Qilin first appeared in July 2022 when a post on hacking forums promoted a new ransomware called “Agenda.” It was renamed Qilin in September that year with the release of a Rust-based variant (the original was developed in Golang). Evidence suggests the operators may be based in Eastern Europe, though this remains unconfirmed. Primary targets include the United States, the United Kingdom, and Canada. In 2025, Qilin is the leading RaaS (Ransomware-as-a-Service) group.
Our Cyber Threat Intelligence analysts have compiled the available information into this profile:
- Overview: initial access is gained via phishing or using personal data stolen beforehand. Qilin is well known for its social engineering capabilities. All elements are listed in the profile.
- Activity status: The group ranks first amongst active attacking groups in 2025 (figures from CTI GLIMPS)
- IOCs: URLs, ransomnote, IP/sevrers,
- Analysis results with GLIMPS Malware Expert
Our latest Cyber Threat Intelligence publications
