Cybercrime critical Eastern Europe (Russia-linked, assessed)

Qilin

Ransomware-as-a-Service operation (Russia-linked, assessed) · Financial — ransomware and extortion

Reports 1

Active Since 2022

Last Reported 9 Jun 2026

Sectors Targeted finance, healthcare, communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

Multi-vendor VPN authentication bypass exploitation — simultaneous targeting across Check Point, Palo Alto, Fortinet, and F5
CVE-2026-50751 (Check Point IKEv1 auth bypass) exploited as zero-day for 37 days before any patch existed
Sliver C2 framework for persistent access and lateral movement
Rclone data exfiltration to attacker-controlled cloud storage before encryption
Tox protocol for operator communications
Cross-platform ransomware deployment — Windows, Linux, ESXi, and Nutanix environments
Double-extortion model: data exfiltration followed by encryption

Known Targets

Financial services organisationsHealthcare providers (UK and US)Critical infrastructure operatorsEnterprise networks across multiple sectors globally

Analyst Notes

Qilin affiliates conducted a coordinated multi-vendor VPN perimeter exploitation campaign in May–June 2026, systematically targeting authentication bypass vulnerabilities across four enterprise VPN platforms simultaneously. The Check Point exploitation window (7 May–4 June 2026) — 37 days with no patch available — represents one of the longest recent zero-day exploitation periods against enterprise security infrastructure. Infrastructure hosted across Kaupo Cloud HK, Shock Hosting, and Vultr. A disgruntled Qilin affiliate founded The Gentlemen ransomware operation in mid-2025 following a commission dispute, demonstrating the volatility of RaaS affiliate relationships. The group has previously targeted UK NHS-adjacent healthcare organisations.

Also Known As

Qilin (Agenda ransomware predecessor)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1486 Data Encrypted for Impact T1041 Exfiltration Over C2 Channel T1490 Inhibit System Recovery T1562.001 Impair Defenses: Disable or Modify Tools

Intelligence Reports

Briefing financehealthcare

Qilin Ransomware Affiliate Exploiting Authentication Bypasses Across Four VPN Platforms in Coordinated Campaign

A Qilin ransomware affiliate is systematically exploiting authentication bypass vulnerabilities across Check Point, Palo Alto Networks, Fortinet, and F5 VPN infrastructure simultaneously — with a month-long zero-day window on the Check Point flaw before any patch existed.

9 Jun 2026 · 4 min read