Campaign DetailSource-backed corpus

qilin Ransomware / Extortion Operations

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Last updated May 24, 2026, 8:00 PM EDT

Actor Mapping

Mapped Threat Actors

qilin

Targeting

Target Sectors / Countries

Cross-industry

Tradecraft

ATT&CK / Techniques

T1078T1190T1566T1566.003T1059.001T1059.004T1569T1569.002T1037T1053

Tools / Observables

Malware, Tools, CVEs

Ransom note or extortion communications

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

Ransomware group and victim claims are often adversary-controlled. Validate actor linkage, malware, and impact with incident evidence.

IntelliOS

Related Intel Products

None Found

Citations

Source Trust / Citations

[1] qilin - Ransomware.live group profileRansomware.live