A surge in Qilin ransomware activity has continued through the second half of 2025, with the group publishing more than 40 victim listings per month on its leak site.
The attacks have primarily targeted the manufacturing sector, followed by professional and scientific services and wholesale trade, according to new findings from Cisco Talos.
The sustained rate of publication underscores Qilin’s position as one of the most active and damaging ransomware operations worldwide.
Using a double-extortion model, the group encrypts data while threatening to leak stolen information if ransoms are not paid.
A Growing Global Footprint
Since emerging in mid-2022, Qilin, formerly known as Agenda, has expanded its reach through a ransomware-as-a-service (RaaS) model.
Affiliates use Qilin’s platform and tools to compromise organizations across the United States, Canada, the United Kingdom, France and Germany.
Talos observed a sharp rise in data leaks, with peaks of 100 victim postings in both June and August 2025.
Recent artifacts suggest that some of the attacker’s scripts used Cyrillic character encoding, possibly linking the operation to Eastern Europe or a Russian-speaking region.
Read more on ransomware-as-a-service: Lynx Ransomware Group Unveiled with Sophisticated Affiliate Program
Qilin Tools and Tactics
In its latest report, Talos identified the use of the open-source file transfer tool Cyberduck for data exfiltration, leveraging trusted cloud services to conceal malicious traffic.
Investigators also noted unusual activity involving standard Windows programs such as notepad.exe and mspaint.exe, which were used to view sensitive files before exfiltration.
Qilin operators commonly deploy two encryptors during an attack, one spreading laterally across systems via PsExec and another running from a single host to encrypt multiple network shares.
The report highlights several additional tactics:
-
Abuse of leaked administrative credentials to access VPNs without multi-factor authentication (MFA)
-
Credential theft using Mimikatz and NirSoft utilities
-
Obfuscated PowerShell scripts disabling Windows security features
-
Attempts to uninstall or stop endpoint detection and response (EDR) tools
Persistent and Damaging Attacks
Talos found that Qilin often uses scheduled tasks and registry modifications to maintain persistence after encryption.
The ransomware replaces victims’ wallpapers with ransom notices linking to a Tor-based leak site and a backup URL for victims without Tor access.
Manufacturing accounted for roughly 23% of all incidents, while professional and scientific services represented about 18% and wholesale trade around 10%.
Despite fluctuations in monthly figures, analysts warn that Qilin continues to pose a major threat, particularly given its operational consistency and expanding affiliate base.
