Qilin Ransomware Gang Escalates Attacks in 2025, Targeting Critical Sectors Worldwide The Qilin ransomware gang has become one of the most prolific cybercriminal operations in 2025, compromising hundreds of organizations, including major corporations, government entities, and healthcare providers. In October alone, the suspected Russia-based group claimed over 185 victims, including Japanese beverage giant Asahi, the Texas city of Sugar Land, a North Carolina county government, and multiple Texas power companies. Cybersecurity firm Cisco Talos reported that Qilin has been publishing data from roughly 40 victims per month in the second half of 2025. Active since July 2022, the group has expanded its operations under a ransomware-as-a-service (RaaS) model, enabling rapid scaling and increased attack success rates. Nearly a quarter of its attacks target the manufacturing sector, followed by professional and scientific services (18%) and wholesale trade (10%). Qilin’s intrusion methods vary, but stolen administrative credentials often sourced from the dark web have been used to breach VPNs in multiple incidents. Comparitech tracked over 700 Qilin-related attacks in 2025, with 118 confirmed, predominantly affecting the U.S. (50%), alongside France, Canada, South Korea, and Spain. The group has also escalated ransom demands, including a $10 million extortion attempt against Kuala Lumpur International Airport in March and a $4 million demand following an attack on Cleveland’s Municipal Court in February. Despite law enforcement scrutiny after a 2024 attack on a British healthcare provider, Qilin has continued its operations, targeting entities like the government of Palau and a major U.S. newspaper chain.