The number that stands out
Ransomware leak-site tracking for 2026 has produced one outlier that dwarfs the rest of the market: Qilin. Black Kite’s 2026 ransomware report puts total disclosed victims across all tracked groups at 7,551, spread across 146 active operations — but Qilin alone accounts for a share that no single group has approached in recent memory. The operation’s claimed victim count rose from roughly 250 in the prior year-over-year period to 1,358, a 443% increase, putting it behind roughly one in every five to six disclosed ransomware cases tracked globally across more than 50 countries.
MOXFIVE’s independent tracking tells a similar story from a different angle: Qilin has claimed more than 500 victims in 2026 alone, and close to 1,500 since the operation’s 2022 launch under the Agenda name, making it the most active ransomware operation in their dataset. Halcyon’s quarterly numbers show some month-to-month volatility — Qilin held the top spot for three consecutive quarters before rivals like TheGentlemen briefly outpaced it in monthly volume in June — but across the year Qilin has consistently sat at or near the top of every major tracking firm’s leaderboard. The top five ransomware operations combined now control 43.6% of all disclosed victims, and Qilin is the largest single contributor to that concentration.
What’s driving the volume
The scale-up traces to a combination of affiliate economics and initial-access breadth rather than any single new exploit. Qilin’s RaaS terms are among the more attractive in the current market: affiliates keep 80-85% of ransom payments, a split at the generous end compared with older operations that historically took 20-30% for themselves. Recruitment runs through RAMP, a Russian-language cybercrime forum, and the group has continued to build out ancillary services that lower the skill floor for affiliates — a “Call Lawyer” feature that brings in purported legal counsel to frame victim exposure through GDPR, CCPA, and HIPAA language during negotiations, alongside DDoS and spam support for pressuring holdout victims.
On initial access, MOXFIVE’s analysis identifies two dominant vectors this year: credential-based access through exposed RDP services and unprotected VPN portals — often sourced from infostealer logs and credential markets — and exploitation of public-facing applications, with FortiGate firewall vulnerabilities and SAP NetWeaver flaws named specifically. That mirrors a pattern seen across several 2026 RaaS operations that have leaned on edge-device and VPN weaknesses as enterprise patching of internet-facing infrastructure continues to lag.
Qilin’s encryptor itself supports Windows, Linux, and VMware ESXi environments, with customizable execution options and a safe-mode reboot capability designed to help less technically sophisticated affiliates still land a working encryption run. Double extortion is standard: data is published on the group’s Tor leak site as well as a clearweb mirror.
Sector and geographic pattern
MOXFIVE’s sector breakdown for 2026 places manufacturing and production as Qilin’s most frequently claimed target category, followed by professional services, retail and hospitality, technology, and construction and engineering. Geographically, activity concentrates heavily in the United States, with significant additional impact across North America and Western Europe. Recent claimed victims tracked in mid-August include German firms Motorenmaier GmbH and Delta Ways, and Double H Equipment, a US industrial equipment provider — all disclosed on Qilin’s leak site within the same week, consistent with the group’s steady, high-volume claim cadence rather than any single large campaign.
A state-linked wrinkle
One development sets Qilin apart from typical criminal RaaS activity: Microsoft has reported observing Moonstone Sleet, a North Korea-linked threat actor, deploying Qilin’s ransomware rather than custom tooling. If confirmed as a pattern rather than an isolated engagement, it would mark one of the first documented cases of a state-aligned operator using a criminal RaaS platform’s payload in place of bespoke malware — a detail that complicates attribution for defenders trying to distinguish financially motivated Qilin affiliates from state-directed activity riding the same infrastructure.
Defensive takeaways
Given the initial access data, the highest-value mitigations for organizations concerned about Qilin exposure are unglamorous but concrete: patch FortiGate and SAP NetWeaver internet-facing systems promptly, enforce MFA on all VPN and RDP access points, and monitor for infostealer-sourced credential exposure tied to the organization’s domain. Qilin’s ESXi and Linux support means backup infrastructure and hypervisor management planes need the same access controls applied to Windows endpoints — a gap that continues to show up in post-incident reviews across the broader 2026 ransomware landscape.
Qilin’s trajectory this year is less a story about a single technical breakthrough than about an affiliate model tuned for volume: generous payment splits, low-friction recruitment, broad platform support, and initial-access vectors that remain widely available across the internet-facing attack surface. That combination has been enough to make it the largest single contributor to a ransomware market that, in aggregate, grew nearly 25% year-over-year.