The Qilin ransomware group claimed 104 victims in August, cementing its position as the world’s most active ransomware operation and nearly doubling the total of second-place Akira, which reported 56 attacks. The figures, compiled by security researchers at GBHackers, mark the fourth time in five months that Qilin topped the global ransomware leaderboard, underscoring the group’s relentless expansion and sophisticated affiliate recruitment strategy.
Affiliate Model Fuels Growth
Since the decline of RansomHub in April, Qilin has addressed 398 claimed victims, representing 18.4 percent of all ransomware incidents logged over the past five months. This figure places Qilin more than 70 percent ahead of Akira, which follows at 10.7 percent of total attacks. The group’s rapid growth can be attributed to its robust affiliate program, which offers lucrative incentives and flexible ransomware-as-a-service (RaaS) models. Affiliates departing former RansomHub or other operations find Qilin’s technical features particularly attractive, including multi-tier encryption chains, anonymous payment processing, and customizable leak sites. Total ransomware activity rose to 467 incidents in August, marking the fourth consecutive monthly increase, though still below February’s record highs.
New Entrants Reshape the Landscape
Perhaps the most striking development was the ascent of Sinobi, a newcomer that vaulted into third place after only two months of activity. Sinobi claimed 41 victims, 39 of which are U.S.-based, with the remainder in Australia and Taiwan. Initial speculation linked Sinobi to the Lynx group due to code overlaps and similarities in data leak site design, but Lynx continues to post fresh victims, suggesting the groups operate separately. The Gentlemen group, first observed in early September, has already posted over 30 victims, while Cephalus, first seen in early August, listed ten victims on its onion data leak site. Two Cephalus victims overlap with Qilin and Kawa4096, suggesting alliance networks aimed at amplifying extortion pressure.
Geographic and Sector Targets
Construction, professional services, manufacturing, and healthcare remain the most targeted sectors, followed by IT and technology companies and the automotive and finance industries. Geographically, the United States endures the lion’s share of attacks, but Europe and Canada, particularly Germany and the United Kingdom, continue to experience substantial activity. In the Asia-Pacific region, BlackNevas and Dire Wolf were significant threats, with South Korea, Japan, Thailand, Singapore, and Taiwan each suffering four or more attacks. Meanwhile, LockBit has launched its 5.0 release in an effort to rebound from law enforcement disruptions in 2024, showcasing novel evasion techniques and enhanced negotiation portals. Security researchers urge organizations to strengthen cyber resilience through network segmentation, zero trust policies, immutable backups, and proactive vulnerability management.
Sources: GBHackers; Cyble; Recorded Future; The Record
discussion