Dedicated dashboard for the Qilin ransomware-as-a-service operation — victims, leak-site posts and activity timeline
Qilin (also tracked as Agenda) is a ransomware-as-a-service operation that has become
one of the most prolific leak-site posters. soc-qilin is a single-actor tracker: every victim
the group publishes, when it appeared, and how the tempo of their operation changes week to week.
Part of a self-hosted SOC fleet: a small, dependency-light Python service with a web dashboard, a JSON API and a built-in manual. No agents, no cloud, no telemetry.
- Victim / leak-post feed for the group, newest first
- Search and filter victims by name, country or sector
- Activity timeline — posting tempo over time, so a surge is obvious
- Backed by the same public leak-site data as soc-ransomware, focused on one crew
cp .env.example .env
env $(cat .env | grep -v '^#' | xargs) python3 app.py
# → http://localhost:8098
Python 3.8+. Standard library only — nothing to pip install.
| Variable | Purpose |
|---|---|
OTX_API_KEY |
AlienVault OTX key — enables indicator enrichment (optional) |
PORT |
Listen port (default 8098) |
| Path | Purpose |
|---|---|
/ |
Dashboard (HTML) |
/api/data |
Qilin victims and activity (JSON) |
/manual |
Built-in user manual |
Drill-down for the Qilin rows in soc-ransomware; soc-shinyhunters is the equivalent tracker for that actor.
MANUAL.md — full user guide (also served at /manual, via the ? button in the UI).
Qilin ransomware · Agenda ransomware · RaaS · ransomware tracker · leak site · threat actor · CTI · dark web monitoring · threat intelligence · self-hosted
MIT — see LICENSE.