Qilin’s 165 incidents in August: what practitioners need to act on

TL;DR: Qilin accounted for at least 165 incidents in August 2026, its highest monthly total this year, according to ZeroFox, and held an unbroken 17-month run as the most active ransomware and digital extortion collective. The pattern matters because sustained double-extortion campaigns reward weak identity boundaries, exposed remote access, and slow containment.

Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “Flash Report: Qilin Claims Record Number of Monthly Attacks for 2026”.

By the numbers:

• Qilin accounted for at least 165 incidents in August 2026.
• Qilin claimed at least 1,480 incidents between September 1, 2025, and August 31, 2026.
• Qilin accounted for nearly 29 percent of the top 10 most active collectives.

Key questions

Q: Why do attackers keep succeeding with ransomware and DoS extortion campaigns?

A: These campaigns keep working because many organisations still pay quickly, often before they understand what happened or how far the intrusion spread.

Q: Why do identity-centric controls matter for ransomware and insider risk?

A: They matter because ransomware and insider abuse often succeed after an identity is already trusted.

Q: What are the signs that ransomware is already moving through an environment?

A: Common warning signs include unusual file renaming or bulk rewriting, privilege escalation, suspicious lateral movement, sudden system slowdown or crashes, and outbound connections to known malicious infrastructure.

Practitioner guidance

• Harden remote access paths Review VPN, remote desktop, and admin portal exposure, then require phishing-resistant authentication and tight conditional access for any pathway that can reach sensitive systems.
• Reduce standing privilege Remove persistent admin rights from user, service, and emergency accounts wherever task-based elevation is sufficient, and verify that revocation is actually enforced.
• Segment systems that store leverage data Separate file stores, backup repositories, and collaboration platforms from general user access so one compromised account cannot reach both operational and exfiltration targets.

Bottom line: Qilin’s month-over-month dominance shows that ransomware and digital extortion remain a durable operating model, not a short-lived spike.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →