Qilin is a financially motivated ransomware-as-a-service (RaaS) operation that first emerged in June 2022 under the name "Agenda" and rebranded to "Qilin" by September 2022. The group shifted to a RaaS model in February 2023, offering its tools and infrastructure to affiliates. Qilin is assessed with moderate confidence to be of Russian or Eastern European origin, indicated by its policy of avoiding targets in Commonwealth of Independent States (CIS) countries and use of Russian-language forums for affiliate recruitment. Its primary motivation is financial gain through double extortion, involving both data encryption and exfiltration. What sets Qilin apart is its cross-platform capability, utilizing ransomware variants written in both Golang and Rust to target Windows, Linux, and VMware ESXi systems, along with a highly customizable approach that allows affiliates to tailor attacks, encryption methods, and evasion techniques to specific victims. The group's notable growth and activity in 2025 and 2026 have positioned it as one of the most prolific RaaS groups.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.