The group's name and branding draw on the qilin (Chinese: 麒麟), a mythological creature from East Asian traditions regarded as an omen of sage rulers and benevolent prosperity. The ransomware operators selected the name deliberately -- a creature associated with ancient power and good fortune, repurposed as threat branding.

Qilin Data Leak Site (DLS) The Tor-hosted DLS where Qilin lists victims, posts countdown timers, and publishes exfiltrated data. The site displays the group's qilin/dragon-style logo alongside victim entries with data volume claims and download links. Source: SANS Institute, "The Evolution of Qilin RaaS" (Oct 2025)

"Qilin Network" Affiliation Branding In March 2025, the Arkana Security extortion group displayed a "Qilin Network" logo on its DLS "About and Contact" page, signaling an affiliation relationship. This shows Qilin's branding extending into a broader network structure. Source: SANS Institute, "The Evolution of Qilin RaaS" (Oct 2025)

Affiliate Self-Identification April 2025: affiliate "Devman" included "Pwn3d By Qilin & Devman" in a victim post, demonstrating the RaaS affiliate layer's independence. Ransom demand disclosed: $60,000 USD. SANS Institute (Oct 2025)

Operator "Haise" on RAMP Forum June 2025: Qilin administrator "Haise" announces a "call lawyer" legal intimidation feature for the affiliate panel on RAMP -- designed to amplify regulatory and compliance pressure on victims. SANS Institute (Oct 2025)

The Mythological Qilin (Kirin, 1666) Ink drawing by Kano Tan'yu (1602-1674), Edo period. The qilin is a chimerical creature from Chinese mythology -- dragon-like head, scaled body, deer hooves, often depicted with sacred flames. Regarded as a benevolent omen heralding just rulers. Public domain. Wikimedia Commons / Kano Tan'yu, 1666

Agenda ransomware was first publicly analyzed in July-August 2022, with early victims reported in Indonesia and Saudi Arabia. The group began operating its dedicated data leak site under the "Qilin" brand around late 2022. Most contemporary vendor reporting treats the Agenda and Qilin names as referring to the same underlying operation. [1] [2] [4]

A forum profile operating under the handle "Haise" joined the RAMP cybercrime forum on May 29, 2022 and advertised Qilin on February 13, 2023. This is the clearest open-source data point linking a specific operator alias to the group's founding period. [12] Note: A July 2025 Telegram channel claiming to be Europol offered a $50,000 bounty for information on Qilin administrators "Haise" and "XORacle" -- Europol confirmed this channel was a scam and no such bounty exists. The aliases themselves appear in prior legitimate forum tracking and are treated as credible at the handle level.

Open-source and vendor analysis consistently presents Qilin/Agenda as a standalone operation, not a rebranded or direct successor to any prior named group such as Conti, Hive, or REvil. No multi-source evidence of code forking from a specific predecessor has been confirmed. Some features (multi-threaded encryption, service killing, safe-mode rebooting) mirror common patterns across the Russian-language RaaS ecosystem but do not establish lineage. [4] [11] [5]

Confidence that Qilin is a direct code fork of a specific prior group: LOW. Confidence that the group's operators have familiarity with Russian-language RaaS tradecraft: HIGH.

Qilin has no confirmed parent-organization designation comparable to Wizard Spider (CrowdStrike) or Gold Ulrick (Secureworks) for Conti. Vendors that have published formal designations for Qilin itself include SentinelOne, Group-IB, Check Point, KELA, Blackpoint Cyber, Darktrace, and FortiGuard Labs. CrowdStrike, Mandiant, and Secureworks have not confirmed public group-specific designations for Qilin as of May 2026, though detailed profiles may exist behind paywalls. [4] [11] [10] [12] [5]

Qilin operates as a Ransomware-as-a-Service platform. Core operators maintain the payload, affiliate panel, negotiation infrastructure, and data leak site. Affiliates conduct intrusions, exfiltration, and encryption, then share revenue with the platform. [9] [10] [11] [12] [5]

Affiliate recruitment occurs on Russian-language cybercrime forums. The platform is assessed as affiliate-friendly: Blackpoint Cyber reports affiliates retain 80% of ransoms below $3 million and 85% for ransoms above $3 million, with the core team retaining the remainder. This split is at the high end of documented RaaS norms. [5]

