Qilin

Profile

Qilin is a ransomware-as-a-service (RaaS) operation run through affiliates that, in 2026, ranked second in the number of incidents observed by Cisco Talos, behind only The Gentlemen. According to Talos, the group is adopting artificial intelligence to improve the efficiency of its operations. Microsoft Threat Intelligence has tracked an affiliate identified as Storm-2570 since April 2025 that works across several RaaS ecosystems, including Qilin, with highly uniform tradecraft based on legitimate remote access tooling and data exfiltration to cloud services. Victims linked to that affiliate span healthcare, education, government, finance, energy and utilities, retail, technology, agriculture and food, nonprofits, pharmaceuticals and chemicals, and construction across the United States, Canada, the United Kingdom, Spain, the Netherlands, and Puerto Rico. Its defining trait is the shared-affiliate model: a single operator may deploy Qilin or other ransomware families while keeping the same tactics and tools.

Active since: 2022-10

Tools

Atera, MeshAgent, ScreenConnect, Splashtop, Remotely

What defenders should watch

• Monitor unauthorised installation or execution of remote access tools (Atera, MeshAgent, ScreenConnect, Splashtop, Remotely) and maintain an allowlist of approved RMM software.
• Watch for bulk data transfers to cloud storage services, a recurring technique of the affiliate tracked by Microsoft prior to encryption.
• Because the same affiliate operates multiple ransomware families, detection should focus on behaviour and tooling (TTPs) rather than on indicators tied solely to the Qilin brand.
• Qilin's incident volume in 2026 and its use of AI to speed up operations make early detection and fast response critical, alongside verified, isolated and restorable backups.
• Targeted sectors are highly varied (healthcare, education, public sector, finance, energy, industry), so no vertical should assume it is out of scope.

Priority mitigations

MITRE ATT&CK mitigations that cover the most techniques used by this group.

1. User Account Management (11 techniques covered)
2. Privileged Account Management (10 techniques covered)
3. Execution Prevention (10 techniques covered)
4. Behavior Prevention on Endpoint (7 techniques covered)
5. Operating System Configuration (6 techniques covered)
6. Audit (6 techniques covered)
7. User Training (5 techniques covered)
8. Restrict File and Directory Permissions (5 techniques covered)

MITRE ATT&CK techniques

Recent victims

Sources analysed

• Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments (Microsoft Threat Intelligence, 9/24/2026)
• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use (Cisco Talos, 9/17/2026)