Qilin
Qilin is a Russia-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 20 sectors, including Government and Technology, in 99 countries, including the United States and the United Kingdom. It uses 127 MITRE ATT&CK techniques and exploits 18 known CVEs.
- Qilin Team
- Water Galura
- Qilin Ransomware
- Agenda
- GOLD FEATHER
- Origin
- Russia
- Techniques
- 127
- Exploited CVEs
- 18
- First seen
- Oct 8, 2022
- Last seen
- Sep 8, 2026
- Record updated
Who They Target.
About Qilin.
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion, demanding payment for a decryptor, as well as for the non-release of stolen data.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.