Close Menu

QILIN · Threat actor profile

// THREAT ACTOR

QILIN_

Active

Qilin (also tracked as Agenda) is a Rust- and Go-based ransomware-as-a-service operation that emerged in 2022. The group attracted significant attention after the 2024 attack on London-based pathology provider Synnovis, which disrupted multiple NHS hospitals and led to thousands of postponed procedures.

For Ransomnews editorial coverage of QILIN — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

2,079 Victims tracked
5 / 640 Active mirrors
2022-10-08 First listing
2026-08-06 Most recent

Victims by year

  • 2026 809
  • 2025 1,029
  • 2024 189
  • 2023 46
  • 2022 6

Leak site mirrors

640 mirrors tracked, 5 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion Qilin snapshot · 2023-02-17 14:02
  • 24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion
  • wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion Qilin snapshot · 2023-02-17 14:03
  • kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion DDOS Protection snapshot · 2025-05-10 12:01
  • wikileaksv2.com WikiLeaks snapshot · 2024-07-09 02:01
  • ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Qilin blog snapshot · 2026-08-06 21:11
  • 85.209.11.49 snapshot · 2024-12-10 19:05
  • 188.119.66.189 snapshot · 2024-12-10 19:05
  • 31.41.244.100. WikiLeaks V2 - New Version of the Legendary WikiLeaks Project snapshot · 2025-04-18 17:16
  • ijzn3sicrcy7quixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvad.onion snapshot · 2024-12-12 16:37
  • kbsqoiyihadmwczmxkbovk7ss2dcynitwhhfu5yw725dbogo5kthfaad.onion snapshot · 2024-12-12 16:37
  • ftp. snapshot · 2025-03-03 19:24
  • ftp. snapshot · 2025-03-03 19:24
  • ugefls6xolqo6anb6jydjtwqbr5h3st2stfo6j4or2hp7ak5zypwq2yd.onion snapshot · 2025-03-06 14:11
  • ftp. snapshot · 2025-04-17 19:26
  • 6d453sm6732jpr5gjs6zrjzysurnmrwi67624goptyly2xuz2kmjixad.onion Login snapshot · 2025-06-09 06:23
  • ftp. snapshot · 2025-06-03 15:31
  • ftp. snapshot · 2025-06-03 15:36
  • vn2untbh4etoqoc4rfsrzlautth7vm62swv7ohemsy4tgh3a4j5ykgyd.onion Login snapshot · 2025-08-11 16:17
  • p2zg4yqlsflg77opdzcjiu3reyj3wx2owwez2tcyv3vemmz7wbyccyqd.onion Login snapshot · 2025-10-10 17:14
  • ytdfc3dvgudgq4zyjwtipzbsu7arbiqvygfqdyqiygkvry2hy47oq2ad.onion Login snapshot · 2025-10-30 06:01
  • 22odvea7bampzr7k2dztbqda67fpau6hcy7sgn2npucaz5gcjmmzrgqd.onion snapshot · 2025-07-24 15:57
  • ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion Sign In snapshot · 2025-08-12 21:28
  • z2rmyu57rkmlsfif4lovlz36ph7lxmjiawilmeryfoupwnbuplm4suqd.onion Login snapshot · 2025-12-17 15:04
  • djixgstarlzvmqsqcewlsfxlqzwd3i2eqs24mccfrfvrhqihjmssahqd.onion Login snapshot · 2026-03-10 17:27
  • zlubnjgvsf6ifxswnvpfgvp36tlzubzggn4txk5mi5qgt377ytzai6yd.onion Login snapshot · 2025-10-05 12:02
  • ifjnyofk7xpdrqzp3pgyorwgoyrxjkjic4aqxcz4sjxjhbpewfoxngad.onion snapshot · 2025-08-16 08:30
  • wikileaks2.site WikiLeaks V2 - New Version of the Legendary WikiLeaks Project snapshot · 2025-12-16 07:03
  • ftp. snapshot · 2025-10-02 20:38
  • ftp. snapshot · 2025-10-30 19:00

Recent victims

The 50 most recent victims claimed by QILIN. Total in the index: 2,079.

Date listed Victim Description
2026-08-06 J&T Bank and Trust Banking
2026-08-06 AmSpec Business Services
2026-08-06 ALIZE (alize-sud.fr) Business Services
2026-08-06 Jakle & Alexander Law Firms & Legal Services
2026-08-06 Akuur Law Firm Law Firms & Legal Services
2026-08-06 Bloom Financials Accounting Services
2026-08-05 Mera Metal Furniture
2026-08-05 STADLER Sensorik CNC-Technik Industrial Machinery & Equipment
2026-08-05 Stade Francais Business Services
2026-08-05 Galvin Brothers Civil Engineering Construction
2026-08-05 RUPP Spritzguss Manufacturing
2026-08-04 WD Masonry & Concrete Construction
2026-08-04 Service Electric Software
2026-08-04 Universitatea De Vest Vasile Goldi Din Arad Education
2026-08-03 Freedom Claims Management Insurance
2026-08-02 INTERTRUST AUSTRALIA PTY LTD Real Estate
2026-08-02 Asset Flooring Group Australia Construction
2026-08-02 Mairie de Drancy Government
2026-08-02 The Saturday Evening Post Advertising & Marketing
2026-08-02 Commercial Furniture Interiors Architecture, Engineering & Design
2026-08-02 Dienst Pack Systems Industrial Machinery & Equipment
2026-08-02 Ceragres Home Improvement & Hardware Retail
2026-08-02 Pointe Property Group Real Estate
2026-08-02 Schreiner Trockenbau GmbH Home Improvement & Hardware Retail
2026-08-02 Wire Products Manufacturing
2026-07-31 Community Management Associates Real Estate
2026-07-31 Hawaii Family Dental Healthcare Services
2026-07-31 The Dcoop Agriculture
2026-07-31 Audio Precision, Inc Manufacturing
2026-07-30 Db Tarimsal Enerji Chemicals & Related Products
2026-07-30 TenSparrows Software
2026-07-30 Byonyks Manufacturing
2026-07-30 Prenisac Construction
2026-07-30 Excel Consultores Business Services
2026-07-30 Affinity Capital Finance
2026-07-30 Adpo Freight & Logistics Services
2026-07-30 servitelco Business Services
2026-07-30 Orimar Business Services
2026-07-30 Indian Motos Inmot Automotive Parts
2026-07-29 Hoc Freight & Logistics Services
2026-07-28 Gran valle negocios Real Estate
2026-07-27 Groupe Fenwick Business Services
2026-07-27 Savills France Construction
2026-07-27 Wilbert's Automotive Parts
2026-07-26 Universitatea de Vest „Vasile Goldiș” din Arad Education
2026-07-26 Contacto Garantido Finance
2026-07-25 Jubilee Jobs Non-Profit & Charitable Organizations
2026-07-25 Plitvička Jezera Nacionalni Park Advertising & Marketing
2026-07-25 The Myers Y Cooper Real Estate
2026-07-25 Principle Diagnostics Laboratory Healthcare Services

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.