Qilin leads 32 new ransomware leak-site claims in 24-hour global surge
Data desk analysis shows Qilin is the most active group, with the United States facing the highest number of unverified claims.
Key points
- Thirty-two new ransomware leak-site claims were recorded in a single 24-hour period.
- The Qilin group accounted for nine of these claims, making it the most active actor.
- Nineteen of the claims targeted organizations located in the United States.
Our data desk analysis of public records from the ransomware.live tracker reveals that thirty-two new ransomware leak-site claims emerged within a 24-hour window. These unverified statements represent criminal groups asserting control over victim data, with Qilin identified as the most prolific group during this specific period of heightened activity.
At a glance
- Claims (24h)
- 32
- Active groups
- 14
- Most active
- Qilin (9)
- Countries
- 12
The Qilin group filed nine claims, followed closely by the N0n group with seven. Storm submitted three claims, while payload and Global Secret Group each filed two. LockBit 5, Redact, and incransom each recorded one claim. These figures reflect only the volume of public assertions made by threat actors on their respective leak sites during this timeframe.
Geographic and Sector Distribution
The United States was the most targeted location, accounting for nineteen of the thirty-two claims. Germany followed with two claims, while Canada, Spain, India, and the United Arab Emirates each saw one claim. This geographic spread highlights the broad reach of current ransomware campaigns, though the majority of activity remains concentrated in North America during this reporting window.
Manufacturing and transportation sectors were the hardest hit, with four claims each. Retail and e-commerce, professional services, and financial services each recorded three claims. Victim names are deliberately excluded from this report to prevent further harm to affected organizations, as per standard safety protocols for reporting on active cyber incidents.
Understanding Leak-Site Claims
Leak-site claims are unverified assertions made by criminal groups to pressure victims into paying ransoms. These statements do not confirm whether a breach actually occurred or if data was successfully exfiltrated. Organizations should treat these claims as potential indicators of compromise rather than confirmed incidents until independent verification is possible through internal logs and security monitoring.
The source material lists the counts by group, country, and sector but does not provide context on the motives or coordination behind these specific claims. Security teams should monitor these trends to anticipate potential targeting patterns, but avoid assuming guilt or compromise based solely on public leak-site postings.
What should you do?
Security professionals should review their monitoring tools for any indicators matching the groups mentioned. Ensure that incident response plans are up to date and tested. Verify the status of critical systems and backups to ensure resilience against potential extortion attempts.
What to do and how to stay safe: Qilin
- Monitor threat intelligence feeds for new claims from Qilin, N0n, and other active groups to assess potential exposure.
- Verify that offline backups are current and accessible, ensuring critical data can be restored without paying ransoms.
- Review access logs for unusual activity that might indicate unauthorized data exfiltration or lateral movement.
- Train staff to recognize phishing attempts that often precede ransomware deployments, reducing the initial attack surface.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware group was most active in the last 24 hours?
Qilin was the most active group, filing nine leak-site claims in the 24-hour period analyzed.
How many countries were affected by these claims?
Six countries were affected: the US, Germany, Canada, Spain, India, and the UAE.
Were any specific victim names released?
No, victim names are deliberately not reported to protect affected organizations from further harm.
