Risk Letters

Threat actor

Qilin

TLP:CLEAR

Facts

  • Motivation: Financial
  • Malware and tools: Cobalt Strike, EasyUpload.io, EDRSandBlast, Evilginx, Kali Linux, MEGA, Mimikatz, NetExec, NetSupport, Nmap, Nping, PCHunter
  • Techniques (MITRE ATT&CK): Valid Accounts, Exploit Public-Facing Application, Phishing, Phishing: Spearphishing via Service, Command and Scripting Interpreter: PowerShell, Command and Scripting Interpreter: Unix Shell, System Services, System Services: Service Execution, Boot or Logon Initialization Scripts, Scheduled Task/Job, Scheduled Task/Job: Scheduled Task, Account Manipulation: SSH Authorized Keys
  • Last seen: 28 October 2026

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.