Search threats, CVEs… ⌘K
← Back to all threat actors

Qilin

Also known as Agenda
Tracked as UAT-11823 UAT-11988 UAT-12197

Qilin is a ransomware-as-a-service operation built around a cross-platform ransomware family of the same name. MITRE ATT&CK attributes operation of the service to Water Galura, which handles payload generation, ransom negotiations, and publication of stolen data while affiliates conduct intrusions. Qilin payloads target Windows, Linux, and VMware ESXi environments and support encryption plus data-theft extortion.

How we source and review actor profiles
Motivation
ransomware
First seen
2025-12-23
Last seen
2026-09-11
Sectors
manufacturing, technology, financial-services, healthcare
Status
Active

Threat intelligence assessment

At a glance

Facts

  • Three distinct threat clusters exploiting Cisco FMC vulnerabilities CVE-2026-20079 and CVE-2026-20316

Activity timeline

First observed
At least 2022
Status
Active
Status as of
2026-04-23

Facts

  • MITRE reports active targeting across multiple regions and industries.

Attribution assessment

Facts

  • UAT-11823 uses Cyclops Blink, previously attributed to Russian state-sponsored group Sandworm
  • Three distinct threat clusters identified: UAT-12197 (state-sponsored), UAT-11823 (state-sponsored), and UAT-11988 (ransomware operation)

Operational playbook

Facts

  • UAT-11988 used legitimate built-in FMC tooling as part of living-off-the-land (LotL) attack

Initial access and identity targets

Facts

  • UAT-12197 exploited CVE-2026-20079 for authentication bypass
  • UAT-11823 exploited both CVE-2026-20079 and CVE-2026-20316
  • UAT-11988 exploited CVE-2026-20316 for initial access

Capabilities and evasion

Facts

  • UAT-12197 queried internal databases and obtained user authentication data and credentials
  • UAT-11823 harvested managed-device configurations
  • UAT-11988 conducted reconnaissance, dropped tunneling tools, collected credentials, built target lists, terminated security tools, and deployed ransomware

Infrastructure patterns

Facts

  • Water Galura maintains a Tor-hosted data-leak site for Qilin and its affiliates.
  • The operation uses a Telegram news channel for service announcements.

Communication and pressure channels

Channels

  • Ransom negotiation
  • Tor data-leak site
  • Telegram announcements

Observed targeting

Targeting, not victimization. The listed sectors and regions summarize reported targeting and do not establish that every leak-site claim is a confirmed compromise.

Facts

  • The majority of reported victims were in the United States, France, Canada, and the United Kingdom.
  • Manufacturing, technology, financial services, and healthcare were the primary reported sectors.

Named victims

Organizations

  • ATF (U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives)
  • Nissan
  • Yangfeng
  • Synnovis
  • Asahi
  • Lee Enterprises
  • Court Services Victoria

Defender guidance

Measures

  • Restrict and patch internet-facing remote access, Citrix, and virtualization management interfaces.
  • Require phishing-resistant MFA and monitor newly established remote-management sessions.
  • Alert on unexpected PsExec, WinSCP, Splashtop, scheduled-task, and Group Policy activity in server and virtualization tiers.
  • Protect and monitor volume shadow copies, backup infrastructure, event logs, and ESXi management settings.
  • Maintain tested offline recovery paths that are isolated from production identity and virtualization control planes.
Derived

Reported detail

Facts

  • Three threat clusters exploited two Cisco FMC vulnerabilities to gain unauthorized access to firewall management systems
  • One cluster deployed web shells and command executors to steal credentials from internal databases
  • Another cluster associated with Sandworm deployed Cyclops Blink modular implant and reverse shells
  • A ransomware operation used the vulnerabilities to conduct reconnaissance and deploy Qilin ransomware across victim environments
  • Both vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Claimed
Victim claimImperial Healthcare Solutions listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
Indicator7 indicators cataloged

Types: tool.

Last observed
Indicator4 indicators cataloged

Types: onion.

First observed
CVECVE-2026-20079 linked to this actor

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

First observed
CVECVE-2026-20316 linked to this actor

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Cataloged
IdentityTracking identifier: UAT-12197

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: UAT-11823

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: UAT-11988

Reviewed identity mapping approved on this date.

First listed
Victim claimJet Specialty listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimMitsuwa Trading Co., Ltd listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAlaska Electrical Apprenticeship listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPartners Group SK listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimJbc listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPhilippine Ports Authority listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBauman Law Group listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimG&S Technologies listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNolan Consulting Group listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimColonial Hyundai listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThe Big Table listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimJouvet SAS listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimComplete Packaging Solutions listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAP CAPITAL PARTNERS LIMITED listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCommission de la construction du Quebec (CCQ) listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGrayson Rural Electric Cooperative listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTanner listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 113 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

QilinCanonical Name
AgendaAlias
UAT-11823Tracking Id
UAT-11988Tracking Id
UAT-12197Tracking Id
Overlaps: The Gentlemen Overlaps: Water Galura

Loading CVEs, techniques, indicators, malware, victims, and activity...