[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJh5xXOz0csODhq88h4f34uqHtATcGeUQotCb-TBHVJo":3,"$foS6PJin-bzYCK0LbZLikN9mqagCcltd6lhOIX5GL0Vs":113},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":110,"created_at":111,"updated_at":112,"published_at":33},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC ranks Qilin first among top 10 ransomware groups in June 2026, ahead of Dire Wolf (68) and World Leaks (52).","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[10,11,12,13,14],"Qilin","Ransomware","AhnLab ASEC","Manufacturing","US","# Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims\n\n*AhnLab ASEC ranks Qilin first among top 10 ransomware groups in June 2026, ahead of Dire Wolf (68) and World Leaks (52).*\n\n**Tags:** `Qilin` `Ransomware` `AhnLab ASEC` `Manufacturing` `US`\n\n> AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.\n\n---\n\n## Qilin leads June 2026 with 83 cases\n\nAhnLab ASEC’s June 2026 ransomware trend report ranks Qilin as the most active group of the month with 83 confirmed cases, ahead of Dire Wolf (68) and World Leaks (52). The top 10 also includes Akira (49), LockBit 5.0 (47), Nova (45), Metaencryptor (31), Play (31), Inc Ransom (30), and DragonForce (22).\n\nIn the same June window, Qilin accounteded for 41 Manufacturing incidents and 92 US-based hits, reinforcing its position as the primary RaaS operator for the month.\n\n## 37 UK organisations hit in H1 2026\n\nQilin’s Tor data leak site listed up to 37 UK-based victims in H1 2026, the highest count of any ransomware group for the period. DragonForce followed with 21 UK victims, and TheGentlemen with 18.\n\nThe 37 UK entries span six sectors: Construction & Property Development, Manufacturing & Engineering, Legal & Professional Services, Technology & IT Infrastructure, Education, and Healthcare. Most victims reported revenue between £10m and £250m, consistent with Qilin’s preference for SMEs large enough to pay mid-tier ransoms but typically lacking a dedicated 24\u002F7 SOC.\n\nSalford City College appeared on both the Qilin and DragonForce DLS between 6 and 10 March 2026. The cross-posting is unexplained but suggests either a single affiliate running both RaaS platforms or two separate affiliates hitting the same target.\n\n## NHS Synnovis fallout: 32,000 patient records\n\nBedfordshire Hospitals NHS Foundation Trust disclosed on 1 June 2026 that it exfiltrated more than 32,000 patient records from its supplier, Synnovis, in a Qilin ransomware attack. The data includes patient name, NHS number, date of birth, postcode, and test results.\n\nThe trust said it took over a year to map the exfiltrated records back to individual patients, a typical lag for Synnovis test data where the lab holds the raw results and the NHS trust holds the patient demographics.\n\n## Securotrop: the Qilin affiliate\n\nSecurotrop is a Qilin RaaS affiliate that deploys the unmodified Go\u002FRust payload across Windows, Linux, and VMware ESXi targets. The group has publicly confirmed it runs the original Qilin code without local modifications, placing it in the affiliate-brand category rather than a distinct malware family. Infrastructure overlap with the parent operation has been confirmed through independent tracking sources.\n\nEncryption uses ChaCha20 when the target lacks AES-NI hardware support, falling back to AES-256-CTR when AES-NI is present. RSA-4096 wraps the symmetric key, with the public key embedded in the payload and the private key held by the operator. The Tor DLS lives at securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion, which is also listed as a Qilin extortion link in the Qilin tracker.\n\nFirst observed in October 2025, Securotrop is assessed as a CIS-linked organized crime group with purely financial motivation. The CIS connection comes from Qilin RaaS’s recruitment pattern on Russian-language forums and its explicit exclusion of CIS entities from targeting. The group’s country of origin remains unconfirmed.\n\n## Exploit stack: VPN, SmarterMail, Web Help Desk, BYOVD\n\nInitial access typically comes through corporate VPN gateways. Qilin operators exploit Fortinet, Check Point, and WatchGuard appliances to land on the target network, a pattern shared across most ransomware groups but consistent here.\n\nLess common in the wild are SmarterTools SmarterMail and SolarWinds Web Help Desk. Both appear in Qilin's tool matrix and are also exploited by the Warlock ransomware gang, making them a useful secondary entry point when the VPN is patched or the target runs a web-based mail\u002Fhelp stack.\n\nOnce inside, the group leans on Bring Your Own Vulnerable Driver (BYOVD) to slip past EDR and AV. The driver is loaded in-process to bypass signature-based detection, a standard move for Qilin's RaaS payload.\n\nThe final encryption stage is a cross-platform Go\u002FRust binary that runs on Windows, Linux, and VMware ESXi. Encryption uses ChaCha20 when the target lacks AES-NI hardware support, falling back to AES-256-CTR when AES-NI is present. RSA-4096 wraps the symmetric key, with the public key embedded in the payload and the private key held by the operator.\n\n## Key points\n\n- Qilin ranked #1 in June 2026 with 83 cases, ahead of Dire Wolf (68) and World Leaks (52).\n- 41 manufacturing incidents and 92 US hits in the June 2026 window.