ThreatVectr
Tag

#Qilin

13 stories taggedQilin.

Illustration: A dimly lit hospital corridor at night
Ransomware

A Russian man, a fatal London hack and a possible world-first murder inquiry

German police have detained a 28-year-old Russian national they say is a core Qilin member. The arrest ties directly to the 2024 Synnovis ransomware attack, which disrupted thousands of NHS appointments and contributed to a patient's death.

3 min read
Illustration: An empty school corridor at dusk, fluorescent lights flickering overhead
Ransomware

Qilin Ransomware Gang Claims Attack on Joliet Public Schools District 86

The criminal group has listed the Illinois school district on its dark-web extortion site. The district has not confirmed any incident, and the claim could not be independently verified.

3 min read
Illustration: a dimly lit server room with rows of blinking rack servers casting cool blue and amber light across the floor
Ransomware

Qilin ransomware group claims attack on US law firm Iliff, Meredith, Wildberger & Brennan

The criminal group listed the Pennsylvania professional-services firm on its dark-web site on 13 October 2026. No public confirmation exists.

3 min read
Illustration: A darkened server room with rows of blinking rack-mounted servers casting faint blue and amber light
Ransomware

Qilin Ransomware Gang Claims Attack on Glenhardie Country Club

The criminal group has listed the Pennsylvania hospitality venue on its dark-web extortion site. The club has not confirmed any incident, and the claim remains unverified.

2 min read
Illustration: A polished corporate office at night
Ransomware

MonsterCloud Owner Charged After Secretly Paying Ransoms While Billing Clients $19 Million for 'Decryption'

Zohar Pinhasi told ransomware victims his company could unlock their data without paying criminals. Federal prosecutors say he was paying the criminals all along, then marking up the bill by as much as 1,700 percent.

4 min read
Illustration: a high-security airport arrivals corridor at night
Ransomware

Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany

A 28-year-old Russian national faces charges in Germany over a $160,000 extortion of a logistics company. The arrest comes as Qilin keeps up a punishing pace, and as a critical flaw in widely used VPN software gives the group a fresh way in.

3 min read
A dimly lit server room with rows of blinking rack-mounted servers, a faint red glow emanating from indicator lights, condensation on a glass panel in the foreg
Ransomware

Qilin Ransomware Group Claims Attack on US Lender Genesis Credit Management

The criminal group has listed the Texas-based financial services firm on its dark-web pressure site. No breach has been confirmed, and the claim has not been independently verified.

3 min read
Illustration: a dimly lit server room with four identical rack cabinets, each glowing a different colour (red, amber, blue
Ransomware

Microsoft names Storm-2570, the affiliate hopping between Qilin, DragonForce and other ransomware crews

The same intruder, the same toolkit, four different ransom notes. Microsoft says defenders who chase payloads keep missing the person behind them.

3 min read
A federal government building's security entrance with warning notices about a cybersecurity breach, alongside dark web marketplace listings displayed on an inv
Ransomware

US firearms agency ATF confirms 'major incident' as Qilin ransomware gang lists it as a victim

The Bureau of Alcohol, Tobacco, Firearms and Explosives says a standalone system was breached. Qilin added ATF to its dark web leak site the same day.

3 min read
A VPN gateway device with attack visualizations flowing across its display, ransomware propagation paths highlighted in red, an AI agent's autonomous actions sh
Ransomware

Ransomware gangs are going after VPNs, and an AI just ran its own attack

Ransomware attacks rose for the fourth month in a row in June, with criminals targeting the devices companies use to connect remote workers. A new AI-driven attack completed an entire break-in with no human at the keyboard.

3 min read
A Check Point network management console showing unauthorized administrator login activity, security logs displaying unrestricted access granted without credent
Vulnerabilities

Hackers Are Actively Exploiting a Flaw in Check Point Security Software

A newly discovered hole in Check Point's network management tools let attackers log in as administrators without a password. Real attacks were already happening before the patch arrived.

3 min read
Illustration: a dimly lit server room with a rack-mounted enterprise firewall appliance glowing red on its status LEDs
Ransomware

Qilin ransomware crew is breaking into Palo Alto VPNs through an unpatched flaw

Arctic Wolf says multiple Qilin affiliates are exploiting CVE-2026-0257 in Palo Alto Networks firewalls to encrypt whole networks. Over 167,000 VPN instances remain exposed online.

3 min read
Illustration: a circuit board with green and amber indicator lights glowing in low light
Threat Intelligence

Mistic Backdoor Ties to IAB Selling Enterprise Footholds to Ransomware Gangs

A new in-memory backdoor named Mistic has been active since April, and the threat actor behind it has reportedly funneled access to Qilin, Akira, Black Basta, and others.

3 min read
© 2026 Threat Vectr