Qilin RaaS Surpasses 500 Victims in 2026, Claims Central Bank of Libya and Schumacher Homes on Leak Site Within Past 24 Hours

Qilin (aka Agenda) has now claimed over 500 victims in 2026 alone, cementing its position as the most active ransomware operation globally for an unbroken 12-month period, with the latest leak-site postings on June 22 including the Central Bank of Libya and U.S. homebuilder Schumacher Homes. The group's double-extortion RaaS model — now featuring a 'Call Lawyer' module that weaponizes GDPR/HIPAA regulatory exposure inside ransom negotiations — has produced 1,945 total claimed victims since 2022, with manufacturing (297), business services (256), and healthcare (176) as the top three sectors. MOXFIVE tracking notes North Korea-linked Moonstone Sleet has previously deployed Qilin ransomware, indicating affiliate overlap with state-sponsored actors and complicating attribution for defenders.

MOXFIVE tracking notes North Korea-linked Moonstone Sleet has previously deployed Qilin ransomware, indicating affiliate overlap with state-sponsored actors and complicating attribution for defenders.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.