In Q2 2024, Microsoft (Threat Intelligence) attributed Octo Tempest / Scattered Spider as a Qilin affiliate, representing a significant escalation: Scattered Spider brings sophisticated social engineering and cloud environment capabilities to Qilin's payload. [Credible - Microsoft attribution; no corroborating independent confirmation in open sources as of research date]

• Double extortion (standard): Data exfiltrated prior to encryption creates two independent leverage points. All Qilin incidents involve both components. [2] [10] [4] [11] [12] [5]
• Triple extortion (documented, not systematic): Qilin has threatened to contact customers, regulators, and media to amplify reputational damage. Not documented as a formalized "phase" but present in multiple incident accounts. [6] [14]
• Teaser-to-full-dump progression: DLS publications begin with sample data, escalating to full dataset publication if negotiations fail. Claimed exfiltration volumes include 550 GB (The Big Issue parent company) and 400 GB (Synnovis). [6] [B1]
• Countdown timers: DLS posts include deadlines that, when missed, trigger ransom increases or accelerated publication. [6]

Negotiations are conducted through a Tor-hosted victim negotiation portal, accessed via a unique URL in the ransom note. Initial demands for large enterprise targets reach into the millions. Negotiators and incident responders report reductions of 30-50% or more during active negotiations, though hard statistics are sparse. Qilin communication is professional and coercive, emphasizing data control leverage. [13] [14] [5]

Some affiliate-dependent variation in victim communication has been documented, with TOX/email handles appearing in ransom notes alongside Tor portal references depending on the affiliate. [5] [13]

No public universal decryptor exists for any Qilin/Agenda variant as of May 2026. The No More Ransom portal does not list a Qilin decryptor. Case-by-case recovery via backup restoration or operational mistake exploitation is documented but not indicative of a cryptographic flaw. [7] [4] [13]

Qilin is assessed to exclude CIS-region targets. Binary analysis documents locale and language checks (Russian keyboard/language settings). No CIS-region organization has been publicly documented as a Qilin victim across three-plus years of operation. This pattern is consistent with Russian-language RaaS operating norms and the safe-harbor dynamic observed across the broader ecosystem. Direct sample-level CIS exclusion code is less consistently described in public write-ups than the behavioral pattern warrants. [13] [5]

Qilin demands ransoms in Bitcoin, the dominant cryptocurrency in its observed ransom notes. Per-incident unique Bitcoin addresses are used, directing funds to victim-specific wallets before aggregation. Some affiliate flexibility in accepting alternative cryptocurrencies has been suggested in incident reporting but is not systematically documented. [13] [5]

No aggregate revenue figure for Qilin has been confirmed in open-source reporting. Given documented victim volume (~958 in 2025), enterprise targeting profile, and typical RaaS ransom magnitudes in the hundreds of thousands to millions of dollars, Qilin is assessed in the upper tier of contemporary RaaS operations by revenue generation. This is an ANALYST INFERENCE based on volume and targeting profile, not a confirmed figure.

Qilin targets organizations across North America, Europe, and Latin America, with consistent reporting of U.S. dominance. SOCRadar specifically identifies the U.S., Brazil, and Argentina as primary target countries. UK-based organizations have been disproportionately represented in high-profile incidents (Synnovis, The Big Issue parent). No CIS-region victims documented. [2] [3] [6] [7] [8]

Qilin demonstrates positive selection for targets where operational disruption and data exposure create maximum leverage: critical infrastructure with low tolerance for downtime (healthcare), time-sensitive services (media/publishing), and organizations managing sensitive personal or financial data. The RaaS model creates heterogeneity in targeting -- more capable affiliates pursue enterprise targets while less sophisticated affiliates may target smaller organizations as collateral.

Negative selection (CIS avoidance) is consistent with documented binary behavior and the absence of any CIS victim across the group's operational history.

