Close Menu

QILIN · Threat actor profile

// THREAT ACTOR

QILIN_

Active

Qilin (also tracked as Agenda) is a Rust- and Go-based ransomware-as-a-service operation that emerged in 2022. The group attracted significant attention after the 2024 attack on London-based pathology provider Synnovis, which disrupted multiple NHS hospitals and led to thousands of postponed procedures.

For Ransomnews editorial coverage of QILIN — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

2,120 Victims tracked
4 / 640 Active mirrors
2022-10-08 First listing
2026-08-14 Most recent

Victims by year

  • 2026 850
  • 2025 1,029
  • 2024 189
  • 2023 46
  • 2022 6

Leak site mirrors

640 mirrors tracked, 4 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion Qilin snapshot · 2023-02-17 14:02
  • 24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion
  • wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion Qilin snapshot · 2023-02-17 14:03
  • kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion DDOS Protection snapshot · 2025-05-10 12:01
  • wikileaksv2.com WikiLeaks snapshot · 2024-07-09 02:01
  • ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Qilin blog snapshot · 2026-08-14 21:00
  • 85.209.11.49 snapshot · 2024-12-10 19:05
  • 188.119.66.189 snapshot · 2024-12-10 19:05
  • 31.41.244.100. WikiLeaks V2 - New Version of the Legendary WikiLeaks Project snapshot · 2025-04-18 17:16
  • ijzn3sicrcy7quixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvad.onion snapshot · 2024-12-12 16:37
  • kbsqoiyihadmwczmxkbovk7ss2dcynitwhhfu5yw725dbogo5kthfaad.onion snapshot · 2024-12-12 16:37
  • ftp. snapshot · 2025-03-03 19:24
  • ftp. snapshot · 2025-03-03 19:24
  • ugefls6xolqo6anb6jydjtwqbr5h3st2stfo6j4or2hp7ak5zypwq2yd.onion snapshot · 2025-03-06 14:11
  • ftp. snapshot · 2025-04-17 19:26
  • 6d453sm6732jpr5gjs6zrjzysurnmrwi67624goptyly2xuz2kmjixad.onion Login snapshot · 2025-06-09 06:23
  • ftp. snapshot · 2025-06-03 15:31
  • ftp. snapshot · 2025-06-03 15:36
  • vn2untbh4etoqoc4rfsrzlautth7vm62swv7ohemsy4tgh3a4j5ykgyd.onion Login snapshot · 2025-08-11 16:17
  • p2zg4yqlsflg77opdzcjiu3reyj3wx2owwez2tcyv3vemmz7wbyccyqd.onion Login snapshot · 2025-10-10 17:14
  • ytdfc3dvgudgq4zyjwtipzbsu7arbiqvygfqdyqiygkvry2hy47oq2ad.onion Login snapshot · 2025-10-30 06:01
  • 22odvea7bampzr7k2dztbqda67fpau6hcy7sgn2npucaz5gcjmmzrgqd.onion snapshot · 2025-07-24 15:57
  • ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion Sign In snapshot · 2025-08-12 21:28
  • z2rmyu57rkmlsfif4lovlz36ph7lxmjiawilmeryfoupwnbuplm4suqd.onion Login snapshot · 2025-12-17 15:04
  • djixgstarlzvmqsqcewlsfxlqzwd3i2eqs24mccfrfvrhqihjmssahqd.onion Login snapshot · 2026-03-10 17:27
  • zlubnjgvsf6ifxswnvpfgvp36tlzubzggn4txk5mi5qgt377ytzai6yd.onion Login snapshot · 2025-10-05 12:02
  • ifjnyofk7xpdrqzp3pgyorwgoyrxjkjic4aqxcz4sjxjhbpewfoxngad.onion snapshot · 2025-08-16 08:30
  • wikileaks2.site WikiLeaks V2 - New Version of the Legendary WikiLeaks Project snapshot · 2025-12-16 07:03
  • ftp. snapshot · 2025-10-02 20:38
  • ftp. snapshot · 2025-10-30 19:00

Recent victims

The 50 most recent victims claimed by QILIN. Total in the index: 2,120.

Date listed Victim Description
2026-08-14 FERRARI MANGIMI SRL Business Services
2026-08-14 Connections Hospitality
2026-08-14 Radiant Software
2026-08-14 Aletex Group Manufacturing
2026-08-14 Urban Worldwide Business Services
2026-08-14 Lercher Werkzeugbau Industrial Machinery & Equipment
2026-08-14 3f Membership Organizations
2026-08-14 PenLink Software
2026-08-13 D & J Beverage Service Grocery Retail
2026-08-12 United Association Local Union 345 Membership Organizations
2026-08-12 Wanted Business Services
2026-08-11 G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L Business Services
2026-08-11 Crown Group Business Services
2026-08-11 Service Evaluation Concepts Advertising & Marketing
2026-08-11 tommer construction Civil Engineering Construction
2026-08-10 HIGEN MOTOR(critical data) Industrial Machinery & Equipment
2026-08-10 City of Winchester Government
2026-08-10 B Wright Drywall Construction
2026-08-09 Energetic Development Corp Manufacturing
2026-08-09 Panda Logistics Taichung Branch Freight & Logistics Services
2026-08-09 East Field Corporation Accounting Services
2026-08-09 Chun Tai Sing Chemical Industry Chemicals & Related Products
2026-08-09 Synergy Interactive Business Services
2026-08-09 pm-energy Die Solarexperten Business Services
2026-08-09 Harplast SRL Business Services
2026-08-09 Price Shoes Retail · Pennsylvania
2026-08-09 Naval Interior Team Business Services
2026-08-09 Phithan Phanich Automotive Parts
2026-08-09 Grupo Diestra Hospitality
2026-08-09 Université Libre de Bruxelles Education
2026-08-09 Service d'usinage 9002 Industrial Machinery & Equipment
2026-08-08 Impact Centre Chrétien Business Services
2026-08-08 Clausing Food & Beverage
2026-08-08 CLLS Co Ltd Industrial Machinery & Equipment
2026-08-07 Astro Electroplating Industrial Machinery & Equipment
2026-08-07 Filtronic Manufacturing
2026-08-07 EISNER ZT GMBH Construction
2026-08-07 John C Saunders, CPA Accounting Services
2026-08-07 Nikan Awasisak Agency Government
2026-08-07 Depona Hospitality
2026-08-07 Crystal Pharmatech Business Services
2026-08-06 J&T Bank and Trust Banking
2026-08-06 AmSpec Business Services
2026-08-06 ALIZE (alize-sud.fr) Business Services
2026-08-06 Jakle & Alexander Law Firms & Legal Services
2026-08-06 Akuur Law Firm Law Firms & Legal Services
2026-08-06 Bloom Financials Accounting Services
2026-08-05 Mera Metal Furniture
2026-08-05 STADLER Sensorik CNC-Technik Industrial Machinery & Equipment
2026-08-05 Stade Francais Business Services

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.