Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Qilin (formerly Agenda) is a Russian-speaking ransomware-as-a-service operation that, following the decline of LockBit and ALPHV, became one of the most active ransomware brands globally through 2025-2026.
Qilin emerged in July 2022 as Agenda and rebranded to Qilin in late 2022. It operates a double-extortion RaaS with encryptors written in Go and Rust capable of targeting Windows, Linux and VMware ESXi. MITRE notes functionality overlaps with Black Basta, REvil and BlackCat. Affiliates typically gain access via phishing, exposed services and purchased access, exfiltrate data, and deploy ransomware across sectors including manufacturing, technology, financial services and healthcare.
As LockBit, ALPHV and RansomHub were disrupted or dissolved in 2024-2025, Qilin absorbed displaced affiliates and became one of the most prolific operations by victim count, with reporting citing hundreds of victims across 60+ countries and status as active and dominant into 2026. It also drew attention for high-profile healthcare disruption (e.g., the Synnovis/UK pathology incident attributed to a Qilin affiliate).
Qilin's leak site has listed victims in the UAE, Egypt and Saudi Arabia among its international claims. These listings are extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.
+102 more relationships — see the relationships browser.
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.