Qilin is a financially motivated ransomware-as-a-service operation also known as Agenda and tracked by TrendAI Research as Water Galura. TrendAI dates its emergence to mid-2022, initially with customizable Go-based ransomware and later Rust, Linux and VMware ESXi variants. The operation expanded substantially in 2024 and 2025. Affiliates conduct many intrusions, so a Qilin listing, payload or tactic requires incident-specific corroboration and does not by itself identify the person or team responsible.
Qilin has operated across regions and industries rather than maintaining a narrow victim set. TrendAI’s monitoring through January 2026 found the largest share of claimed victims in North America, followed by Europe and the Asia-Pacific region, with manufacturing the most represented industry and significant healthcare and technology activity. These figures derive heavily from the operation’s leak site and should be treated as observed claims rather than confirmed incident totals.
The operation became one of the most active ransomware services in 2025. Check Point Research observed increased affiliate recruitment after RansomHub’s closure and described Qilin as the most active group in the third quarter. Check Point also noted that operator statements suggesting ideology conflicted with broad opportunistic targeting and a profit-focused affiliate model.
Qilin combines file encryption with data theft and leak-based pressure. Its Tor data-leak site supports proof-of-compromise material, countdowns, staged releases and publication when demands are not met. TrendAI observed stolen-credential access, initial-access brokers and deceptive browser-verification social engineering, followed by PowerShell and Active Directory discovery, propagation through vCenter or ESXi environments, PsExec-based remote execution and bring-your-own-vulnerable-driver defense evasion.
The malware’s configurable builds let affiliates select encryption, propagation, file targeting and ransom-note behavior. Cross-platform variants and affiliate-supplied loaders or legitimate remote-management tools create meaningful variation between incidents. A technique observed in one campaign should therefore not be generalized to all Qilin activity.
Qilin is best characterized as a financially motivated ransomware group operating a service and affiliate ecosystem. Core operators provide malware, infrastructure, leak-site operations and negotiation support, while affiliates may obtain access, exfiltrate data and deploy the ransomware. Public reporting has described isolated state-linked or politically motivated affiliates using the ecosystem, but that does not establish state sponsorship or a unified political motive for Qilin itself. The reviewed evidence supports profit as the primary operating model and leaves the core operators and jurisdiction unidentified.
Qilin listing names Community Medical Center, Falls City Nebraska and www.cmcfc.org. Current name/domain searches establish a matching public claim. Responsibility, encryption, data theft and connection to the clinical disruption remain unverified.
Ransomware.live indexed a Qilin listing naming City of Columbia, SC and www.columbiasc.gov on Oct. 29, 2026. The tracker provides no claim detail or stolen-data volume. Columbia independently confirmed ransomware and application disruption but has not attributed the incident to Qilin. Qilin’s responsibility and any underlying data allegation remain unconfirmed.
Qilin listed Premier Medical Group with the matching premiermedicalhv.com domain in an entry recorded by Ransomware.live on Oct. 26, 2026. Responsibility, encryption, data removal and the relationship to the June 2026 intrusion disclosed by the practice remain unverified. Discovery is not the intrusion date or verified original post time.
Ransomware.live lists Heber City, UT (www.heberut.gov) under Qilin, discovered Oct. 24, 2026. The reviewed feed provides no substantive description or independently authenticated intrusion, encryption or data-theft evidence. The feed’s Oct. 24 claimed attack timestamp is not adopted as onset; independent reporting dates the municipal network intrusion Oct. 10 and restoration by Oct. 15. An operator linked this claim to the existing occurrence, which does not independently verify actor attribution. Original actor post and screenshot were not independently authenticated. This junction records the listing allegation and does not establish renewed disruption or alter resolved operational status.
Qilin listing for Llano Independent School District and www.llanoisd.org. Existence of the claim is established by preserved original payload and current MCP name/domain searches; responsibility, ransomware, data theft and causal linkage to the district’s acknowledged incident remain unverified. Publication date is not established; tracker attackdate/discovery are not incident onset.
