At a glance
- Qilin is a ransomware-as-a-service operation active since September 2022.
- It uses double extortion: stealing data before encrypting systems.
- Qilin recruits affiliates to breach organizations and deploy ransomware.
- Prioritize reviewing detection of intrusions, data theft, and unauthorized encryption.
Qilin ransomware: understanding its double-extortion model and what organizations should review
Qilin is a ransomware-as-a-service operation active since September 2022, using affiliates to breach organizations and deploy ransomware. It steals data before encrypting systems and threatens disclosure; organizations should review their ability to detect intrusions, data theft, and…
In this article
Krebs on Security describes efforts to trace the identity of a Qilin administrator using the alias Haise, and outlines the group’s operating model. The report is available in the original article.
Overview and technical details
Qilin is a ransomware-as-a-service (RaaS) operation that has been active since September 2022. It recruits affiliates to breach organizations and deploy ransomware. The article focuses on tracing an administrator who uses the alias Haise.
| Field | Details |
|---|---|
| Group / operation | Qilin, ransomware-as-a-service |
| Active since | September 2022 |
| Article focus | Tracing an administrator using the alias Haise |
| Source | Krebs on Security |
Affected systems
Qilin recruits affiliates to breach organizations and deploy ransomware. The information provided does not identify specific affected products or version branches; the activity described targets organizations.
Mechanism and impact
Qilin uses a double-extortion model: it steals sensitive data before encrypting systems, then threatens to publish the data. This combines the impact of encryption with the risk of data disclosure.
The group attracts affiliates by offering them at least 80% of extortion proceeds. The article says Qilin claims at least 365 victim organizations in the most recent three months; this is a figure claimed by the group.
Remediation and mitigation
- Prioritize reviewing the ability to detect intrusions into the organization.
- Review the ability to detect data theft.
- Review the ability to detect unauthorized encryption.
The information provided does not specify a patch, a particular mitigation, or a remediation deadline.
References
Related articles
Cairn used in 25 automated attack campaigns targeting at least 19 organizations
Unit 42 says CL-STA-1238 used the Cairn AI framework with Zhipu GLM and DeepSeek in 25 campaigns targeting at least 19 organizations. Ten organizations experienced unauthorized access or data theft; relevant organizations should review accounts, credentials, and signs of lateral movement.