# Qilin Ransomware Group Claims Cyberattack on ATF (DOJ) — Standalone Investigation-Target System Breached, Attribution Unconfirmed

> The Qilin ransomware group added the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), a Department of Justice law enforcement agency, to its Tor leak site, claiming a cyberattack on a standalone system holding information on ATF investigation targets. ATF confirmed the breach, isolated the machine, and designated it a DOJ major incident; the agency's case management, laboratory, and eForms systems were not affected, no ransom is expected to be paid, and independent confirmation of Qilin's involvement is still pending.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2192
- **ID:** TL-2026-2192
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On or shortly before August 26, 2026, the Qilin (aka Agenda) ransomware-as-a-service operation listed the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) on its dark-web extortion blog, claiming to have compromised agency data and threatening to publish it absent contact from a company representative. ATF confirmed a cyberattack against a single standalone computer system that held information about targets of ongoing ATF investigations. Per ATF Public Affairs Chief Tanya Roman, the system 'was not connected to any other ATF systems ... and it was quickly shut down when the breach was discovered,' and the incident 'has not impacted ATF's ability to perform its missions.' Senior DOJ officials designated the event a 'major incident' under federal breach-reporting guidance, triggering required incident-response, forensic, and notification processes; ATF states required notifications have been completed. Neither ATF nor Qilin has published sample data, IOCs, or a confirmed initial-access vector for this specific intrusion, and ATF has declined to disclose when the breach occurred or was discovered. Because the target is a federal law-enforcement agency, a ransom payment is considered unlikely, and attribution to Qilin — while consistent with the group's leak-site listing — remains formally unconfirmed pending DOJ's investigation.

Qilin is a Russian-speaking, financially motivated ransomware-as-a-service operation first identified by Trend Micro in August 2022, operating the 'Agenda' ransomware family (originally Go, rewritten in Rust by December 2022) against Windows, Linux, and VMware ESXi targets under a double-extortion model. Group-IB's March 2023 infiltration of the group's affiliate panel found affiliates retain roughly 80-85% of each ransom payment, a structure that has helped the group become one of the most prolific RaaS operations globally — the second most active ransomware brand by reported victim count in July 2026 (127 claimed attacks) — with confirmed intrusions across healthcare (Synnovis/NHS London hospitals, June 2024), manufacturing/beverage (Asahi Breweries, October 2025), education (Académie d'Amiens, 2025), and government/critical-infrastructure targets in 60+ countries. Documented Qilin intrusions typically begin with phishing, brute-forced or credential-stuffed VPN/External Remote Services access (frequently against MFA-less endpoints), or exploitation of internet-facing infrastructure such as CVE-2023-27532 in Veeam Backup & Replication to recover stored backup-infrastructure credentials; affiliates then use Mimikatz-based LSASS credential dumping, Group Policy modification to enable RDP, and legitimate remote-access/RMM tooling (AnyDesk, ScreenConnect, ConnectWise, ngrok, ligolo) alongside Cobalt Strike and SystemBC for command and control, PsExec and SMB admin shares for lateral movement, WinRAR/Cyberduck for staging and cloud exfiltration (observed targeting Backblaze), and vssadmin/backup-job destruction plus multipass AES-256/ChaCha20+RSA-4096 encryption for impact, appending a per-victim company-ID file extension and dropping a 'README-RECOVER-<id>.txt' ransom note. No such technical indicators have been published for the ATF intrusion itself; the TTP detail above reflects the actor's documented playbook from prior, independently investigated Qilin cases and is included as investigative and hunting context, not as confirmed forensic findings for this incident.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Phishing: Spearphishing Link
- T1133 External Remote Services
- T1078.002 Valid Accounts: Domain Accounts
- T1003.001 OS Credential Dumping: LSASS Memory
- T1087.002 Account Discovery: Domain Account
- T1018 Remote System Discovery
- T1685.005 Clear Windows Event Logs
- T1685 Disable or Modify Tools
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1560.001 Archive Collected Data: Archive via Utility
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [ATF cyberattack: Qilin ransomware group claims responsibility](https://cyberscoop.com/atf-doj-cyberattack-qilin-ransomware/)
- [DOJ firearms agency says hackers breached system containing investigation targets](https://therecord.media/doj-atf-cyberattack-qilin-ransomware)
- [US firearms agency ATF confirms cyberattack – Qilin ransomware gang claims it](https://cybernews.com/news/qilin-ransomware-bureau-alcohol-tobacco-firearms-atf-cyberattack/)
- [ATF Hit By Ransomware Attack, DOJ Says](https://dailycaller.com/2026/08/26/atf-hit-by-ransomware-attack/)
- [Qilin Ransomware Targets U.S. Government Agency ATF](https://www.dexpose.io/qilin-ransomware-targets-u-s-government-agency-atf/)
- [ATF Confirms Cyberattack Claimed by Qilin Ransomware Gang](https://hoodline.com/2026/08/russian-hackers-claim-atf-breach-agency-says-investigation-files-were-hit/)
- [Qilin (cybercrime group)](https://en.wikipedia.org/wiki/Qilin_(cybercrime_group))
- [Qilin, Software S1242 — MITRE ATT&CK](https://attack.mitre.org/software/S1242/)
- [Qilin Ransomware Analysis: Critical TTPs and Defense](https://www.picussecurity.com/resource/blog/qilin-ransomware)
- [Qilin Threat Actor Profile: TTPs, IOCs & Attacks](https://www.huntress.com/threat-library/threat-actors/qilin)
- [Uncovering Qilin attack methods exposed through multiple cases](https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/)
- [HC3 releases threat profile on Qilin ransomware targeting global healthcare, other critical sectors](https://industrialcyber.co/medical/hc3-releases-threat-profile-on-qilin-ransomware-targeting-global-healthcare-other-critical-sectors/)
- [Qilin (aka Agenda) Ransomware Threat Profile — HHS HC3](https://www.hhs.gov/sites/default/files/qilin-threat-profile-tlpclear.pdf)
- [CVE-2023-27532 — NVD](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-27532)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2192