Ransom Ledger

Qilin

Also known as Agenda

One of the busiest ransomware brands since LockBit's fall. Its attack on the pathology firm Synnovis disrupted London hospitals, and it claimed the 2025 attack that stopped Asahi's breweries.

What it is
Ransomware-as-a-service
Based
Russian-speaking
Active
2022–
Status
Active

On the record

  1. Oct 2025 · The Record

    Qilin claims the attack that halted Asahi's Japanese breweries

  2. Jun 2024 · BankInfoSecurity

    Qilin demanded $50 million from Synnovis

  3. Jun 2024 · BleepingComputer

    Qilin is linked to the attack on London hospitals' pathology provider

In the ledger

2 outages listed

  • Jun 2024Synnovis, London hospitals: 7,690 postponements. NHS England London: 6,199 outpatient appointments and 1,491 elective procedures in the first weeks.
  • Sep 2025Asahi Group: 6 breweries stopped. All six of Asahi's Japanese breweries halted production.
The brick clock tower of King’s College Hospital against a blue sky
King’s College Hospital, London, 2015. Synnovis runs pathology for King’s and for Guy’s and St Thomas’. Photo: FormerBBC, CC BY-SA 4.0.
The Asahi Suita brewery: a red-brick hall beside white production buildings and silos
Asahi’s Suita brewery near Osaka, 2014. Photo: Tokumeigakarinoaoshima, CC0.