RaqibCTI ⌘K
Qilin (fka Agenda) · Ransomware · RaqibCTI
Knowledge / Actors / Qilin (fka Agenda) Corpus Ransomware
Qilin Agenda Water Galura (assessed)
Attribution
RaaS (Russian-speaking, unattributed to a state)
Origin
Unknown (Russian-speaking operators assessed)
Motivation
Financially motivated (ransomware)
Attribution confidence
medium
MENA targeting
UAE, Egypt, Saudi Arabia
Sectors
Logistics, energy, IT services, healthcare
Corpus activity · 6mo 2 mentions
Aug 2026: 1 Sep 2026: 1 A M J J A S
Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Why it matters Ransomware actor, medium confidence, documented targeting UAE, Egypt, Saudi Arabia (Logistics, energy, IT services sectors).
What's next No pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Coverage robustness · vs this actor How evasion-resistant our detection coverage is against Qilin (fka Agenda)'s techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.
Techniques with a robust rule
0%
Techniques with any detection
26 / 51
Mean robustness (of covered)
2.1
Known tooling · Ransomware Tool Matrix Tools observed in intrusions leading to Qilin (fka Agenda)'s ransomware, per the community Ransomware Tool Matrix — observed use, not exhaustive. Snapshot 2026-08-07.
Technique overlap
← Cl0p actor Technique overlap ← Lynx actor Technique overlap ← APT33 actor Technique overlap → WIRTE actor Technique overlap ← Nova actor Technique overlap ← 8Base actor Technique overlap ← Monti actor Technique overlap ← Gunra actor Technique overlap 6 source reports · latest 25 April 2025
Claimed victims · 26 tracked Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches . Metadata only. MENA Ransomware Watch →
Claim volume · last 12 months
Feb 2026: 1 Mar 2026: 3 Apr 2026: 4 May 2026: 2 Jun 2026: 3 Jul 2026: 6 Aug 2026: 4 Sep 2026: 3 O N D J F M A M J J A S
Date Victim Country Sector 2026-09-21 Telrad Networks Israel Technology 2026-09-20 Zorlu Holding Türkiye Manufacturing 2026-09-02 Uak University Türkiye Education 2026-08-30 Black Cat Engineering Construction Wll Qatar Manufacturing 2026-08-24 A&E + SMA Design UAE Professional Services 2026-08-23 Black Cat Engineering & Construction WLL Qatar Manufacturing 2026-08-06 Akuur Law Firm Türkiye Professional Services 2026-07-30 Db Tarimsal Enerji Türkiye Agriculture and Food Production 2026-07-23 Assos Pharmaceuticals Türkiye Healthcare 2026-07-19 Synergy Products Türkiye Manufacturing 2026-07-10 Navana Real Estate UAE Retail & E-Commerce 2026-07-10 Eurodefi Morocco Financial Services
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
Malware Qilin co-mentioned in 2 items Country United States co-mentioned in 2 items Country Japan co-mentioned in 1 item Malware AiLock co-mentioned in 1 item Malware Responder co-mentioned in 1 item Malware impacket-partial-mic co-mentioned in 1 item Country Taiwan co-mentioned in 1 item Malware RansomEXX co-mentioned in 1 item CVE CVE-2020-1472 co-mentioned in 1 item Sector transportation and warehousing co-mentioned in 1 item Malware RustHound co-mentioned in 1 item Malware NetRunner co-mentioned in 1 item Sector
Manufacturing
co-mentioned in 1 item
Sector health care/social assistance co-mentioned in 1 item
Sector finance and insurance co-mentioned in 1 item
Sector professional, scientific, and technical services co-mentioned in 1 item
Sector services co-mentioned in 1 item
Malware The Gentlemen co-mentioned in 1 item
Sector retail trade co-mentioned in 1 item
CVE CVE-2025-24799 co-mentioned in 1 item
Malware Stormous co-mentioned in 1 item
Sector Construction co-mentioned in 1 item
Sector wholesale trade co-mentioned in 1 item
Sector educational services co-mentioned in 1 item
Malware LockBit 5.0 co-mentioned in 1 item
Country Philippines co-mentioned in 1 item
CVE CVE-2025-2479 co-mentioned in 1 item
Malware SafePay co-mentioned in 1 item
Sector information and communications co-mentioned in 1 item
Malware NightSpire co-mentioned in 1 item