Qilin (fka Agenda)

Qilin emerged in July 2022 as Agenda and rebranded to Qilin in late 2022. It operates a double-extortion RaaS with encryptors written in Go and Rust capable of targeting Windows, Linux and VMware ESXi. MITRE notes functionality overlaps with Black Basta, REvil and BlackCat. Affiliates typically gain access via phishing, exposed services and purchased access, exfiltrate data, and deploy ransomware across sectors including manufacturing, technology, financial services and healthcare.

As LockBit, ALPHV and RansomHub were disrupted or dissolved in 2024-2025, Qilin absorbed displaced affiliates and became one of the most prolific operations by victim count, with reporting citing hundreds of victims across 60+ countries and status as active and dominant into 2026. It also drew attention for high-profile healthcare disruption (e.g., the Synnovis/UK pathology incident attributed to a Qilin affiliate).

Qilin's leak site has listed victims in the UAE, Egypt and Saudi Arabia among its international claims. These listings are extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.