qilin - f4n6

notes

Ransomware: qilin named Orimar (BE)

1. Executive summary On 30 July 2026, the Qilin ransomware group listed Orimar (www.orimar.be), a Belgian organisation, as a victim on its leak site.

30 Jul 2026 · 3 min read read →

notes

Ransomware: qilin named Hoc (GB)

1. Executive summary On 28 July 2026, the Qilin ransomware group publicly claimed a victim named "Hoc" (domain: www.hocltd.com), a UK-based

29 Jul 2026 · 3 min read read →

notes

Ransomware: qilin named GURR Abdichtungstechnik GmbH (DE)

1. Executive summary On 25 July 2026, the Qilin ransomware group listed GURR Abdichtungstechnik GmbH (Germany) as a victim on its leak site. Attribution to the

25 Jul 2026 · 3 min read read →

notes

Ransomware: qilin named GOP (GB)

1. Executive summary On 24 July 2026, the Qilin ransomware group listed "GOP" (www.gopltd.com, GB) as a victim on its leak site.

25 Jul 2026 · 4 min read read →

notes

Ransomware: qilin named WellPerf (GB)

1. Executive summary On 2026-07-23, the Qilin ransomware group publicly named WellPerf (UK, www.wellperf.com) as a victim on its leak site. Attribution

23 Jul 2026 · 4 min read read →

notes

Ransomware: qilin named Primeline Logistics (IE)

1. Executive summary On 2026-07-22, the Qilin ransomware operation publicly named Primeline Logistics (Ireland, www.primeline.ie) as a victim on its leak site.

22 Jul 2026 · 4 min read read →

notes

Ransomware: qilin named Max Fordham (GB)

1. Executive summary On 2026-07-06, the Qilin ransomware group publicly claimed Max Fordham (www.maxfordham.com), a UK-based engineering consultancy, as a victim

06 Jul 2026 · 5 min read read →

notes

Risky Bulletin: Researcher drops giant cache of zero-day exploits

1. Executive summary An anonymous researcher using the pseudonym "Bikini" has published proof-of-concept exploit code and write-ups for more than a

01 Jul 2026 · 7 min read read →

notes

Ransomware: qilin named Bristol Place (GB)

1. Executive summary On 2026-06-29, ransomware tracking site ransomware.live published a victim listing naming Bristol Place (bristolplace.net, GB) as a target of

29 Jun 2026 · 4 min read read →

notes

Ransomware: qilin named Gsma (GB)

1. Executive summary On 2026-06-29, the ransomware operator/group "qilin" publicly claimed a ransomware attack against Gsma, an organisation based in Great

29 Jun 2026 · 3 min read read →

notes

Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs

1. Executive summary A new backdoor tracked as Mistic (also tracked as MLTBackdoor) has been deployed in financially motivated intrusions since April 2026, targeting organisations across

26 Jun 2026 · 8 min read read →

notes

Stealthy new backdoor emerges in attacks on multiple sectors

1. Executive summary Symantec and Carbon Black's Threat Hunter Team have identified a new backdoor dubbed Mistic (also tracked as MLTBackdoor by Zscaler) deployed

25 Jun 2026 · 8 min read read →