- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- 2022–2025
- Status
- Active
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0897 · qilin
What it is
Qilin is a ransomware group that first appeared in 2022 but had a breakout year in 2024, with around 200 victims, 156 of them based in the U.S.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Agenda, Qilin Gang, Qilin Group, Qilin Ransomware, Qilin Team
Targets
- Sectors
- Critical Infrastructure, Government, Healthcare, Manufacturing
Tools
The tools and malware families the sources tie to it.
- Agenda
- Qilin