Qilin

| Active

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Victims

1628

First Discovered

2022-10-08

victim

Last Discovered

2026-03-24

victim

Inactive Since

day

Avg Delay

46.7

days

Infostealer

9.3%

victims with domain

View Victims on World Map

View group statistics

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Qilin	No	2025-06-01 21:19:12		`ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion`
DDOS Protection	No	2025-06-09 13:00:11		`kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion`
Qilin blog	Yes	2026-03-25 08:01:58	Apache	`ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion`
Sign In	No	2025-09-11 22:00:18		`ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (3)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Nmap Nping placeholder placeholder placeholder placeholder placeholder	NetSupport ScreenConnect placeholder placeholder placeholder placeholder placeholder	EDRSandBlast PCHunter PowerTool Toshiba power management driver (BYOVD) Updater for Carbon Black’s Cloud Sensor AV (upd.exe) YDArk Zemana Anti-Rootkit driver	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder	Cobalt Strike Evilginx NetExec placeholder placeholder placeholder placeholder	Proxychains placeholder placeholder placeholder placeholder placeholder placeholder	fsutil PsExec WinRM placeholder placeholder placeholder placeholder	EasyUpload.io placeholder placeholder placeholder placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (70)

FTP 2 IP 8 MD5 60

Type	IOC
`ftp`	`ftp://dataShare:nX4aJxu3rYUMiLjCMtuJYTKS@176.113.115.97`
`ftp`	`ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@176.113.115.209`
`ip`	`176.113.115.97`
`ip`	`176.113.115.209`
`ip`	`85.209.11.49`
`ip`	`31.41.244.100`
`ip`	`85.209.11.49`
`ip`	`176.113.115.209`
`ip`	`176.113.115.97`
`ip`	`188.119.66.189`
`md5`	`d6e7547ad7dfd1fbc62e8282aebcc391`
`md5`	`f588802958c35fe18eb87bc36651a3d1`
`md5`	`2bb209ccfc5103eccab523c875050cfa`
`md5`	`a7e7d00d531cb7ca27d0f3bee448573f`
`md5`	`964c13b68dc6b6b918b66a9a10469d2a`
`md5`	`3b10127e65fa3e215d21e0a2e7fd32be`
`md5`	`d1c331c17ddd4abe0d53755461c1ec9a`
`md5`	`417ad60624345ef85e648038e18902ab`
`md5`	`b04e8ee43aba85fa5c585b9335c953c2`
`md5`	`59d756280b06cf113ca43abc0050edd5`
`md5`	`88bb86494cb9411a9692f9c8e67ed32c`
`md5`	`37155f0bca29ccd6b6d4f5b2bc42eb4d`
`md5`	`e01776ec67b9f1ae780c3e24ecc4bf06`
`md5`	`417ad60624345ef85e648038e18902ab`
`md5`	`11d795baafa44b73766e850d13b8e254`
`md5`	`88630916b0c6633ca28c8896416a93ee`
`md5`	`dd42c3e017889c107a81da78d87dc8af`
`md5`	`1c4bea81c0da22badd9b7eab574c51cd`
`md5`	`ab05a1925fee8334a2114811d5283364`
`md5`	`64a590760fdbb84356544cc90ac3d50f`
`md5`	`2020979e080d7ac9c0403172573c7de8`
`md5`	`bed0f34673cc93560c17e3ab04ea5d19`
`md5`	`4a3f22021e4415e8211633fb3735a046`
`md5`	`6fc6164b3a08669992acad3764fb1922`
`md5`	`d309e3d77ed6a336eb3ad263ddf9db90`
`md5`	`575b26c1cc06609722f98e2beaed6a8a`
`md5`	`a6302fdb63e2244c1246a73a7d65d09e`
`md5`	`1bde76f3197123dcc2ecd0bfef567484`
`md5`	`ea1f8794c73b26724314e5356f1f4128`
`md5`	`9befad1d56d2bd8195813aea1f37f921`
`md5`	`9f510626c7327a7c2328bc5131726638`
`md5`	`08a2405cd32f044a69737e77454ee2da`
`md5`	`fdc6848dad660414bed9ad1b381cf6e3`
`md5`	`19ff6488a259d750ec18902fe75a713b`
`md5`	`4ea8adecc5bd45a76cc61430c560924f`
`md5`	`0d68a310f4265821900249bec89364c2`
`md5`	`53c8a4f0497929de4a5039b2c14bf426`
`md5`	`670fe8faaede4e2e033311fb662d2a4a`
`md5`	`f982da00c547913fd0ae7d0da0fc77e7`
`md5`	`9ea321b6a0f069caab7092cfe1cbbde0`
`md5`	`2f76a29d4e4292d7f29a29345717812c`
`md5`	`826a8e8c05983aa3a884d7abcfa473ac`
`md5`	`8ca5c9745e8a0e18167a9b932821645a`
`md5`	`5862f9fc9c9a0d766eba29eb4945f619`
`md5`	`3158a3849ea2695d6ec5aea6512fd030`
`md5`	`24a8fcd08d9e40d32929b57de9b15385`
`md5`	`996c394d0f6d6967df9542c52f6f4661`
`md5`	`420a2c53386678396f972f09cc7f3a5c`
`md5`	`5cffa3126b9effc279d32b2cf4ef2278`
`md5`	`348b0ce6af4698061678c8e92b4b2675`
`md5`	`144183a4217ae0914ba0c865858d07cd`
`md5`	`6f893b1cc5cf534c59eabe932c1bf21e`
`md5`	`b4a6152514919a637c22a58bea316fc7`
`md5`	`88630916b0c6633ca28c8896416a93ee`
`md5`	`bed0f34673cc93560c17e3ab04ea5d19`
`md5`	`d1c331c17ddd4abe0d53755461c1ec9a`
`md5`	`a7e7d00d531cb7ca27d0f3bee448573f`
`md5`	`2020979e080d7ac9c0403172573c7de8`
`md5`	`a7ab0969bf6641cd0c7228ae95f6d217`
`md5`	`e4c1add9f7606e3fa57976b908b4b375`