TOKYO, October 19, 2026 — International hacking group Qilin has claimed responsibility for a ransomware attack on subsidiaries of Keio Railway, threatening to release stolen data if demands are not met. The attack, which occurred on September 26, disrupted hotel reservations and email systems, highlighting Qilin’s continued focus on critical infrastructure in Asia.
Qilin’s Rise as a Dominant Ransomware-as-a-Service Operation
Qilin operates as a financially motivated ransomware-as-a-service (RaaS) group, likely based in Russia or another former Soviet state, according to Barracuda. Since its emergence in the first half of 2025, the group has rapidly expanded its operations, capitalizing on the vacuum left by RansomHub’s dormancy in April 2025. Figures show that Qilin’s average monthly victim count surged from 35 to nearly 70, solidifying its position as a leading ransomware operation.
The group’s success stems from its aggressive targeting of diverse sectors, including healthcare, and its ability to attract experienced affiliates. Qilin’s leak site recorded over 40 victim postings monthly in 2025, with spikes of approximately 100 in June and August. This growth was further fueled by substantial investments in its RaaS platform, which now includes automated negotiation, legal support, media assistance, and data-leak hosting.
Technical Infrastructure and Affiliate Model
Qilin’s ransomware binaries have undergone significant updates, optimizing cross-platform support, virtualization-focused attacks, and enterprise-scale deployment. This full-service affiliate platform has enabled Qilin to compete effectively, even as new groups like The Gentlemen challenge its dominance with higher payout offers.
This tactic, reported by ReliaQuest, allows the groups to gain initial access to internal networks, often bypassing detection until significant damage is done.
International Law Enforcement Pressure and Investigations
Qilin’s high-profile attacks have drawn intense scrutiny from international law enforcement. In May 2026, German authorities arrested a 28-year-old Russian national, Vladimir K., in Japan, extraditing him to Germany on October 2. This arrest was part of Operation ALBUS, launched in 2024 following a $100 million ransomware payment from an unnamed German logistics company.
The investigation, which spanned 21 months, leveraged victim reporting, forensic evidence, intelligence sharing, and cross-border cooperation. According to Barracuda, investigators infiltrated Qilin’s infrastructure, analyzed cryptocurrency flows, and monitored its operations, demonstrating the vulnerability of even the most successful ransomware groups to sustained law enforcement efforts.
Current Status and Impact on Critical Infrastructure
Despite law enforcement pressure, Qilin remains active, as evidenced by the Keio Railway attack. The group’s focus on critical infrastructure in Asia, including transportation and healthcare, underscores its strategic targeting of high-impact sectors. The Keio Railway incident, which disrupted operations and threatened data exposure, highlights the group’s ability to exploit vulnerabilities in essential services.
As Qilin continues to evolve its tactics and infrastructure, organizations must remain vigilant, particularly in patching known vulnerabilities like CVE-2026-0257. The group’s operational resilience and international reach signal that it will remain a significant threat, even as law enforcement agencies intensify their efforts to dismantle its network.
Qilin’s Exploitation of Unpatched Systems and the Role of CVE-2026-0257
Qilin’s ability to infiltrate critical infrastructure, as demonstrated in the Keio Railway attack, is closely tied to its exploitation of unpatched vulnerabilities. One such vulnerability, CVE-2026-0257, has been a focal point for Qilin and its affiliate Settra. This high-severity flaw in Palo Alto Networks products allows unauthorized VPN sessions to be established, providing initial access to internal networks. Despite a patch being available since May 2026, many systems remain unpatched, leaving organizations vulnerable to exploitation.
ReliaQuest reported that Qilin and Settra are actively targeting this vulnerability, often deploying offensive security tools like Cobalt Strike, BloodHound, and SharpHound. The exploitation of CVE-2026-0257 is particularly insidious because the malicious activity can mimic legitimate remote work, making it difficult to detect until significant damage has occurred. This tactic underscores Qilin’s strategic approach to gaining access to high-value targets, such as transportation and healthcare systems, by leveraging known but unaddressed weaknesses in network security.
Specifics of the Keio Railway Breach and Data Verification
The ransomware attack on Keio Railway subsidiaries occurred in the early hours of September 26, 2026. The intrusion disrupted operations across parts of the railway group, specifically rendering reservation services at certain hotels and specific email systems unavailable. While the initial disruption affected business continuity, the threat escalated when Qilin claimed responsibility for the incident, a statement that was confirmed on the morning of October 16, 2026.
Qilin’s claim included the publication of 27 images purportedly showing internal company documents. Accompanying these images was a countdown timer, which cybersecurity analysts believe indicates a deadline for the group to release the stolen information publicly if demands are not met. This tactic of publishing partial data alongside a countdown serves as a pressure mechanism to force victims into compliance with ransom demands.
In response, Keio Railway acknowledged that the hacking group had claimed to have released some information belonging to its subsidiaries. However, the railway operator stated that it had not yet established whether the material published by the hackers was genuine internal information. The company is currently continuing to investigate the circumstances surrounding the attack and is working to verify the authenticity of the information allegedly disclosed by Qilin, highlighting the ongoing challenge victims face in distinguishing between genuine stolen data and fabricated evidence used to extort funds.
Sources
- Qilin Threatens to Release Data Stolen in Keio Railway Cyberattack
- Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
- 21 months, $100 million, one Qilin suspect in custody
Photo: M.S. Meeuwesen / Unsplash (Unsplash License)
