Qilin ransomware deep dive: Rust loaders, kernel EDR killers and four years of leak-site data
Qilin, the ransomware-as-a-service brand that emerged in 2022 as Agenda, has spent three years at the top of leak-site rankings. The tracker ransomware.live attributes 2,398 published victims to it across 104 countries, with new listings as recent as 19 October 2026. That month the brand also returned to headlines for a different reason: a suspected core member is in German custody, and the case file includes the 2024 attack on London's pathology services.
Qilin is a different animal from the Medusa operation we covered in our earlier piece on leak-site mechanics: it runs its own toolchain, rents a mature affiliate panel and hunts organisations where downtime hurts — hospitals, newspapers on deadline, manufacturers inside a supply chain.A Go-and-Rust codebase, a kernel-level toolbox
Qilin's encryptors are written in Go and Rust, with builds for Windows, Linux and VMware ESXi; a recruitment post cited by SOCRadar lists ChaCha20, AES and RSA-4096 as the primitives, and builds are tailored to each victim's environment. The delivery layer is newer: Flashpoint's July 2026 analysis documented a custom Rust loader that unpacks the encryptor in-process, in the wild since May 2024. Beside it runs a kernel-level EDR killer, sold for around US $2,000 on illicit marketplaces, which abuses the legitimate ThrottleStop driver for kernel access, then kills EDR processes after rewriting their access controls so they cannot restart. Like most Russian-language operations, the tooling refuses CIS locales such as Russia or Belarus — and Flashpoint frames anti-EDR tooling as a standard prerequisite for high-impact ransomware.Synnovis: when encryption reached the operating table
On 3 June 2024, Qilin hit Synnovis, the pathology partnership serving King's College Hospital and Guy's and St Thomas' trusts in London. NHS England figures reported by the BBC showed more than 800 operations postponed in the first week, hundreds of outpatient appointments rearranged and 18 organs diverted; more than 10,000 appointments were disrupted over the following weeks."We believe it is a Russian group of cybercriminals who call themselves Qilin." — Ciaran Martin, former NCSC chief executive, quoted by the Guardian, June 2024SOCRadar reports a $50 million demand; after the 20 June deadline passed, roughly 400 GB of patient data was published, much of it via the group's Telegram channel. The gang told the BBC the attack protested British support for Ukraine — a claim met with scepticism. A year on, King's College Hospital confirmed a patient had died after a long wait for a blood test result; the BBC reports police are exploring an unlawful-killing case, a potential cyber-crime first. In May 2026, Japanese police detained a 28-year-old Russian man, identified in German press as Vladimir K., during a holiday trip; extradited to Frankfurt, he is accused of extorting about $160,000 from a logistics company in September 2024 — and German investigators have since added the Synnovis attack to the case, the BBC reported in October 2026.
Big-name victims as a pattern
Synnovis was not an outlier. In February 2025, Qilin encrypted critical applications at Lee Enterprises, the US publisher behind the St. Louis Post-Dispatch, the Buffalo News and some 350 other titles, halting print runs. The gang claimed 120,000 files and 350 GB of data; Lee later disclosed that 39,779 people, including Social Security numbers, were affected, and put recovery costs at about $2 million. Other claimed victims include Yanfeng, Court Services Victoria in Australia and, in October 2025, Japan's brewer Asahi. Microsoft has linked Scattered Spider members to attacks using Qilin's brand, as BleepingComputer has reported.What the counters show
Counts differ by tracker but the trend agrees. The ransomware.live Qilin page lists 2,398 victims since 2022, led by manufacturing (502), professional services (398), technology (272), healthcare (200) and retail (169), with the United States first at 1,005. CybelAngel counted more than 2,100 organisations on the leak site since 2022 — 55 of them in the first two weeks of January 2026 alone. SOCRadar's November 2025 update called Qilin 2025's most active ransomware group, with roughly 800 victims in 50-plus countries since that January. Tactics evolve with the rankings. SOCRadar documents a "Call lawyer" feature added to the affiliate panel in June 2025, letting affiliates bring legal counsel into negotiations. In September 2025, DragonForce announced a coalition with Qilin and LockBit to share techniques and infrastructure. The pressure is also regulatory: Lee Enterprises' notification to Maine regulators and NHS England's warnings over patient data show the compliance tail of a leak.What keeps Qilin distinctive
Stripped of branding, a few operational habits set Qilin apart:- Double extortion is standard: data is exfiltrated before encryption, and publication follows when the deadline passes — Synnovis and Lee Enterprises both ended in dumps.
- Targeting leans toward time-sensitive organisations — manufacturers, logistics firms, hospitals, newspapers — where an hour of downtime carries a price.
- Access routes include phishing, exploitation of public-facing applications and remote services such as RDP, per MS-ISAC reporting; via managed service providers, supply-chain attacks have hit dozens of firms at once — the September 2025 "Korean Leaks" operation reached at least 25 South Korean financial firms.
- Evasion is a feature: the BYOVD kernel attack and Rust loader documented by Flashpoint, plus Linux encryptors run inside Windows Subsystem for Linux to bypass Windows-focused EDR, according to SOCRadar.