KELA's July 2023 observation is the load-bearing detail. Haise, the RAMP profile that advertises Qilin, told the forum that ransom payments go into affiliate wallets first, and only then is a share transferred to the Qilin RaaS owners [9]. That places the core team downstream of its own affiliate for collection. In a market where the operator normally controls the wallet, that is a concession, and concessions of that kind get made to attract and keep the people who do the intrusions.
The economics behind the concession are documented. Group-IB reported affiliates can take up to 80 percent when the paid ransom is 3 million USD or less, rising to 85 percent above that [8]. KELA logged Qilin demands in the 25,000 to 600,000 USD range in mid-2023 and identified one Thai real estate development company that paid 600,000 USD after 20 days of negotiation [16]. At the 80 percent tier, that single payment leaves 480,000 USD with the affiliate and 120,000 USD with the core team [1]. A RAMP account, the gate to the advertisement, costs up to 500 USD in BTC [6], roughly a thousandth of the affiliate's take on that one deal [2]. At the 3 million USD boundary, the five-point step to 85 percent is worth 150,000 USD [3].
The recruitment timeline runs behind the operational one. Haise joined RAMP on 29 May 2022 and advertised Qilin on 13 February 2023, a gap of 260 days [7][4]. The first victim appeared on the Tor leak site in October 2022, with reports of the same code deployed under the name Agenda as early as June 2022 [10]. The crew was encrypting and leaking about four months before it posted the public advertisement [5].
Counting is where the public record is weakest. From Q2 2023, victim listings ran at around five per month and rose noticeably from the start of 2024 [11], but only victims who do not pay get leaked, and BushidoToken notes that establishing true attack volume is difficult [12]. Leak-site tallies are a floor on attacks and a proxy for refusal rates, not a measure of activity. The only stated targeting rule is exclusion: the operators wrote on RAMP that they do not work in CIS countries [15]. Everything else in the victim set reflects affiliate opportunity, spread across Argentina, Australia, Brazil, Canada, France, Germany, Japan, the UK, the US and others, with large companies targeted indiscriminately [13].
For detection engineering, the honest read is that this record does not carry the weight. Qilin is used for domain-wide encryption of servers and workstations with bulk data theft ahead of it [4], which describes the outcome rather than the technique. Naming conventions exist across vendors, Water Galura at Trend Micro and GOLD FEATHER at Secureworks [5], but only a handful of public resources cover affiliate TTPs, with Trend Micro the primary contributor [17]. A tabletop built on this material can exercise the negotiation clock, the double-extortion sequence and the leak-site publication step [3], because those are documented. Host-level detection content still has to come from somewhere else.