No U.S., UK, EU, or other public indictment has named any individual as a member of Qilin. No arrest attributable to Qilin operations has been publicly announced. This is an assessed intelligence gap, not proof that investigations are absent. [5] [13] [8]

Neither "Qilin" nor "Agenda" appears in OFAC's Specially Designated Nationals list. No Qilin-linked wallet has been OFAC-designated in open-source data. This gap could change rapidly given the group's healthcare targeting profile and NHS-level impact. [13] [5]

Qilin's Tor-hosted data leak site and negotiation portal remain operational as of May 2026. No large-scale seizure of Qilin's core infrastructure has been publicly announced. Isolated sinkholing of affiliate-used C2 nodes is possible but not documented under the Qilin name. [5]

No public universal decryptor for any Qilin or Agenda variant is available through the No More Ransom portal or any publicly disclosed vendor release as of May 2026. Recovery in documented incidents has relied on unaffected backups or, in isolated cases, operational mistakes by affiliates. No systemic cryptographic flaw has been publicly identified. [7] [4] [13]

Qilin is consistently assessed as a Russian-language, likely Russia-based or CIS-based criminal group. Supporting indicators: Russian-language forum recruitment and operator communications; CIS exclusion behavior across three-plus years of operation; SOCRadar, KELA, and Group-IB all formally characterize origin as Russian; Ecuador's ECUCERT advisory characterizes it as Russian-origin. [13] [12] [5]

The only named aliases associated with Qilin leadership in open-source reporting are "Haise" (RAMP forum, documented joining May 2022, Qilin advertisement February 2023) and "XORacle" (referenced only in the July 2025 fake Europol Telegram post). Europol confirmed the Telegram channel was not genuine. Neither alias has been attributed to a real-world identity in any public law enforcement action.

Confidence that "Haise" is a legitimate Qilin operator alias: CREDIBLE (documented forum record predating the fake Europol post). Confidence that real identity is known to open sources: LOW / NOT CONFIRMED.

No leaked communications, indictments, or credible technical reporting ties Qilin to FSB, SVR, GRU, or any other Russian state service. No evidence of overt intelligence collection on behalf of a state actor. No state-directed targeting has been documented.

The combination of CIS avoidance, Russian-language operation, and absence of domestic prosecution is consistent with a de facto safe harbor -- the expectation of non-prosecution in exchange for avoiding CIS targets -- that characterizes the broader Russian cybercrime ecosystem. This is an analytic inference about ecosystem dynamics, not a documented agreement. [5] [13] [12]

Microsoft Threat Intelligence (mid-2024) reported that Octo Tempest, also known as Scattered Spider (CrowdStrike), had become a Qilin affiliate. Scattered Spider is a financially motivated, English-language threat group known for sophisticated social engineering, SIM-swapping, and cloud environment exploitation. Its adoption of Qilin as a payload represents a convergence of Western social engineering capability with Russian-language RaaS infrastructure. This affiliation does not indicate a state nexus but does materially expand the attacker population capable of deploying Qilin.

• Continuous operation since July 2022 with no prolonged disappearance or disruption. [1] [3] [4] [11]
• No leaked internal communications, affiliate disputes, or visible internal fragmentation analogous to Conti's May 2022 collapse. [4] [12] [5]
• Active payload development cycle: Go to Rust transition, NETXLOADER integration, Chrome credential GPO technique all represent non-trivial development investment. [TM1] [S1] [4]
• Affiliate pool expansion: Scattered Spider adoption as an affiliate in 2024 demonstrates the group's attractiveness to sophisticated Western actors. [Microsoft]

No major vendor characterizes Qilin as a direct extension or rebrand of a prior named top-tier group. Mandiant and Recorded Future have not published a formal cluster assessment connecting Qilin to a specific parent organization as of May 2026 open-source research. [4] [11] [5] [1] [12]

Current signals do not suggest imminent rebranding. Qilin is at peak operational visibility and volume -- conditions that historically precede rebranding are present (law enforcement attention, SLTT-level advisories) but have not yet materialized into the infrastructure seizure or key arrest that typically triggers rebrand decisions. If law enforcement action targets Qilin in 2026, a rebrand within 60-90 days would be consistent with precedent from other Russian-language RaaS operations. [ANALYST INFERENCE]

• Real identities, locations, and organizational hierarchy of core operators and leading affiliates.
• Dedicated on-chain wallet attribution from TRM Labs, Chainalysis, or Elliptic.
• Any non-public law enforcement investigations or coordinated actions not yet disclosed.
• Precise ransom demand distributions, negotiation reduction rates, and aggregate revenue figures.
• Scope of any additional CVE exploitation chains beyond FortiOS and SAP NetWeaver vulnerabilities currently documented.