Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Active · #1 by victimsRansomware group

Qilin

As of Oct 19, 2026, Qilin has listed 2,369 confirmed victims on its leak site since Feb 20, 2023, 7.3% of all victims tracked by Brandefense. Its most targeted country is United States (46.8% of its victims) and its most targeted sector is Manufacturing.

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion - demanding payment for a decryptor, as well as for the non-release of stolen data.

Is My Company Listed?Follow QilinRequest IOC FeedTTPs, CVEs and malware →

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
2,369
Rank By Victims
#1
Last Leak-Site Post
Oct 18, 2026
Top Country
United States
Top Sector
Manufacturing

Victims Posted Per Month.

Qilin confirmed victims per month
MonthConfirmed victims
November 2025103
December 2025176
January 2026110
February 2026115
March 2026138
April 2026111
May 2026111
June 202678
July 2026128
August 2026162
September 202673
October 2026 (month in progress)62
Updated continuously · figures as of Oct 19, 2026

Latest Qilin Victims.

Search all 2,369 →
Latest confirmed leak-site victims claimed by Qilin
VictimCountryIndustryData claimedPosted
Belcorp
belcorp.biz
PEPeruRetailNot stated
Llano Independent School District
llanoisd.org
USUnited StatesEducation and ResearchNot stated
BRUTRA Logistek
brutra-logistiek.nl
NLNetherlandsTransportation and LogisticsNot stated
Pengurusan Aset Air Berhad
paab.my
MYMalaysiaEnergy and UtilitiesNot stated
Pergande
pergande.de
DEGermanyManufacturingNot stated
Mastelli S.r.l.
mastelli.com
ITItalyHealthcareNot stated

How They Operate.

Qilin's threat actor profile lists 127 ATT&CK techniques, 18 exploited CVEs, 138 malware and tools, with its targets and related actors.

TTPs, CVEs and malware →

Who Qilin Targets.

Sectors

  1. Manufacturing1958.2%
  2. Consulting1757.4%
  3. Construction1395.9%
  4. Technology1335.6%
  5. Healthcare1024.3%

Countries

  1. USUnited States1,10946.8%
  2. CACanada1195.0%
  3. FRFrance1074.5%
  4. GBUnited Kingdom843.5%
  5. DEGermany833.5%
Shares are of this group's confirmed victims.

History.


  1. First confirmed victim listed on its leak site

  2. First seen in Brandefense data

  3. Busiest month on record: 191 confirmed victims

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.