\n- Targets include Musashino University, Lee International IP & Law, ISUZU Motors, and the Central Bank of Libya.\n- LockBit 5.0 (47 cases) and Akira (49) round out the top 5; Nova (45) and Metaencryptor (31) follow.\n- Ransomware detections declined after March 2025, rose after November 2025, and dipped slightly in the last month.\n\n## Further reading & sources\n\n- [June 2026 Ransomware Trend Report - ASEC](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F94619) — AhnLab Security Intelligence Center\n- [UK Cybercrime Journal: Qilin Ransomware Rampage in H1 2026](https:\u002F\u002Fblog.bushidotoken.net\u002F2026\u002F07\u002Fuk-cybercrime-journal-qilin-ransomware.html)\n- [Threat Intelligence Report June 2 to June 8, 2026](https:\u002F\u002Fredpiranha.net\u002Fnews\u002Fthreat-intelligence-report-jun-2-jun-8-2026)\n- [New Threat Actor: Securotrop - Joe Shenouda | Threat Intelligence](https:\u002F\u002Fshenouda.nl\u002Fnew-threat-actor-securotrop)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d",{"actors":18,"targets":68,"industries":88,"technologies":103},[19,25,29,34,39,43,47,51,56,59,64],{"url":20,"name":21,"slug":21,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fqilin","qilin","ransomware","Russia \u002F Russian-speaking (excludes CIS countries from targeting)","financial",{"url":26,"name":27,"slug":27,"type":22,"origin":28,"motivation":24},"\u002Fthreat-groups\u002Fdragonforce","dragonforce","Unknown; hacktivist origins (possible Malaysia) evolving to a financially motivated Russia-nexus RaaS",{"url":30,"name":31,"slug":32,"type":22,"origin":33,"motivation":24},"\u002Fthreat-groups\u002Fthegentlemen","The Gentlemen","thegentlemen",null,{"url":35,"name":36,"slug":37,"type":22,"origin":38,"motivation":24},"\u002Fthreat-groups\u002Fwarlock","Warlock","warlock","China (assessed with moderate confidence by Microsoft)",{"url":40,"name":41,"slug":42,"type":22,"origin":33,"motivation":24},"\u002Fthreat-groups\u002Fdirewolf","Dire Wolf","direwolf",{"url":44,"name":45,"slug":46,"type":22,"origin":33,"motivation":24},"\u002Fthreat-groups\u002Finc-ransom","INC Ransom","inc-ransom",{"url":48,"name":49,"slug":50,"type":22,"origin":33,"motivation":24},"\u002Fthreat-groups\u002Fworld-leaks","World Leaks","world-leaks",{"url":52,"name":53,"slug":54,"type":22,"origin":55,"motivation":24},"\u002Fthreat-groups\u002Fakira","Akira","akira","Russia (suspected; overlaps with Conti)",{"url":57,"name":58,"slug":58,"type":22,"origin":33,"motivation":33},"\u002Fthreat-groups\u002Fnova","nova",{"url":60,"name":61,"slug":62,"type":22,"origin":63,"motivation":24},"\u002Fthreat-groups\u002Fplay","Play","play","Unknown",{"url":65,"name":66,"slug":67,"type":22,"origin":33,"motivation":24},"\u002Fthreat-groups\u002Fmetaencryptor","MetaEncryptor","metaencryptor",[69,74,77,82,85],{"name":70,"sector":71,"status":72,"geography":73},"Salford City College","Education","confirmed","UK",{"name":75,"sector":76,"status":72,"geography":73},"Bedfordshire Hospitals NHS Foundation Trust","Healthcare",{"name":78,"sector":79,"status":80,"geography":81},"Central Bank of Libya","Finance","targeted","Libya",{"name":83,"sector":84,"status":80,"geography":33},"Lee International IP & Law","Professional services",{"name":86,"sector":71,"status":80,"geography":87},"Musashino University","Japan",[89,92,95,99],{"url":90,"name":71,"slug":91},"\u002Findustries\u002Feducation","education",{"url":93,"name":76,"slug":94},"\u002Findustries\u002Fhealthcare","healthcare",{"url":96,"name":97,"slug":98},"\u002Findustries\u002Fbanking","Banking","banking",{"url":100,"name":101,"slug":102},"\u002Findustries\u002Fprofessional-services","Professional Services","professional-services",[104,107],{"vendor":105,"product":106},"SmarterTools","SmarterMail",{"vendor":108,"product":109},"Fortinet","Fortinet VPN Gateway","ransomware_incident","2026-09-18T07:07:39.952851+00:00","2026-10-16T12:28:34.091765+00:00",{"articles":114},[115,127,138,149],{"slug":116,"title":117,"summary":118,"tags":119,"hero_image_url":124,"story_type":125,"created_at":126},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.",[120,12,121,122,123,11],"Gunra","Operation Double Barrel","FortiOS","FortiProxy","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","threat_actor_activity","2026-09-18T07:15:06.272711+00:00",{"slug":128,"title":129,"summary":130,"tags":131,"hero_image_url":136,"story_type":110,"created_at":137},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[132,133,134,11,135],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":139,"title":140,"summary":141,"tags":142,"hero_image_url":147,"story_type":110,"created_at":148},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[143,11,144,145,146],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":150,"title":151,"summary":152,"tags":153,"hero_image_url":157,"story_type":110,"created_at":158},"inc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak","INC Ransom Extorted 24 US Law Firms; 58% Paid Without a Leak","SOCRadar identified 24 individualized INC Ransom extortion pages for US law firms from a March 2026 campaign, cross-referenced them against INC's leak site, and found only 10 of 24 (42%) listed, implying 14 (58%) paid or are unlisted.",[45,154,155,156,14],"law firm","extortion","leak site","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finc-ransom-extorted-24-us-law-firms-58-paid-without-a-leak.png?v=7e1c94e2e7","2026-08-31T12:15:18.010257+00:00"]