News / Industry
Qilin ransomware led much of 2026, a lesson in exposure
Qilin ransomware topped many 2026 leaderboards, by several threat-intel counts. It rarely needs a zero-day. Stolen credentials and exposed VPNs are the way in.
Qilin ransomware spent much of 2026 at the top of the ransomware leak-site leaderboards, and how it got there matters more than the ranking. The operation, a ransomware-as-a-service business also tracked as Agenda, rarely reaches for an exotic zero-day. More often, it logs in. Stolen or purchased credentials and exposed, internet-facing remote-access appliances are its usual way through the front door. That makes the busiest operator of the year a clean illustration of where ransomware risk actually sits, and of what a defender can do about it before an affiliate ever arrives.
| Key fact | Detail |
|---|---|
| Group | Qilin, a ransomware-as-a-service operation |
| Also known as | Agenda |
| 2026 standing | Most active group for much of the year by leak-site counts (ZeroFox, NCC Group, Cyble); the lead narrowed late in 2026 |
| Common entry vectors | Stolen or purchased credentials; exposed, internet-facing remote-access appliances and VPNs (CybelAngel) |
| Top regions and sectors | North America the most-targeted region (Cyble); manufacturing and construction among the most-hit sectors |
A year near the top
No single tally is authoritative, but several point the same way. ZeroFox counted at least 1,480 Qilin incidents between September 2025 and August 2026, well ahead of the second-place group, The Gentlemen, at 767. It logged at least 165 Qilin claims in August 2026 alone, the most it had recorded for any single group in 2026. NCC Group put Qilin at roughly 15% of the ransomware attacks it tracked in August 2026. Cyble recorded about 370 Qilin attacks in North America in the first half of the year, close to a fifth of all ransomware incidents in the region. Industrial Cyber reported that ransomware activity hit a 2026 high, with Qilin the dominant name.
The lead was not permanent. By late in the year the gap had closed. An October tally compiled by HackerFeeds and reported through a tech-insider outlet put a group called N0n first with about 154 leak-site claims, The Gentlemen second at about 143, and Qilin third at about 140. The standing, in other words, is a moving picture rather than a fixed rank, which is exactly how these numbers should be read.
How Qilin gets in
Strip away the ranking and a consistent method remains. CybelAngel's profile of the group describes affiliates who increasingly just authenticate, using purchased or reused credentials instead of burning an exploit. The 2025 compromise of a major beverage maker reportedly began that way, with stolen credentials and no zero-day at all. When Qilin does exploit something, it tends to be an exposed remote-access appliance. The group has been tied to abuse of Fortinet VPN flaws, and CybelAngel links it, with medium confidence, to a post-compromise case involving CVE-2026-50751, a Check Point Remote Access VPN authentication bypass rated 9.3 that lets an unauthenticated attacker open a VPN session without a valid password. Check Point disclosed it in June 2026 after tracing exploitation back to May.
None of that needs a never-before-seen bug. It needs something reachable and a credential that works. That is the same attack-surface story behind the VPN zero-days we have covered, from the actively exploited Cisco ASA and FTD flaw to the Ivanti Connect Secure chain that reached root. The appliance built to guard remote access is also the one most exposed to the internet, and attackers of every tier, from a lone affiliate to an organized ransomware crew, converge on it.
The victim pattern fits the method. Vendor profiles of the group put North America at roughly 55% of its victims, in line with Cyble's regional figure, and manufacturing and construction sit among its most-hit sectors. Those are industries with sprawling networks, remote sites, and plenty of reachable infrastructure that no one has fully mapped.
The busiest ransomware operation of the year did not need a zero-day. It needed a credential that still worked and an appliance it could reach. That is an exposure problem before it is a malware one.
The Threatless read
Read the counts and the tradecraft together and the lesson is not really about Qilin. It is about exposure. Credentials that should no longer work still do, and appliances that should not be reachable still are. Both are things an organization can see and shrink before they become an entry point, and neither of them shows up on a severity score.
That reframes the defensive job. The useful question is not only which CVE is worst this week, but what you expose: which identities and credentials are live, which remote-access appliances face the internet, and which of them an attacker can actually reach. Answering it is the work of knowing your attack surface and running that check as a continuous loop instead of an annual audit, the discipline of continuous threat exposure management.
This is the premise Threatless is built on: AI-native exposure management that keeps the picture of what you expose current, so a reachable appliance or an exposed credential surfaces as work to close, not as an incident report later. Qilin did not top 2026 with anything exotic. It walked through doors that were left open. Map them, prioritize the ones an attacker can reach, and close those first.