Qilin Ransomware Continues to Impact Manufacturing Sector

In the second half of 2025, the Qilin ransomware group has continued to publish victim information on its leak site, impacting over 40 cases per month. The manufacturing sector has been the most affected, followed by professional and scientific services, and wholesale trade. The attackers have used tools like Cyberduck for data exfiltration and legitimate Windows applications like mspaint.exe and notepad.exe to inspect sensitive information. The group employs a double-extortion strategy, combining file encryption with the threat of public data exposure.