The Qilin campaign claimed 29 financial organizations headquartered in the Republic of Korea as victims to their DLS in a mid-September Qilin campaign.

Qilin claimed 56 victims (organizations and individuals) in Q3 2024.

Qilin was the most active threat group in June 2025, responsible for 16% of all attacks, which amounted to 60 cases.

Qilin ranked as the third most active threat group in May 2025 with 42 attacks.

Qilin saw a significant rise in Q2 2025 with 151 attacks, up from 95 attacks in Q1.

Qilin saw an 85% increase in activity, making it the most active threat group in Q2 2025.

Spain and other Spanish-speaking countries each accounted for less than 4% of Qilin's total victim volume in Q2.

80% of the organizations named by Qilin in Q2 were based in the US.

Qilin showed an 80% increase in activity in Q2 compared to Q1 2025.

Qilin emerged as the top ransomware threat in Q2 2025.