Qilin’s record August drive signals sustained ransomware dominance

At a glance

What this is: ZeroFox says Qilin was the most prominent ransomware and digital extortion collective in August 2026, with at least 165 incidents and a continued lead over other groups.

Why it matters: For IAM, PAM, NHI, and security teams, the message is that repeatable extortion campaigns still exploit identity exposure, overprivileged access, and delayed containment more than novel malware.

By the numbers:

• Qilin accounted for at least 165 incidents in August 2026.
• Qilin claimed at least 1,480 incidents between September 1, 2025, and August 31, 2026.
• Qilin accounted for nearly 29 percent of the top 10 most active collectives.
• Akira accounted for approximately 14 percent of the top 10 most active collectives.

Context

Ransomware and digital extortion campaigns are not defined only by encryption. They are coordinated operations that combine intrusion, privilege abuse, data theft, and public pressure to force payment or disruption.

Qilin’s current pace shows how industrialised extortion has become: the group is not relying on one-off bursts, but on a durable operating model that scales across sectors and regions. For identity programmes, that means the control problem is not limited to endpoint recovery; it includes exposed credentials, unmanaged remote access, and privileged accounts that remain valid long enough to be abused.

Key questions

Q: Why do attackers keep succeeding with ransomware and DoS extortion campaigns?

A: These campaigns keep working because many organisations still pay quickly, often before they understand what happened or how far the intrusion spread. Attackers also adapt their methods, including ransomware-as-a-service and denial-of-service extortion, to keep pressure high. When controls are weak and response is unclear, criminals can repeat a proven model with little resistance.

Q: Why do identity-centric controls matter for ransomware and insider risk?

A: They matter because ransomware and insider abuse often succeed after an identity is already trusted. If the identity can still reach sensitive systems, the attacker or malicious insider can move, encrypt, or exfiltrate before traditional controls react. Identity-centric controls narrow that path and limit the damage.

Q: What are the signs that ransomware is already moving through an environment?

A: Common warning signs include unusual file renaming or bulk rewriting, privilege escalation, suspicious lateral movement, sudden system slowdown or crashes, and outbound connections to known malicious infrastructure. Teams should also watch for processes that rapidly read and rewrite many files at once. These indicators matter because they often appear before full encryption completes and containment becomes harder.

Q: Should organisations prioritise adaptive security over recovery planning?

A: They should not replace recovery planning, but they should stop treating recovery as the end goal. Recovery restores operations after damage; adaptive security reduces how much damage can occur next time. The right balance is recovery for continuity and anti-fragility for programme improvement, with adaptation focused on the controls that most affect blast radius.

Technical breakdown

Why double-extortion operations scale so well

Double extortion combines data theft with encryption or disruption so the attacker can pressure the victim from two directions at once. The model works because data exfiltration creates leverage even when recovery is possible, and encryption creates urgency even when backups exist. Criminal groups like Qilin favour this approach because it increases monetisation without requiring every target to be fully encrypted. In practice, the real control gap is often not one weak safeguard but a chain of weak points: exposed credentials, too much privilege, insufficient segmentation, and delayed incident containment. See the Incident Response Plan Template.

Practical implication: reduce the attacker’s leverage by limiting data reach and privileged access before extortion actors can stage exfiltration.

What ransomware-as-a-service changes in the attack economy

Ransomware-as-a-service separates the malware operator from the affiliate or broker carrying out the intrusion. That division creates scale, because the group can recruit operators, share infrastructure, and standardise tradecraft while keeping the brand and leak site central. It also blurs detection, because the same family may appear across many industries and geographies with similar TTPs but different initial access methods. For defenders, the key point is that the criminal business model is designed for repetition, not novelty, so controls must be built to withstand recurring patterns rather than a single named threat. See the Threat Actor Groups Guide.

Practical implication: tune detection and response for repeated access paths, not just one-off indicators tied to a single intrusion.

Why identity exposure still matters in ransomware campaigns

Ransomware crews usually do not need exotic exploits when identity controls are weak. Stolen credentials, overprivileged service accounts, accessible admin interfaces, and unrotated secrets can all provide a path from initial access to data theft or destructive action. That is why extortion reporting keeps intersecting with IAM and NHI governance even when the article is not about identity by name. The underlying pattern is simple: if an attacker can authenticate as a legitimate identity, many downstream controls become easier to bypass. See the Ransomware Groups Guide.

Practical implication: treat privileged and machine identities as likely attack paths and verify that access scope, revocation, and monitoring are enforced.

Threat narrative

Attacker objective: The objective is to maximise extortion leverage by stealing data, disrupting operations, and coercing payment through public pressure.

