Double extortion

Qilin hands affiliates the ransom wallet before the core team takes its cut

Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.