RANSOMWARE FAMILY
Qilin
Qilin is a ransomware-as-a-service operation that has been behind a number of significant incidents affecting UK organisations, including disruption to NHS-linked services via a supplier attack in 2024. Like other modern groups, it pairs file encryption with data theft.
What to look for
- File encryption combined with a threat to leak stolen data
- Attacks frequently reaching an organisation through a third-party supplier or partner
- A ransom note left in affected directories directing victims to a negotiation portal
- Downstream disruption to services that depend on the affected organisation
Recovery approach
Because Qilin incidents often arrive via a supplier, part of our assessment looks at how the compromise reached you — not just the encrypted data.
OTHER FAMILIES WE SEE
Also covered
RansomHub
A fast-growing ransomware-as-a-service operation that has absorbed affiliates from several disrupted groups.
What to look for →Play
Also known as PlayCrypt, a group that frequently exploits exposed VPN and remote-access systems.
What to look for →Medusa
A ransomware-as-a-service group operating a public leak site, frequently targeting healthcare and education.
What to look for →Ryuk
An older but historically significant family, often deployed as the final stage of a wider malware infection.
What to look for →