Qilin Publishes iFink as Latest Victim of Sophisticated Phishing Attack

| 2026-10-30 13:35 HIGH LOW RANSOMWARE & EXTORTION

JSON

Executive Summary

Highlight CTI
AI-generated

On October 30, 2026, the ransomware operator Qilin published a new victim, iFink, and subsequently exfiltrated data from it. The cyber operation type was identified as both Exfiltration and Ransomware. A malware payload of the same name, Qilin, was used in this attack. DNS records were found for the victim's domain, indicating that the entity affected is a DNS organization. This incident highlights an ongoing ransomware campaign where data exfiltration and ransom demands are being carried out by using the Qilin malware against iFink's DNS infrastructure.

Technical Mitigations AI-generated

• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

Qilin

Target & Sectors

Global Scope

Incident Timeline

‎2026/10/30

Threat actors, likely Qilin, published a new victim's DNS records publicly.

Click on any entity below to view its context and source!

organisation DNS

The following DNS records were found for the victim's domain.

Ransomware Live

Intelligence Sources

Ransomware Live 2026-10-30

🏴‍☠️ Qilin has just published a new victim : iFink Ransomware Live

Highly Correlated Entities

tactic Cyber Operation Type

‎Exfiltration tactic

Unknown Source

Contextual Telemetry

Context Block 2 METRICS

malware Malware Payload

‎Qilin tool

organisation Identified Entity

‎DNS entity

Click on any entity below to view its context in the main text!