qilin
First seen October 8, 2022Active2,262 claimed victims
The claims below are reproduced as posted by qilin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| agrofair | July 29, 2025 | ransomware_live | — |
| [Redacted] | July 24, 2025 | ransomware_live | — |
| morgan911.org | July 24, 2025 | ransomware_live | — |
| jaegerndorfer.at | July 23, 2025 | ransomware_live | — |
| Krusell | July 21, 2025 | ransomware_live | — |
| chainstoreguide.com | July 21, 2025 | ransomware_live | — |
| danielslawgroupllc.com | July 21, 2025 | ransomware_live | — |
| Metricon Homes | July 21, 2025 | ransomware_live | — |
| jtekt.eu | July 21, 2025 | ransomware_live | — |
| ARCTICGROUP | July 19, 2025 | ransomware_live | — |
| Tiger Communications | July 18, 2025 | ransomware_live | — |
| WIBAIE | July 18, 2025 | ransomware_live | — |
| sotaconstruction.com | July 18, 2025 | ransomware_live | — |
| Specialty Components | July 16, 2025 | ransomware_live | — |
| joseantoniorodriguez.com | July 16, 2025 | ransomware_live | — |
| KEP Credit Union KEP | July 16, 2025 | ransomware_live | — |
| Yapi Teknik Proje | July 16, 2025 | ransomware_live | — |
| ProActive Solutions USA | July 15, 2025 | ransomware_live | — |
| The Paul Wilkinson Law Firm | July 15, 2025 | ransomware_live | — |
| City of Green River | July 15, 2025 | ransomware_live | — |
| WH Rogers Sheet Metal | July 15, 2025 | ransomware_live | — |
| Halvorsen Family Law Group | July 15, 2025 | ransomware_live | — |
| studebakersubmetering.com | July 15, 2025 | ransomware_live | — |
| venturecreditunion.com | July 15, 2025 | ransomware_live | — |
| www.meduane-habitat.fr | July 15, 2025 | ransomware_live | — |
| alpresor.se | July 14, 2025 | ransomware_live | — |
| pinnacle Roofing and Exteriors | July 13, 2025 | ransomware_live | — |
| VM Racing | July 13, 2025 | ransomware_live | — |
| apderm.com | July 13, 2025 | ransomware_live | — |
| www.intereum.com | July 11, 2025 | ransomware_live | — |
| fuld.com | July 11, 2025 | ransomware_live | — |
| Media Broadcast Satellite | July 11, 2025 | ransomware_live | — |
| Kengen | July 9, 2025 | ransomware_live | — |
| ResourceEnergy | July 8, 2025 | ransomware_live | — |
| http://www.balkankalip.com | July 8, 2025 | ransomware_live | — |
| www.balkankalip.com | July 8, 2025 | ransomware_live | — |
| Ridewill SRL | July 7, 2025 | ransomware_live | — |
| volpatoindustrie.it | July 7, 2025 | ransomware_live | — |
| knightknox | July 4, 2025 | ransomware_live | — |
| Mainetti | July 2, 2025 | ransomware_live | — |
| fcsserves.org | July 2, 2025 | ransomware_live | — |
| atlantissubmarines | July 2, 2025 | ransomware_live | — |
| QUINTADAMARINHA.com | July 2, 2025 | ransomware_live | — |
| https://www.injusa.com/ | July 2, 2025 | ransomware_live | — |
| PDC www.cobranzasbeta.com.co | July 2, 2025 | ransomware_live | — |
| ryeco.com | July 2, 2025 | ransomware_live | — |
| LP Charpente | July 1, 2025 | ransomware_live | — |
| capmark.org | July 1, 2025 | ransomware_live | — |
| villagecoin.com | July 1, 2025 | ransomware_live | — |
| corpdvs.com | July 1, 2025 | ransomware_live | — |
| www.nuphoton.com | June 30, 2025 | ransomware_live | — |
| semco-tech.com | June 30, 2025 | ransomware_live | — |
| simmons-Boardman Publishing, Inc | June 30, 2025 | ransomware_live | — |
| norsk.global | June 27, 2025 | ransomware_live | — |
| artexmanagement.com | June 27, 2025 | ransomware_live | — |
| buffalomarine.com | June 27, 2025 | ransomware_live | — |
| broadleafgame.com | June 27, 2025 | ransomware_live | — |
| greatcdltraining.com | June 27, 2025 | ransomware_live | — |
| elpasoglass.com | June 27, 2025 | ransomware_live | — |
| Windsor Door | June 27, 2025 | ransomware_live | — |
| melilla.es | June 26, 2025 | ransomware_live | — |
| Tappoo Group of Companies | June 26, 2025 | ransomware_live | — |
| CMI | June 25, 2025 | ransomware_live | — |
| Tecore | June 25, 2025 | ransomware_live | — |
| AEROBLOX | June 25, 2025 | ransomware_live | — |
| Airedale Springs | June 25, 2025 | ransomware_live | — |
| vresystems.com | June 25, 2025 | ransomware_live | — |
| formacompany | June 25, 2025 | ransomware_live | — |
| Summit Asset Management | June 25, 2025 | ransomware_live | — |
| TRAUM Investment Co. | June 25, 2025 | ransomware_live | — |
| sbh | June 24, 2025 | ransomware_live | — |
| nexa.bb | June 22, 2025 | ransomware_live | — |
| Bronze Craft | June 22, 2025 | ransomware_live | — |
| DelCampo | June 21, 2025 | ransomware_live | — |
| www.barobinson.com | June 20, 2025 | ransomware_live | — |
| glwholesale.com | June 19, 2025 | ransomware_live | — |
| januschke.at | June 19, 2025 | ransomware_live | — |
| rioglass-solar | June 19, 2025 | ransomware_live | — |
| caldine | June 19, 2025 | ransomware_live | — |
| Microbix Biosystems | June 19, 2025 | ransomware_live | — |
| gmaxequine.com | June 18, 2025 | ransomware_live | — |
| nipro.com | June 18, 2025 | ransomware_live | — |
| spacebridge.com | June 18, 2025 | ransomware_live | — |
| accu-search.com | June 18, 2025 | ransomware_live | — |
| mileschristi.org | June 18, 2025 | ransomware_live | — |
| kontek.com | June 18, 2025 | ransomware_live | — |
| hparchitecture.com | June 18, 2025 | ransomware_live | — |
| nardinifire.com | June 18, 2025 | ransomware_live | — |
| realityfinance.com | June 18, 2025 | ransomware_live | — |
| Microf | June 18, 2025 | ransomware_live | — |
| shinko plastics co. ltd | June 16, 2025 | ransomware_live | — |
| conlonproducts.net | June 15, 2025 | ransomware_live | — |
| Ritenour School District | June 15, 2025 | ransomware_live | — |
| moserengineering.com | June 14, 2025 | ransomware_live | — |
| gudeco.de | June 13, 2025 | ransomware_live | — |
| Punta Del Agua | June 13, 2025 | ransomware_live | — |
| McCracken Financial Solutions | June 12, 2025 | ransomware_live | — |
| garmonandcompany.com | June 12, 2025 | ransomware_live | — |
| haydist.com | June 12, 2025 | ransomware_live | — |
| biokplus.com | June 12, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).