extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

Qilin

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under Qilin in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

HHS documents the Agenda-to-Qilin rebrand. MITRE separately identifies Water Galura as the operator cluster for the Qilin RaaS; that explicit mapping is displayed without treating every Qilin affiliate as Water Galura.

Source name
Qilin
Canonical lineage name
Qilin
Entity model
operation
First observed
July 2022
Last observed
Date not established
Current status
Not established

Documentary media

First page of the HHS HC3 Qilin also known as Agenda ransomware threat profile
HHS HC3 Qilin / Agenda threat profileFirst-page preview of the HHS HC3 threat profile reporting that the operation launched as Agenda in July 2022 and had rebranded as Qilin by September 2022.U.S. Department of Health and Human Services, Health Sector Cybersecurity Coordination Center · published 2024-06-18 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedHHS warns that some website imagery may be third-party stock and not public domain. This record uses only the unaltered first page of the agency-authored threat profile, at reduced resolution, and does not claim that all HHS-hosted assets are reusable.Source: U.S. Department of Health and Human Services, HC3 Threat Profile, 18 June 2024; acquisition mirror: American Hospital Association.

Known aliases

Evidence-backed names associated with this lineage record
AliasTypeFirst observedLast observedConfidenceSources
AgendaHHS HC3 reports that the operation launched as Agenda in July 2022 and had rebranded as Qilin by September 2022. Former name July 2022 September 2022 Confirmed MITRE ATT&CK · U.S. Department of Health and Human Services, Health Sector Cybersecurity Coordination Center

Historical timeline

Lineage and relationships

No evidence-backed relationship is currently recorded. Similar code, language, infrastructure style, or negotiation behavior is not enough on its own.

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

MITRE ATT&CK integration

G1050: Water Galura · mapping status confirmed · Confirmed

MITRE explicitly identifies Water Galura as the operators of the Qilin RaaS. This mapping does not assign every Qilin affiliate to Water Galura.

MITRE associated groups: GOLD FEATHER

Associated software

Associated campaigns

None listed.

MITRE ATT&CK 19.1, synchronized 2026-07-23. MITRE enrichment remains separate from extortion.wiki lineage claims.

External intelligence references

  1. Water Galura, Group G1050MITRE ATT&CK · MITRE ATTACK · authoritative secondary
  2. Qilin, Software S1242MITRE ATT&CK · MITRE ATTACK · authoritative secondary
  3. Qilin, aka Agenda RansomwareU.S. Department of Health and Human Services, Health Sector Cybersecurity Coordination Center · government advisory · primary authoritative

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Qilin notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Qilin. Its 3 archived notes are counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter Qilin records

Collection: 2 records · 39 messages

Qilin negotiation record collection
Participants Source Archive status
20250203 - from @RakeshKrish12 36 Qilin, Victim JSON Indexed
20240429 3 Qilin, Victim JSON Indexed