Qilin Ransomware Claims at Least 365 Victims in Three Months of Attacks
The Qilin ransomware group has publicly claimed at least 365 organizations as victims across three months, according to an investigation into cybercrime published on November 11, 2026. The figure reflects only victims claimed by the group itself and does not represent independently verified breaches.
Active since September 2022, Qilin functions as a ransomware-as-a-service operation. The core group maintains the attack platform while third-party affiliates perform intrusions and deploy the ransomware in exchange for at least 80 percent of ransom payments. The operation relies on double extortion, in which attackers exfiltrate sensitive files prior to encryption and threaten to publish the material if the ransom is not paid.
A survey referenced in the investigation identified Qilin's affiliate program as the most active in the world during the observed period. The group's technical capabilities extend beyond standard workstations. Prior reporting documented attacks against VMware vCenter and ESXi hypervisors, leveraging remote management tools, network propagation techniques, and vulnerable drivers to disable security products. Compromising the virtualization layer allows attackers to disrupt multiple business systems from a single entry point.
The same investigation connected the group's administrator, known online as Haise, to Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of Saint Petersburg, Russia. This attribution stems from research findings rather than any judicial ruling or criminal charges. Researchers traced the connection through reused identities: Haise applied to the Russian cybercrime forum RAMP in June 2022, and private messages also referenced the Telegram handle Alexbigboss44, which appeared in 2020 posts on the Exploit and XSS forums under the nickname Rjun. An email used to register the Rjun accounts led to leaked records from the Russian government platform Gosuslugi.
Researchers recovered more than 5,000 Telegram messages linked to the identifier since 2018, along with additional contact details and travel records obtained from data leaks. The case illustrates a persistent weakness in long-running criminal operations: changing usernames does not erase historical links between accounts. The investigation did not determine whether Qilin operations have ceased.
Related articles
Negotiating with Ransomware Attackers: Lifeline or Legal Trap?
Ransomware incidents leave organizations facing encrypted systems and threats to leak stolen data, prompting urgent questions about whether to contact extortionists. Experts emphasize that initial response must focus on containment, evidence preservation, and backup verification rather than immediate payment discussions. NCSC guidelines stress isolating affected systems, securing communication channels, and understanding the exact nature of demands before any dialogue begins. Real-world cases such as the PowerSchool breach demonstrate that paying ransoms does not ensure data deletion or end extortion attempts. Legal risks vary by jurisdiction, with prohibitions in places like North Carolina and sanctions concerns from OFAC complicating decisions for many entities. Technical recovery options, including tools from the No More Ransom project, should be evaluated alongside insurance and regulatory notification requirements under Russian Federal Law No. 152-FZ. Ultimately, successful resolution depends on verified restoration capabilities and eliminating attacker persistence rather than any negotiated discount.
Ransomware Group BYOD Claims Theft of Toyota Customer Personal Data in Unverified Extortion Listing
A ransomware group calling itself BYOD has added Toyota to its victim list on a dark web extortion site, claiming to have stolen personal information belonging to the automaker’s customers. The announcement, updated on November 10, 2026, alleges access to full names, email addresses, physical addresses, telephone numbers, and dates of birth, along with data from the company’s self-service kiosk terminals. No independent verification of the claims has been performed, and the listing provides no details on the volume of records, affected regions, or specific business units involved. The group states that parts of the environment were isolated but claims residual remote access paths remained; however, the announcement contains no technical indicators or proof-of-compromise samples. Toyota has not issued any public statement confirming or denying the incident. The report notes that similar unverified listings are sometimes used to pressure victims into negotiations and may include repackaged data from prior breaches. This marks a contrast with Toyota’s 2023 public disclosure of a separate cloud misconfiguration incident that the company itself reported.
Santos Port Authority Systems Offline After Suspected Cyber Incident and Possible Ransom Demand
The systems of Autoridade Portuária de Santos (APS), which manages Brazil's largest port, have been unavailable since the morning of November 6, 2026. The outage began after a power fluctuation that affected servers and later recurred despite initial restoration efforts. APS has confirmed a suspected cyber incident but has not determined the full scope or whether data was accessed. Local reporting indicates that alleged attackers demanded financial ransom to restore operations, though this claim remains unconfirmed by APS or federal police. Backups have been sent for forensic examination while Serpro technicians assist in recovery. Port operations continue using manual procedures and heightened security measures, but vessel and truck wait times have increased significantly.
ESTT Completes Cloud Infrastructure Recovery After Ransomware Attack on November 8
Hosting provider ESTT has announced that engineers are finalizing the restoration of its cloud infrastructure following a ransomware attack that occurred on November 8. The incident impacted virtualization clusters and cloud management systems, causing widespread disruption to client services. At this stage, the core components of the cloud infrastructure have been restored and all client virtual machines have been relaunched. A small portion of VPS instances remains unreachable over the network and requires additional network configuration work. ESTT continues to prioritize the return of every virtual server to normal operation despite the scale of the remaining tasks.