Qilin listed “Newton County School System” and the district’s correct domain on August 28, 2026. Ransomware.live’s archived image shows a Qilin-branded entry with four purported proof thumbnails, but the tracker blurs them and the page description is N/A. The listing is stable claim evidence but does not independently prove ransomware deployment, encryption, data theft, a ransom demand or Qilin responsibility.
Qilin listed ATF on its data-leak site Aug. 26 and threatened to publish a full leak unless an agency representative made contact through the provided channels. On Aug. 31, the group began releasing files that CNN and independent cybersecurity researcher Ron Fabela said appeared to include ATF investigative targets, phone-communication analyses, agent-specific files and case material. ATF confirmed a breach of a standalone system but has not attributed the incident to Qilin or confirmed the files’ authenticity, nature or scope. No public evidence establishes ransomware encryption or deployment of Qilin malware in the affected environment.
Qilin listed Brazosport College and claimed internal data on August 25, 2026. An accessible tracker characterized the allegation as unverified and said the listing supplied no proof, sample, record count or data categories. The claim does not independently prove ransomware deployment, encryption, data theft or Qilin responsibility.
Qilin listed Stryker and stryker.com July 24. The monitored page contains no description, alleged data volume, deadline, sample or other supporting detail and marks the entry as a possible duplicate because the same domain appears in Handala’s March listing. No reviewed source ties Qilin to the March disruption or documents a later confirmed Stryker intrusion or outage. The entry may be a duplicate, misattribution or separate unconfirmed claim.
Ransomware.live recorded a Qilin victim listing naming Alamo Heights School District on May 28. The stable listing identifies the claimant and victim name but does not authenticate alleged files, prove data theft or establish that Qilin caused the March ransomware disruption. The earlier WorldLeaks listing creates unresolved conflicting attribution.
Qilin claimed responsibility for Rusk County’s March 2026 incident. The county confirmed a cyber incident but did not name Qilin; a separate Lynx claim concerned a November 2025 outage and is not attributed to this incident.
Qilin listed the Standard-Examiner and threatened publication of allegedly stolen data. The newspaper has not confirmed the claim or linked it to April production delays.
Qilin listed Aroostook Mental Health Services on March 24, 2026. AMHC said the group was likely behind the network attack and described the posting as following its decision not to deal with the criminals. DeXpose reproduced a Qilin threat to publish information unless a representative made contact, but associated the victim with amhservices.com rather than AMHC’s canonical amhc.org domain. The stable name match, AMHC’s response and later confirmation of file theft support the claim, while the domain mismatch and absence of public forensic artifacts remain contrary evidence. The claim does not independently confirm ransomware deployment, encryption, payment or verified attribution.
Qilin listed Duffy’s Sports Grill. The claim is stable external cyber evidence but does not independently prove ransomware deployment, data theft or actor responsibility.
Qilin’s victim listing named Evergreen Printing, and Kaspersky ICS CERT later associated Qilin with the December 2025 printer disruption. The indexed listing uses egpp.biz while the Bellmawr, New Jersey printer identifies egpp.com as its website. The group claim and its identity match have not been independently confirmed; this record does not establish Qilin’s role, data theft or a link to the operational outage.
Qilin listed Eanes ISD schools as a purported victim, as recorded by ransomware.live and our Dec. 22 report. The district experienced a weeklong Wi-Fi disruption, but no reviewed district statement confirms Qilin, ransomware, data theft or a link between the listing and the outage.
Qilin listed City of Urbana with the Ohio city’s urbanaohio.com domain. This is a claim, not confirmation of actor responsibility, ransomware deployment or data theft.
Qilin listed Santa Paula and spcity.org as a claimed victim; city did not verify attribution or data theft.
Qilin listed Lake Superior State University after the university disclosed ransomware-related disruption. The university has not confirmed Qilin’s role or data theft.
Qilin listed the Virginia district domain and threatened a future full leak. District did not confirm attribution, ransomware deployment or exfiltration.
Qilin claimed the city; a secondary outlet reported its 800 GB theft allegation. Neither responsibility nor data volume is confirmed by the city.
