Home › Threat Actors › Qilin
← All Threat Actors
Cybercrime critical Eastern Europe (Russia-linked, assessed)

Qilin

Ransomware-as-a-Service operation (Russia-linked, assessed) · Financial — ransomware and extortion

Reports 2
Active Since 2022
Last Reported 1 Jul 2026
Sectors Targeted healthcare, critical-infrastructure, finance, communications, government

Tactics, Techniques & Procedures (TTPs)

  • Multi-vendor VPN authentication bypass exploitation — simultaneous targeting across Check Point, Palo Alto, Fortinet, and F5
  • CVE-2026-50751 (Check Point IKEv1 auth bypass) exploited as zero-day for 37 days before any patch existed
  • Sliver C2 framework for persistent access and lateral movement
  • Rclone data exfiltration to attacker-controlled cloud storage before encryption
  • Tox protocol for operator communications
  • Cross-platform ransomware deployment — Windows, Linux, ESXi, and Nutanix environments
  • Double-extortion model: data exfiltration followed by encryption

Known Targets

Financial services organisationsHealthcare providers (UK and US)Critical infrastructure operatorsEnterprise networks across multiple sectors globally

Analyst Notes

Qilin affiliates conducted a coordinated multi-vendor VPN perimeter exploitation campaign in May–June 2026, systematically targeting authentication bypass vulnerabilities across four enterprise VPN platforms simultaneously. The Check Point exploitation window (7 May–4 June 2026) — 37 days with no patch available — represents one of the longest recent zero-day exploitation periods against enterprise security infrastructure. Infrastructure hosted across Kaupo Cloud HK, Shock Hosting, and Vultr. A disgruntled Qilin affiliate founded The Gentlemen ransomware operation in mid-2025 following a commission dispute, demonstrating the volatility of RaaS affiliate relationships. The group has previously targeted UK NHS-adjacent healthcare organisations.

Also Known As

Qilin (Agenda ransomware predecessor)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1486 Data Encrypted for Impact T1041 Exfiltration Over C2 Channel T1490 Inhibit System Recovery T1562.001 Impair Defenses: Disable or Modify Tools

Intelligence Reports

Analysis healthcarecritical-infrastructure

Qilin: The Ransomware Group Behind the NHS Synnovis Attack and the Chrome Credential Theft Innovation

Qilin emerged in 2022 as Agenda ransomware and has evolved through a complete Rust rewrite, a defining attack on NHS blood supply services in 2024, a novel Chrome browser credential theft technique, and a 2026 VPN exploitation campaign hitting four major vendors simultaneously. This deep dive covers the full operational and technical profile.

1 Jul 2026 · 15 min read
Briefing financehealthcare

Qilin Ransomware Affiliate Exploiting Authentication Bypasses Across Four VPN Platforms in Coordinated Campaign

A Qilin ransomware affiliate is systematically exploiting authentication bypass vulnerabilities across Check Point, Palo Alto Networks, Fortinet, and F5 VPN infrastructure simultaneously — with a month-long zero-day window on the Check Point flaw before any patch existed.

9 Jun 2026 · 4 min read