Search threats, CVEs… ⌘K
← Back to all threat actors

Qilin

Also known as Agenda, Spikey Scorpius, Tarnished Scorpius, INC, Qilin
Tracked as UAT-11823 UAT-11988 UAT-12197

Qilin is a ransomware-as-a-service operation built around a cross-platform ransomware family of the same name. MITRE ATT&CK attributes operation of the service to Water Galura, which handles payload generation, ransom negotiations, and publication of stolen data while affiliates conduct intrusions. Qilin payloads target Windows, Linux, and VMware ESXi environments and support encryption plus data-theft extortion.

How we source and review actor profiles
Motivation
ransomware
First seen
2025-12-23
Last seen
2026-10-27
Sectors
manufacturing, technology, financial-services, healthcare
Status
Active

Threat intelligence assessment

At a glance

Facts

  • Ransomware operators exploiting CVE-2026-0257

Activity timeline

Facts

  • Financially-motivated attacks targeting a wide range of sectors
  • Attacks range from rapid encryption-only operations to full double-extortion

Attribution assessment

Facts

  • Spikey Scorpius is also known as Qilin
  • Tarnished Scorpius is also known as INC
  • Settra ransomware group was also observed exploiting CVE-2026-0257 according to ReliaQuest

Operational playbook

Facts

  • Deployed typical double-extortion attacks, stealing data before encrypting

Initial access and identity targets

Facts

  • Exploitation of CVE-2026-0257 (authentication bypass flaw in PAN-OS and Prisma Access) to set up unauthorized VPN connections

Capabilities and evasion

Facts

  • Bypass multi-factor authentication (MFA) controls
  • Conduct internal network reconnaissance
  • Move laterally across the network via RDP and SMB
  • Stage additional tooling for credential harvesting, data exfiltration, and ransomware deployment
  • Disable security controls on ESXi hypervisors
  • Perform offline credential dumping against domain controller virtual disks
  • Chain initial access with other exploit tools including CVE-2023-27532 to target Veeam backup infrastructure

Infrastructure patterns

Facts

  • Water Galura maintains a Tor-hosted data-leak site for Qilin and its affiliates.
  • The operation uses a Telegram news channel for service announcements.

Communication and pressure channels

Channels

  • Ransom negotiation
  • Tor data-leak site
  • Telegram announcements

Observed targeting

Facts

  • Targeted sectors include education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail
  • Direct pivot to virtualization layer after successful exploitation, moving from compromised VPN gateway to vCenter management appliance

Named victims

Organizations

  • Nissan
  • Asahi
  • Lee Enterprises
  • Court Services Victoria
  • U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)

Defender guidance

Facts

  • Apply latest patches for CVE-2026-0257
  • Proactively hunt for indicators of compromise
  • Initiate appropriate incident response protocols if successful gateway-connected events are detected

Reported detail

Facts

  • Qilin (aka Spikey Scorpius) and INC (aka Tarnished Scorpius) are ransomware groups actively exploiting CVE-2026-0257 to bypass MFA and establish unauthorized VPN access to corporate networks.
  • After gaining initial access, attackers move laterally using RMM tools, RDP, and SMB, then pivot to virtualization infrastructure to dump credentials while evading EDR protections.
  • The threat actors target diverse sectors and employ double-extortion tactics, sometimes chaining CVE-2026-0257 with other vulnerabilities like CVE-2023-27532 to maximize damage.
  • Organizations are advised to patch CVE-2026-0257, hunt for compromise indicators, and initiate incident response if gateway anomalies are detected.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimNuVista Federal Credit Union listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHawaii Law Enforcement Fedral Credit Union listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator4 indicators cataloged

Types: onion.

First listed
Victim claimDelta Electric Power Association listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBangor Wholesale Laminates listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTeleTronic listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFIRMENGRUPPE APPL Holding GmbH listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPremier Medical Group listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimZachary Confections listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTHOMAS JORDAN, P.A listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFive Star Sheets listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPower Funding listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMountain Rheumatology listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTaubensee Steel & Wire listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNatural Energy Laboratory of Hawaii Authority listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMiller Stratvert listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSeufert Construction listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimRaceTrakka listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimSmith Feddeler & Smith listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimECOM listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimETO listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimWhite & Case listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimHossner-Textil GmbH listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimOoredoo Myanmar listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCommonwealth Community Bank listed by Qilin

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 123 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

QilinCanonical Name
AgendaAlias
INCAlias
Spikey ScorpiusAlias
Tarnished ScorpiusAlias
QilinAlias
UAT-11823Tracking Id
UAT-11988Tracking Id
UAT-12197Tracking Id
Overlaps: The Gentlemen Overlaps: Water Galura

Loading CVEs, techniques, indicators, malware, victims, and activity...