Qilin claimed responsibility for the district incident and alleged theft of employee, student and financial records, publishing purported document samples. The district had not verified the allegation. Neither file authenticity nor Qilin’s responsibility for the intrusion is independently established.
Qilin claimed the Virginia school division and alleged theft of 305 gigabytes, publishing purported document samples. Comparitech reported that Superintendent Scott Worner confirmed the group was responsible, while the investigation into affected data remained open. The claimed volume and authenticity of the samples were not independently established. Listing text that names Charlotte-Mecklenburg in North Carolina conflicts with the verified Virginia victim.
Qilin listed the Town of Waxhaw and claimed access to municipal files. DeXpose described procurement and contract material; Comparitech reported an alleged 619 gigabytes and a proof pack containing internal and police reports and a passport copy. Those reports document a claim and purported sample material, without independently verifying their authenticity, the data volume, successful theft, encryption or the actor’s responsibility for the intrusion. Reporting dates the claim to Sept. 25, 2025; the original posting time is unverified.
Qilin listed Spartanburg County using its historical www.spartanburgcounty.org website. The tracker discovered the entry Sept. 17, 2025; the original post time is unverified. Comparitech reports a 390 GB claim and alleged publication, which the county has not verified. The county independently confirms unauthorized copying, without confirming Qilin attribution, encryption or a ransom/payment outcome. The 2023 and 2026 incidents are separate events.
Qilin claimed responsibility for the Orleans Parish Sheriff’s Office incident and published purported administrative and financial documents. Later reporting described an alleged 842 gigabytes of stolen data. The agency had not confirmed that volume or the full authenticity and scope of the files. The claim does not independently establish attribution or verified exfiltration.
Qilin listed the district domain in a lead discovered Aug. 1, 2025. The district’s statements confirm cyber disruption and later unauthorized registration-file access without naming Qilin. The listing remains an unverified responsibility allegation and does not independently establish encryption, data theft or publication, or ransom payment.
Qilin listed the emergency district’s exact domain. The director later confirmed Qilin to Comparitech while disputing the group’s claims. Discovery date is not publication; data provenance, encryption, ransom and payment remain unresolved.
Qilin listed www.covenanthealth.net, the domain of the New England Covenant Health system. The tracker records discovery June 24, 2025, at 13:12:48 UTC; that is not a verified publication time. BleepingComputer’s Jan. 2, 2026, report independently describes the late-June claim and allegations of 852 gigabytes and nearly 1.35 million files. Covenant confirms unauthorized access and patient and resident information involvement, but does not confirm Qilin, encryption, the alleged quantity, a ransom demand or payment. Vitasora’s July 2025 market announcement repeats Qilin attribution without supplying forensic evidence. The unrelated Tennessee covenanthealth.com organization is excluded.
A Qilin-attributed tracker listing identifies abilenetx.gov, the City of Abilene, Texas, domain, and threatens data publication May 27. Its description instead refers to the Abilene Housing Authority; that identity inconsistency remains unresolved. Independent local reporting says the city acknowledged a Qilin claim and refused payment. The original leak post, original posting time and full data scope are unverified. Confidence in responsibility is low, and the alleged 477 GB is not a confirmed forensic measurement. The May 16 timestamp is tracker discovery, rather than attack or publication. No separate housing-authority, school-district or medical-office incident is inferred.
Qilin listed www.hcsheriff.gov, the Hamilton County, Tennessee, sheriff’s office domain. An original May 9, 2025, post by Indicators of Leakage @ StealthMole reproduces the listing, which displays a May 4 date and alleges possession of 99 GB comprising 128,294 files. The tracker discovered the listing May 8. The screenshot’s date has day precision; the original time and timezone and the intrusion date are not established. The sheriff confirmed ransomware and a rejected demand but did not identify Qilin. Responsibility and the alleged data volume remain unverified, with low attribution confidence. The later claim does not override Vendetta’s earlier scope-limited assessment or establish theft, encryption, payment or renewed disruption. Original researcher post: https://x.com/stealthmole_iol/status/1920733731049902129
Qilin listed the county’s historical cobbcounty.org domain as an alleged victim. Comparitech’s original report independently dates the listing to May 1, 2025; the tracker discovery timestamp is recorded separately. The group alleged more than 150 GB and threatened publication. May 2 reporting attributes descriptions of samples and 400,000 files to an outside expert; the county explicitly declined to verify those allegations. County disclosures separately confirm unauthorized file copying and a refused ransom demand. They do not confirm Qilin’s responsibility, the full file volume, sample authenticity or encryption.
