Following the decline of the prominent RansomHub Ransomware as a Service (RaaS), there has been a significant increase in the Qilin Ransomware.
The ransomware landscape underwent a significant transformation in the second quarter of 2025 as Qilin Ransomware emerged as the leading threat following the unexpected collapse of RansomHub, which had been the most prolific Ransomware-as-a-Service (RaaS) operation. This transition reshaped the cybercriminal ecosystem, with Qilin quickly capitalising on the void left by RansomHub’s abrupt cessation of operations in early April 2025. RansomHub’s disappearance marked the end of an era for the leading RaaS platform, which had averaged approximately 75 listed victims per month over the preceding six months. The sudden exit of RansomHub left numerous affiliates scrambling for alternative platforms, creating an opportunity that Qilin seized with remarkable speed. The impact was immediate and measurable, as many former RansomHub operators migrated their operations to Qilin’s infrastructure, resulting in a dramatic surge in Qilin’s activity.
Check Point researchers reported that Qilin nearly doubled its victim count from an average of 35 victims per month to almost 70 during this period. This shift represents one of the most significant power changes observed in the ransomware ecosystem, underscoring how quickly threat actors can adapt and redistribute following major disruptions. The migration pattern indicates a level of operational continuity that highlights the resilience and adaptability of modern ransomware networks. Qilin’s rise to prominence has been accompanied by the introduction of sophisticated extortion mechanisms, moving beyond traditional encryption-based attacks to embrace a comprehensive data-theft-and-exposure model. This evolution maximises pressure on victims while minimising operational risks associated with file encryption. The ransomware operation now offers an integrated Distributed Denial-of-Service (DDoS) capability within its administrative panel, allowing affiliates to overwhelm victim networks during negotiations.