1. Entry typically begins with initial access obtained through stolen credentials, exposed remote services, or brokered access inside a target environment.
2. Escalation follows when the attacker expands privileges, moves laterally, and reaches systems that hold valuable data or operational leverage.
3. Impact is delivered through double extortion, combining data theft with encryption or disruption to increase pressure on the victim.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• 230M AWS environment compromise: 230M AWS environments compromised via exposed .env files with cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Qilin’s persistence is the main signal, not its monthly peak. A collective that stays at the top for 17 months is demonstrating operational consistency, affiliate discipline, and repeatable monetisation rather than a temporary spike. That matters because defenders often overreact to a single burst and under-prepare for an adversary that can keep returning with the same playbook. The practical lesson is to build controls for sustained campaign pressure, not just headline incidents.

Identity exposure is still the enabling condition behind many ransomware intrusions. The article is about extortion tempo, but the governance issue underneath is access integrity: if credentials, admin interfaces, and service identities are easy to abuse, ransomware actors do not need to invent a new path. Ransomware groups guide is useful here because repeatable extortion campaigns depend on repeatable access methods. The practitioner takeaway is to narrow authentication paths before the actor turns access into leverage.

Sector concentration shows where governance friction is highest. Manufacturing, construction, professional services, retail, and healthcare remain attractive because operational urgency makes disruption expensive and recovery slow. That is not a reason to treat these sectors as uniquely vulnerable in abstract terms; it is a reminder that business pressure can delay containment decisions. The practical implication is to align identity controls, backup readiness, and response authority with the business processes most likely to be targeted.

Double extortion rewards environments that cannot see data movement quickly enough. Once exfiltration is part of the model, the defender is no longer only racing encryption. The real question becomes whether the organisation can detect unusual access, restrict privileged movement, and stop staged data collection before it becomes leverage. In framework terms, this is as much a visibility and access-governance problem as a malware problem. The practical conclusion is to measure how fast your programme can spot and contain abuse of legitimate access.

R&DE is now a business model for scale, not a side effect of malware. Qilin’s numbers show that extortion crews are running an enterprise operation with target selection, timing, and monetisation discipline. That means security teams should stop treating ransomware as only a recovery problem and start treating it as a recurring access-governance challenge. The correct response is to reduce the value of every legitimate account an attacker could hijack.

What this signals

Extortion tempo is now a governance signal. When one actor can sustain dominance for more than a year, the relevant question is not how to chase the latest indicator but how quickly the programme can remove attacker leverage. That means identity, segmentation, and recovery planning must be measured together, because any one weak area can keep the extortion loop alive.

Ransomware resilience depends on reducing authentication value. The more a stolen or abused identity can reach, the more attractive it becomes to an extortion crew. Security leaders should read Qilin-style activity as a prompt to reassess whether privileged access, service accounts, and remote entry points are still too generous for the business processes they protect.

For practitioners

• Harden remote access paths Review VPN, remote desktop, and admin portal exposure, then require phishing-resistant authentication and tight conditional access for any pathway that can reach sensitive systems.
• Reduce standing privilege Remove persistent admin rights from user, service, and emergency accounts wherever task-based elevation is sufficient, and verify that revocation is actually enforced.
• Segment systems that store leverage data Separate file stores, backup repositories, and collaboration platforms from general user access so one compromised account cannot reach both operational and exfiltration targets.
• Test extortion response before a crisis Run a table-top exercise that covers credential revocation, backup validation, legal notification, and evidence preservation so teams do not improvise under pressure.

Key takeaways

• Qilin’s month-over-month dominance shows that ransomware and digital extortion remain a durable operating model, not a short-lived spike.
• The article’s scale numbers point to a repeatable campaign engine that keeps pressure on multiple sectors and regions.
• The most effective response is to shrink attacker leverage by tightening identity controls, remote access, and containment discipline before exfiltration starts.

Related NHI Mgmt Group resources: Incident Response Plan Template · Ransomware Groups Guide · Top 10 Active Directory Security Risks · 230M AWS environment compromise

Key terms

• Ransomware-as-a-Service: A criminal operating model where ransomware developers provide tooling, infrastructure, and support to affiliates who carry out attacks. This model lowers the barrier to entry for attackers and increases scale, making identity-based entry points more attractive and more frequently targeted.
• Double extortion: A ransomware strategy that combines file encryption with data theft and the threat of public release. It raises pressure on the victim because recovery requires both restoring systems and managing exposure of stolen information, often before operational disruption is fully contained.
• Privilege Abuse: Privilege abuse is the misuse of legitimate elevated access to perform actions that were not intended or expected. In AD environments, it often follows credential theft or over-permissioning, and it can look like normal administration unless access changes and activity patterns are correlated.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control design to the broader security programme they run.