#3 Qilin Ransomware Group

Qilin ransomware continues to pose a significant threat to Australian organisations, with recent claimed victims spanning retail, non-profit services, technology, finance, construction and healthcare.

Qilin operates a ransomware-as-a-service (RaaS) model. MITRE ATT&CK identifies Qilin as an active ransomware family associated with Agenda and notes its ability to target Windows, Linux and VMware ESXi environments.

Recent Australian claims include Reddrop Group and Thorndale Foundation, both listed by Qilin in September. The Thorndale listing reportedly included samples such as passport photographs and invoices, while the Reddrop Group claim had no published evidence at the time of reporting. These remain threat-actor claims and should not automatically be treated as independently confirmed breaches.

The continued Australian activity is consistent with wider regional reporting. Group-IB identified Qilin as one of the most active ransomware operators in the ANZ region during Q2 2026, recording 11 attacks, while its August report again placed Qilin among the region’s most active operators.

Broad Targeting

Qilin’s victim profile is notably diverse. Its activity has affected organisations across healthcare, manufacturing, technology, financial services, retail, transportation, utilities and professional services. This makes the group relevant not only to large enterprises but also to Australian and New Zealand mid-market organisations.

Recent claims involving Australian organisations illustrate this breadth:

Dates and victim status reflect the supplied dataset. Leak-site listings are allegations by the threat actor unless independently confirmed.

Qilin Tradecraft

Qilin combines conventional ransomware deployment with extensive use of legitimate administration and remote-access functionality.

Reported techniques include:

• Valid accounts and credential theft for initial access and privilege escalation.
• Exploitation of public-facing applications and remote services.
• Phishing, including malicious attachments and links.
• PowerShell and command-line execution.
• RDP, SMB, SSH and WinRM for lateral movement.
• Cobalt Strike and other remote-access tooling.
• Chisel, Ngrok and other tunnelling mechanisms to maintain connectivity.
• Archive-based collection before data exfiltration.
• Defense impairment, including termination or modification of security tooling.
• Data exfiltration followed by encryption, supporting a double-extortion model.

MITRE ATT&CK documents Qilin’s use of PowerShell, exploitation of public-facing applications, SMB and SSH, remote-access software, process discovery and data encryption.

Qilin activity has also been associated with Agenda Ransomware, Qilin.B, NETXLOADER and SmokeLoader. Reported vulnerabilities associated with Qilin activity include CVE-2023-27532 and CVE-2024-1853, while separate 2026 reporting has linked Qilin activity to exploitation of CVE-2026-20079 and CVE-2026-20316 in Cisco Secure Firewall Management Center.

MITRE ATT&CK Techniques