qilin ransomware group

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Claims in 7 days: 16
Claims in 30 days: 120
Reported techniques: 40

Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.

Where it claims victims

Country	Claims in 60 days
United States	37
Germany	11
United Kingdom	10
Mexico	8
Australia	6
Spain	5
Canada	3
Japan	3

Sectors

Sector	Claims in 60 days
Manufacturing	14
Professional Services	14
Other	13
Technology	11
Education	9
Transportation	9
Healthcare	9
Financial Services	9

Reported techniques

Valid Accounts Exploit Public-Facing Application Phishing Command and Scripting Interpreter Native API Shared Modules System Services Hijack Execution Flow Boot or Logon Initialization Scripts Scheduled Task/Job Account Manipulation Create Account Create or Modify System Process Boot or Logon Autostart Execution Process Injection Exploitation for Privilege Escalation Obfuscated Files or Information Masquerading Indicator Removal Access Token Manipulation Exploitation for Stealth Execution Guardrails Virtualization/Sandbox Evasion Hide Artifacts OS Credential Dumping Network Sniffing Input Capture Brute Force Credentials from Password Stores Query Registry Network Service Discovery System Information Discovery File and Directory Discovery Network Share Discovery Software Discovery System Location Discovery Remote Services Lateral Tool Transfer Archive Collected Data Data from Configuration Repository

Ransomware tracker