Qilin leads June 2026 with 83 cases
AhnLab ASEC’s June 2026 ransomware trend report ranks Qilin as the most active group of the month with 83 confirmed cases, ahead of Dire Wolf (68) and World Leaks (52). The top 10 also includes Akira (49), LockBit 5.0 (47), Nova (45), Metaencryptor (31), Play (31), Inc Ransom (30), and DragonForce (22).
In the same June window, Qilin accounteded for 41 Manufacturing incidents and 92 US-based hits, reinforcing its position as the primary RaaS operator for the month.
37 UK organisations hit in H1 2026
Qilin’s Tor data leak site listed up to 37 UK-based victims in H1 2026, the highest count of any ransomware group for the period. DragonForce followed with 21 UK victims, and TheGentlemen with 18.
The 37 UK entries span six sectors: Construction & Property Development, Manufacturing & Engineering, Legal & Professional Services, Technology & IT Infrastructure, Education, and Healthcare. Most victims reported revenue between £10m and £250m, consistent with Qilin’s preference for SMEs large enough to pay mid-tier ransoms but typically lacking a dedicated 24/7 SOC.
Salford City College appeared on both the Qilin and DragonForce DLS between 6 and 10 March 2026. The cross-posting is unexplained but suggests either a single affiliate running both RaaS platforms or two separate affiliates hitting the same target.
NHS Synnovis fallout: 32,000 patient records
Bedfordshire Hospitals NHS Foundation Trust disclosed on 1 June 2026 that it exfiltrated more than 32,000 patient records from its supplier, Synnovis, in a Qilin ransomware attack. The data includes patient name, NHS number, date of birth, postcode, and test results.
The trust said it took over a year to map the exfiltrated records back to individual patients, a typical lag for Synnovis test data where the lab holds the raw results and the NHS trust holds the patient demographics.
Securotrop: the Qilin affiliate
Securotrop is a Qilin RaaS affiliate that deploys the unmodified Go/Rust payload across Windows, Linux, and VMware ESXi targets. The group has publicly confirmed it runs the original Qilin code without local modifications, placing it in the affiliate-brand category rather than a distinct malware family. Infrastructure overlap with the parent operation has been confirmed through independent tracking sources.
Encryption uses ChaCha20 when the target lacks AES-NI hardware support, falling back to AES-256-CTR when AES-NI is present. RSA-4096 wraps the symmetric key, with the public key embedded in the payload and the private key held by the operator. The Tor DLS lives at securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion, which is also listed as a Qilin extortion link in the Qilin tracker.
First observed in October 2025, Securotrop is assessed as a CIS-linked organized crime group with purely financial motivation. The CIS connection comes from Qilin RaaS’s recruitment pattern on Russian-language forums and its explicit exclusion of CIS entities from targeting. The group’s country of origin remains unconfirmed.
Exploit stack: VPN, SmarterMail, Web Help Desk, BYOVD
Initial access typically comes through corporate VPN gateways. Qilin operators exploit Fortinet, Check Point, and WatchGuard appliances to land on the target network, a pattern shared across most ransomware groups but consistent here.
Less common in the wild are SmarterTools SmarterMail and SolarWinds Web Help Desk. Both appear in Qilin's tool matrix and are also exploited by the Warlock ransomware gang, making them a useful secondary entry point when the VPN is patched or the target runs a web-based mail/help stack.
Once inside, the group leans on Bring Your Own Vulnerable Driver (BYOVD) to slip past EDR and AV. The driver is loaded in-process to bypass signature-based detection, a standard move for Qilin's RaaS payload.
The final encryption stage is a cross-platform Go/Rust binary that runs on Windows, Linux, and VMware ESXi. Encryption uses ChaCha20 when the target lacks AES-NI hardware support, falling back to AES-256-CTR when AES-NI is present. RSA-4096 wraps the symmetric key, with the public key embedded in the payload and the private key held by the operator.
Key points
- Qilin ranked #1 in June 2026 with 83 cases, ahead of Dire Wolf (68) and World Leaks (52).
- 41 manufacturing incidents and 92 US hits in the June 2026 window.
- Targets include Musashino University, Lee International IP & Law, ISUZU Motors, and the Central Bank of Libya.
- LockBit 5.0 (47 cases) and Akira (49) round out the top 5; Nova (45) and Metaencryptor (31) follow.
- Ransomware detections declined after March 2025, rose after November 2025, and dipped slightly in the last month.