Ransomware.live: qilin

| Active

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Victims

1824

First Discovered

2022-10-08

victim

Last Discovered

2026-05-14

victim

Inactive Since

day

Avg Delay

46.5

days

Infostealer

21.9%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

-48% vs last month

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Qilin	No	2026-04-28T07:25:49		`ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion`
DDOS Protection	No	2026-04-28T07:28:21		`kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion`
Qilin blog	Yes	2026-05-15T02:41:24	Apache	`ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion`
Sign In	No	2026-04-28T07:30:53		`ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion`

Target

Heatmap

Ransom Notes (3)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Nmap Nping placeholder placeholder placeholder placeholder placeholder	NetSupport ScreenConnect placeholder placeholder placeholder placeholder placeholder	EDRSandBlast PCHunter PowerTool Toshiba power management driver (BYOVD) Updater for Carbon Black’s Cloud Sensor AV (upd.exe) YDArk Zemana Anti-Rootkit driver	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder	Cobalt Strike Evilginx Kali Linux NetExec SystemBC Tofsee placeholder	Proxychains placeholder placeholder placeholder placeholder placeholder placeholder	PowerShell PsExec WinRM fsutil placeholder placeholder placeholder	EasyUpload.io MEGA placeholder placeholder placeholder placeholder placeholder

TTPs Matrix (11)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Valid Accounts	Command and Scripting Interpreter: PowerShell	Scheduled Task/Job: Scheduled Task	Obfuscated Files or Information	OS Credential Dumping: LSASS Memory	Network Service Discovery	Remote Services: Remote Desktop Protocol	Archive Collected Data: Archive via Utility	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Application Layer Protocol: Web Protocols	Data Encrypted for Impact
Exploit Public-Facing Application	Command and Scripting Interpreter: Unix Shell		Disable or Modify Tools	Credentials from Web Browsers	System Information Discovery	Remote Services: SMB/Windows Admin Shares				Inhibit System Recovery
Phishing: Spearphishing via Service

Negotiation Chats (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (61)

Hash MD5 54 IP Address 5 ftp 2

Type	IOC
`Hash MD5`	`08a2405cd32f044a69737e77454ee2da`
`Hash MD5`	`0d68a310f4265821900249bec89364c2`
`Hash MD5`	`11d795baafa44b73766e850d13b8e254`
`Hash MD5`	`144183a4217ae0914ba0c865858d07cd`
`Hash MD5`	`19ff6488a259d750ec18902fe75a713b`
`Hash MD5`	`1bde76f3197123dcc2ecd0bfef567484`
`Hash MD5`	`1c4bea81c0da22badd9b7eab574c51cd`
`Hash MD5`	`2020979e080d7ac9c0403172573c7de8`
`Hash MD5`	`24a8fcd08d9e40d32929b57de9b15385`
`Hash MD5`	`2bb209ccfc5103eccab523c875050cfa`
`Hash MD5`	`2f76a29d4e4292d7f29a29345717812c`
`Hash MD5`	`3158a3849ea2695d6ec5aea6512fd030`
`Hash MD5`	`348b0ce6af4698061678c8e92b4b2675`
`Hash MD5`	`37155f0bca29ccd6b6d4f5b2bc42eb4d`
`Hash MD5`	`3b10127e65fa3e215d21e0a2e7fd32be`
`Hash MD5`	`417ad60624345ef85e648038e18902ab`
`Hash MD5`	`420a2c53386678396f972f09cc7f3a5c`
`Hash MD5`	`4a3f22021e4415e8211633fb3735a046`
`Hash MD5`	`4ea8adecc5bd45a76cc61430c560924f`
`Hash MD5`	`53c8a4f0497929de4a5039b2c14bf426`
`Hash MD5`	`575b26c1cc06609722f98e2beaed6a8a`
`Hash MD5`	`5862f9fc9c9a0d766eba29eb4945f619`
`Hash MD5`	`59d756280b06cf113ca43abc0050edd5`
`Hash MD5`	`5cffa3126b9effc279d32b2cf4ef2278`
`Hash MD5`	`64a590760fdbb84356544cc90ac3d50f`
`Hash MD5`	`670fe8faaede4e2e033311fb662d2a4a`
`Hash MD5`	`6f893b1cc5cf534c59eabe932c1bf21e`
`Hash MD5`	`6fc6164b3a08669992acad3764fb1922`
`Hash MD5`	`826a8e8c05983aa3a884d7abcfa473ac`
`Hash MD5`	`88630916b0c6633ca28c8896416a93ee`
`Hash MD5`	`88bb86494cb9411a9692f9c8e67ed32c`
`Hash MD5`	`8ca5c9745e8a0e18167a9b932821645a`
`Hash MD5`	`964c13b68dc6b6b918b66a9a10469d2a`
`Hash MD5`	`996c394d0f6d6967df9542c52f6f4661`
`Hash MD5`	`9befad1d56d2bd8195813aea1f37f921`
`Hash MD5`	`9ea321b6a0f069caab7092cfe1cbbde0`
`Hash MD5`	`9f510626c7327a7c2328bc5131726638`
`Hash MD5`	`a6302fdb63e2244c1246a73a7d65d09e`
`Hash MD5`	`a7ab0969bf6641cd0c7228ae95f6d217`
`Hash MD5`	`a7e7d00d531cb7ca27d0f3bee448573f`
`Hash MD5`	`ab05a1925fee8334a2114811d5283364`
`Hash MD5`	`b04e8ee43aba85fa5c585b9335c953c2`
`Hash MD5`	`b4a6152514919a637c22a58bea316fc7`
`Hash MD5`	`bed0f34673cc93560c17e3ab04ea5d19`
`Hash MD5`	`d1c331c17ddd4abe0d53755461c1ec9a`
`Hash MD5`	`d309e3d77ed6a336eb3ad263ddf9db90`
`Hash MD5`	`d6e7547ad7dfd1fbc62e8282aebcc391`
`Hash MD5`	`dd42c3e017889c107a81da78d87dc8af`
`Hash MD5`	`e01776ec67b9f1ae780c3e24ecc4bf06`
`Hash MD5`	`e4c1add9f7606e3fa57976b908b4b375`
`Hash MD5`	`ea1f8794c73b26724314e5356f1f4128`
`Hash MD5`	`f588802958c35fe18eb87bc36651a3d1`
`Hash MD5`	`f982da00c547913fd0ae7d0da0fc77e7`
`Hash MD5`	`fdc6848dad660414bed9ad1b381cf6e3`
`IP Address`	`176.113.115.209`
`IP Address`	`176.113.115.97`
`IP Address`	`188.119.66.189`
`IP Address`	`31.41.244.100`
`IP Address`	`85.209.11.49`
`ftp`	`ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@176.113.115.209`
`ftp`	`ftp://dataShare:nX4aJxu3rYUMiLjCMtuJYTKS@176.113.115.97`