Qilin Claims Central Bank of Libya; DragonForce Hits BITS Pilani; Cartel Pace Continues with 39+ New Victims in 48 Hours

Qilin ransomware posted the Central Bank of Libya (cbl.gov.ly) to its dark web leak site on June 22, threatening to release confidential banking data, while DragonForce claimed India's premier BITS Pilani research university on the same date in a separate double-extortion listing. Leak site telemetry from Breachsense and Ransomware.live shows 39+ new victims posted across Qilin, DragonForce, TheGentlemen, INC_RANSOM, and Aurora in the 48-hour window ending June 23 — spanning financial services, aerospace R&D, insurance, and academia across at least 10 countries. The targeting of a central bank alongside a flagship engineering university in the same cycle illustrates the breadth of the Qilin/DragonForce cartel's sector-agnostic targeting posture heading into Q3 2026.

The targeting of a central bank alongside a flagship engineering university in the same cycle illustrates the breadth of the Qilin/DragonForce cartel's sector-agnostic targeting posture heading into Q3 2026.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.