A tracker entry identifies Qilin and the district’s exact official domain, bertie.k12.nc.us. It was discovered April 17, 2025, at 5:18 a.m. Eastern; the original posting and attack dates are unknown. The district’s April 9 outage notice does not identify a cyber cause. Attribution confidence is low: the claim does not establish responsibility, ransomware, data theft or a causal connection to the documented phone and internet outage.
Qilin listed Cleveland Municipal Court and threatened to publish data on March 21, 2025. Comparitech reported the listing March 18 and noted that the court had not verified responsibility or data theft. A separate contact told News 5 that they carried out the attack, demanded $4 million and later claimed a Qilin affiliation. The contact supplied purported files and negotiation screenshots; a security specialist cautioned that the person might instead have purchased data from someone else. The tracker’s March 18 discovery does not establish the original posting time. The court’s attribution, authenticated theft scope, attacker encryption and payment history remain unconfirmed.
A Qilin-attributed tracker listing names Lee Enterprises and lee.net. BleepingComputer’s Feb. 28, 2025, report describes the group’s allegation of 120,000 files totaling 350 gigabytes, purported document samples and a threat to publish by March 5. Lee said it was aware of the claims and investigating. The company’s independent confirmation of encryption and file exfiltration does not verify Qilin’s responsibility, the claimed volume or every sample. Tracker discovery on Feb. 27 precedes the report’s account of the listing on Feb. 28; the exact original claim publication time remains unverified.
Ransomware.live lists cityofwesthaven.com as an alleged Qilin victim, with discovery recorded Jan. 11, 2025, at 12:33:26.327796 UTC. The listing alleged that city data would become available Jan. 19. Its discovery time is not a verified original actor-post time or attack date. West Haven acknowledged a security incident and shutdown, but its statements do not independently confirm Qilin responsibility, encryption, a completed leak or ransom payment. Later reporting of affected people does not establish which actor was responsible; the city’s 2018 ransomware incident is a separate event.
Qilin listed Catawba County Government on its leak site, indexed Oct. 14, 2025. The county confirmed a cyber event but did not attribute it to Qilin or establish ransomware deployment or exfiltration. The listing is a low-confidence attribution claim.
Comparitech’s PrimaryPlus passage reports that Qilin claimed an attack earlier in December 2024. The provider acknowledged an IT security incident and service disruption but did not confirm Qilin’s responsibility, ransomware encryption, data theft, a ransom demand or payment. The original actor post, posting date and claimed data volume remain unestablished. The report primarily concerns a different California hospital; that hospital’s patient-care effects and technical details do not establish effects at PrimaryPlus.
Unresolved attribution: Comparitech refers to Green River, Wyoming as a data breach claimed by Qilin, while the same-name ransomware.live entry identifies www.greenriverutah.com and describes Utah. The reviewed evidence does not resolve that identity conflict or confirm Qilin responsibility, theft or a demand against the Wyoming city. Original listing publication is unverified; the Utah lead’s discovery timestamp is not assigned to this incident.
Searchlight New Mexico’s April 25, 2025, report reproduces a Qilin-signed ransom note on a university laptop. The note claims files and personal/financial information were stolen, threatens leak-site publication and offers a decryption tool and negotiation contact. This records the incident-specific claimant, not an independently verified Qilin intrusion or original public leak listing. Original claim publication/discovery times and original leak post URL are unknown. The later university breach notice independently confirms unauthorized access April 9–13 and copied files, but does not establish Qilin responsibility, all note categories, actual public data release or encryption of every affected system. Actor confidence remains low; no separate downstream-school claim is established.
