Qilin emerges as dominant ransomware operator amid market consolidation

The ransomware landscape is consolidating around a smaller number of major operators, with the Qilin ransomware-as-a-service group now identified as the leading player, according to research published by Infosecurity Magazine. The analysis shows that following the disruption or decline of several high-profile ransomware groups, the market has reconsolidated around operators like Qilin, which have maintained consistent activity, reliable infrastructure and effective affiliate recruitment. Qilin operates a ransomware-as-a-service model, providing tools, infrastructure and negotiation support to affiliates who carry out attacks in exchange for a share of ransom payments. The group has been linked to attacks across multiple sectors, including healthcare, manufacturing and professional services, and is known for using double extortion tactics that combine encryption with the threat of data publication.

Why this matters for UK organisations

This consolidation trend is operationally significant because it suggests that ransomware attacks are becoming more professionalised and consistent rather than fragmented and opportunistic. A smaller number of dominant operators means that attack techniques, negotiation tactics and targeting patterns may become more predictable, but it also means that these groups have greater resources, more sophisticated tooling and stronger operational security. The Qilin group's focus on double extortion underscores the importance of treating data exfiltration as a primary risk, not just encryption. Organisations should review whether backup and recovery plans account for data theft, whether incident response procedures include steps to assess what data may have been accessed, and whether cyber insurance policies and legal obligations are understood in the context of data publication threats. The operational challenge is ensuring that defences, response plans and recovery strategies reflect the reality of how modern ransomware attacks unfold, rather than outdated assumptions about encryption-only incidents.

What to review

Organisations should review whether incident response plans account for data exfiltration and publication threats, not just encryption. This includes checking whether backup strategies are sufficient to restore operations, whether there are processes to assess what data may have been accessed during an incident, and whether cyber insurance coverage and legal obligations are understood in the context of double extortion attacks. It is worth considering whether detection capabilities can identify data exfiltration activity, whether response teams understand how to investigate and contain data theft, and whether communication plans account for the possibility of stolen data being published. For organisations that have not recently tested their incident response plans, this is a prompt to review whether those plans reflect the current ransomware threat landscape.

Source: Infosecurity Magazine