder placeholder placeholder placeholder placeholder

TTPs Matrix (14)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact	Resource Development	Reconnaissance
Valid Accounts	Command and Scripting Interpreter: PowerShell	Boot or Logon Initialization Scripts	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping: LSASS Memory	Query Registry	Remote Services	Archive Collected Data: Archive via Utility	Exfiltration Over Other Network Medium	Data Obfuscation	Data Encrypted for Impact	Develop Capabilities: Malware	Gather Victim Network Information: Network Topology
Exploit Public-Facing Application	Command and Scripting Interpreter: Unix Shell	Scheduled Task/Job		Masquerading: Invalid Code Signature	Network Sniffing	Network Service Discovery	Remote Services: Remote Desktop Protocol	Network Device Configuration Dump	Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth	Data Obfuscation: Junk Data	Inhibit System Recovery
Phishing	System Services	Scheduled Task/Job: Scheduled Task		Access Token Manipulation: Parent PID Spoofing	Brute Force: Password Cracking	System Information Discovery	Remote Services: SMB/Windows Admin Shares		Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol	Application Layer Protocol: Web Protocols	Disk Wipe
Phishing: Spearphishing via Service	System Services: Service Execution	Account Manipulation: SSH Authorized Keys		Exploitation for Defense Evasion	Credentials from Web Browsers	System Location Discovery	Remote Services: SSH		Exfiltration Over Web Service: Exfiltration to Cloud Storage	Protocol Tunneling	Disk Wipe: Disk Content Wipe
		Create Account		Execution Guardrails			Lateral Tool Transfer
		Boot or Logon Autostart Execution		Virtualization/Sandbox Evasion: System Checks
				Subvert Trust Controls: Code Signing
				Disable or Modify Tools
				Impair Defenses: Disable or Modify System Firewall
				Hidden Artifacts
				Hidden Artifacts: Hidden Window

Negotiation Chats (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (61)

Hash MD5 54 IP Address 5 ftp 2

Type	IOC
`Hash MD5`	`08a2405cd32f044a69737e77454ee2da`
`Hash MD5`	`0d68a310f4265821900249bec89364c2`
`Hash MD5`	`11d795baafa44b73766e850d13b8e254`
`Hash MD5`	`144183a4217ae0914ba0c865858d07cd`
`Hash MD5`	`19ff6488a259d750ec18902fe75a713b`
`Hash MD5`	`1bde76f3197123dcc2ecd0bfef567484`
`Hash MD5`	`1c4bea81c0da22badd9b7eab574c51cd`
`Hash MD5`	`2020979e080d7ac9c0403172573c7de8`
`Hash MD5`	`24a8fcd08d9e40d32929b57de9b15385`
`Hash MD5`	`2bb209ccfc5103eccab523c875050cfa`
`Hash MD5`	`2f76a29d4e4292d7f29a29345717812c`
`Hash MD5`	`3158a3849ea2695d6ec5aea6512fd030`
`Hash MD5`	`348b0ce6af4698061678c8e92b4b2675`
`Hash MD5`	`37155f0bca29ccd6b6d4f5b2bc42eb4d`
`Hash MD5`	`3b10127e65fa3e215d21e0a2e7fd32be`
`Hash MD5`	`417ad60624345ef85e648038e18902ab`
`Hash MD5`	`420a2c53386678396f972f09cc7f3a5c`
`Hash MD5`	`4a3f22021e4415e8211633fb3735a046`
`Hash MD5`	`4ea8adecc5bd45a76cc61430c560924f`
`Hash MD5`	`53c8a4f0497929de4a5039b2c14bf426`
`Hash MD5`	`575b26c1cc06609722f98e2beaed6a8a`
`Hash MD5`	`5862f9fc9c9a0d766eba29eb4945f619`
`Hash MD5`	`59d756280b06cf113ca43abc0050edd5`
`Hash MD5`	`5cffa3126b9effc279d32b2cf4ef2278`
`Hash MD5`	`64a590760fdbb84356544cc90ac3d50f`
`Hash MD5`	`670fe8faaede4e2e033311fb662d2a4a`
`Hash MD5`	`6f893b1cc5cf534c59eabe932c1bf21e`
`Hash MD5`	`6fc6164b3a08669992acad3764fb1922`
`Hash MD5`	`826a8e8c05983aa3a884d7abcfa473ac`
`Hash MD5`	`88630916b0c6633ca28c8896416a93ee`
`Hash MD5`	`88bb86494cb9411a9692f9c8e67ed32c`
`Hash MD5`	`8ca5c9745e8a0e18167a9b932821645a`
`Hash MD5`	`964c13b68dc6b6b918b66a9a10469d2a`
`Hash MD5`	`996c394d0f6d6967df9542c52f6f4661`
`Hash MD5`	`9befad1d56d2bd8195813aea1f37f921`
`Hash MD5`	`9ea321b6a0f069caab7092cfe1cbbde0`
`Hash MD5`	`9f510626c7327a7c2328bc5131726638`
`Hash MD5`	`a6302fdb63e2244c1246a73a7d65d09e`
`Hash MD5`	`a7ab0969bf6641cd0c7228ae95f6d217`
`Hash MD5`	`a7e7d00d531cb7ca27d0f3bee448573f`
`Hash MD5`	`ab05a1925fee8334a2114811d5283364`
`Hash MD5`	`b04e8ee43aba85fa5c585b9335c953c2`
`Hash MD5`	`b4a6152514919a637c22a58bea316fc7`
`Hash MD5`	`bed0f34673cc93560c17e3ab04ea5d19`
`Hash MD5`	`d1c331c17ddd4abe0d53755461c1ec9a`
`Hash MD5`	`d309e3d77ed6a336eb3ad263ddf9db90`
`Hash MD5`	`d6e7547ad7dfd1fbc62e8282aebcc391`
`Hash MD5`	`dd42c3e017889c107a81da78d87dc8af`
`Hash MD5`	`e01776ec67b9f1ae780c3e24ecc4bf06`
`Hash MD5`	`e4c1add9f7606e3fa57976b908b4b375`
`Hash MD5`	`ea1f8794c73b26724314e5356f1f4128`
`Hash MD5`	`f588802958c35fe18eb87bc36651a3d1`
`Hash MD5`	`f982da00c547913fd0ae7d0da0fc77e7`
`Hash MD5`	`fdc6848dad660414bed9ad1b381cf6e3`
`IP Address`	`176.113.115.209`
`IP Address`	`176.113.115.97`
`IP Address`	`188.119.66.189`
`IP Address`	`31.41.244.100`
`IP Address`	`85.209.11.49`
`ftp`	`ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@176.113.115.209`
`ftp`	`ftp://dataShare:nX4aJxu3rYUMiLjCMtuJYTKS@176.113.115.97`