Qilin Ransomware

Qilin belongs to a sophisticated ransomware family known for using double extortion, a nefarious tactic aimed at amplifying the impact and urgency of their demands. In this scheme, the attackers not only perform data encryption across the victim’s systems but also exfiltrate sensitive data, threatening to release or sell the stolen information if ransom payments are not made.

After gaining access to a compromised network, Qilin actors often conduct lateral movement to expand their reach before launching widespread data encryption. To evade detection, they tailor their malware to bypass traditional security tools, leveraging insights from threat intelligence to exploit vulnerabilities and weak security controls. This dual-threat strategy significantly increases the pressure on victim organisations to comply with ransom demands quickly.