Qilin Ransomware Leverages Ghost Bulletproof Hosting for Global Attacks

Qilin ransomware is described as an increasingly prolific ransomware-as-a-service operation that has intensified global extortion campaigns by exploiting a covert network of bulletproof hosting providers. According to the piece, these BPH services allow Qilin’s operators and affiliates to host malware, data leak sites and command-and-control infrastructure with near impunity, backed by zero knowledge of customer checks and limited abuse remediation.

In late September 2025, Qilin claimed responsibility for an attack that crippled Asahi Group Holdings, Japan’s largest beverage manufacturer, with disruption spanning 30 factories and forcing a shift to manual, paper-based order fulfilment. The incident involved the exfiltration of about 27 GB of data, and in mid-October the group demanded $10 million USD for the stolen data, bypassing middlemen to accelerate pressure on the victim.

Since emerging in mid-2022 under the name Agenda, Qilin has evolved into a platform that offers affiliates a web panel to configure attacks, manage victims and negotiate ransoms, with affiliates typically keeping 80–85 percent of payments and operators 15–20 percent. The article notes that Tor-hosted data leak sites referenced IP addresses tied to Cat Technologies Co.

Limited in Hong Kong and Red Bytes LLC in Saint Petersburg, linking to a broader BPH conglomerate run by Lenar Davletshin, as part of the infrastructure that supports Qilin’s operations.