Qilin is a ransomware-as-a-service (RaaS) operation that emerged in July 2022, initially known as Agenda, and rebranded to Qilin by September 2022. The group's structure operates on an affiliate model, which it has actively recruited for since late 2023, allowing other threat actors to deploy its customizable ransomware. Assessed to be of Russian origin, Qilin’s motivation is purely financial gain through extortion. The group is notable for its cross-platform ransomware variants, written in Go and Rust, and its aggressive approach, including the recent adoption of a "Call Lawyer" feature in mid-2025 to pressure victims during negotiations, and a claimed alliance with LockBit and DragonForce in September 2025. Qilin ransomware payloads often contain a language kill switch to avoid targeting systems in Commonwealth of Independent States (CIS) countries.

Aliases del actor

agendaNanometrics para operar en la oscuridad

Actores similares

Affilates Blacklist from NOVA, QILIN, DragonForcethreat-actor · 0