Qilin

Active
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
2,285 Victims
Oct 8, 2022 First Discovered
Sep 16, 2026 Last Discovered
0 Days Inactive
0% Infostealer
1/4 Sites Online
Known Locations (4)
Sign In
ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion
Qilin
ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion
DDOS Protection
kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion
Qilin blog
ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
Tools Used
CredentialTheft
Mimikatz
DefenseEvasion
EDRSandBlast, PCHunter, PowerTool, Toshiba power management driver (BYOVD), Updater for Carbon Black’s Cloud Sensor AV (upd.exe), YDArk, Zemana Anti-Rootkit driver
DiscoveryEnum
Nmap, Nping
Exfiltration
EasyUpload.io, MEGA
LOLBAS
PowerShell, PsExec, WinRM, fsutil
Networking
Proxychains
Offsec
Cobalt Strike, Evilginx, Kali Linux, NetExec, SystemBC, Tofsee
RMM-Tools
NetSupport, ScreenConnect
Intelligence
Victims (2,285)

Detailed victim list temporarily unavailable

This group has 2,285 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.