D3/100
Malware · high
Who Runs the Ransomware Group Qilin?
Tier D · Background noise – Good to know
Who’s exposed: Organizations targeted by Qilin ransomware affiliate attacks
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild
The Brief
- Qilin has emerged as the most active ransomware affiliate program, according to Krebs on Security.
- The group claims at least 365 victim organizations in the past three months.
- Krebs reports that the group's administrator made operational security mistakes, which may help identify them.
Why it matters
Qilin's high volume of claimed attacks means organizations of any size face a real risk of ransomware, so developers should review backups, access controls and incident response for systems they run.
The checklist behind the tier
Checklist · 1 of 10 yes
| No | Hits tech teams | Judgment: Qilin is a criminal ransomware affiliate group, not software or services developers or IT teams run. |
| No | Core infrastructure | Judgment: A ransomware gang's operations are not core infrastructure software that nearly every team runs. |
| No | Popular tool | Judgment: Qilin is a criminal group, not a widely used framework, tool, platform, OS or package. |
| Yes | Exploited in the wild | Krebs on Security: Qilin claims at least 365 victim organizations in the past three months. |
| No | Public exploit | Krebs on Security: No published exploit code or proof-of-concept is mentioned in the source. |
| No | Remote, no login | Krebs on Security: The source does not describe unauthenticated network access as the attack method. |
| No | Full takeover | Krebs on Security: The source does not explicitly report code execution, root access or account takeover. |
| No | Secrets exposed | Krebs on Security: The source does not report stolen credentials, keys, configs, source code or customer data. |
| No | Supply chain | Krebs on Security: The source does not report compromise of a legitimate package, update or build pipeline. |
| No | No fix yet | Krebs on Security: This is a criminal group story, not an unpatched vulnerability, so no fix applies. |
Source
Who Runs the Ransomware Group Qilin? ↗ Krebs on Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided