Qilin is one of the most well-known and old ransomware groups that have been operating under the same name for more than two years. What makes you different from other ransomware groups that have closed their operations or were seized by law enforcement?

We are free and actively fight; our size is growing. This is our main difference and advantage.

How do you choose your targets? Are there any red lines when searching for potential victims? (Country, religion, sector, moral/ethical code, etc.)

All hacking targets we choose are related to the governments of the countries in which they are located. We do this intentionally to draw politicians' attention to specific problems. There are no red lines for us. If we know that the leadership of a particular commercial structure is related to the government of any country and can influence decision-making that contradicts international agreements, we begin to attack this structure. Our purpose is to force the governments of countries to fulfill their obligations and keep the promises they made to their people.

Earlier this month, news broke of a major ransomware attack on Synnovis Company, causing widespread chaos in multiple UK hospitals that were forced to cancel operations and appointments for patients. Doesn't it concern you to target hospitals and other critical sectors, impacting people's lives—literally endangering lives?

Can you imagine the level of danger that threatens our people today? Our people are dying without the medicines, arms, techniques, and donor blood promised by your governments. All lives are valuable, but your government seems to believe that British lives are more valuable than others. We believe this is unfair.

Did you change anything or become more cautious after the NCA seized Lockbit and AlphV's operations?

We haven't changed anything in our work; we are always extremely careful and continue our work in the same rhythm as before. Moreover, I can say that we are stronger than ever and the number of successful attacks will grow.

You posted only 11–12 victims until May 2023. However, since then, you have significantly increased the pace and posted over 100 victims in the last year. What accounts for this change?

Every month, we increase our turnover and influence. We have more and more associates who support us in our struggle. More than 100 reports of victims are just the beginning.

Why did you start your ransomware operation? Why not work in a regular job in the cybersecurity field? Do you do this only for the money, or do you have other motives?

Many of us work in cybersecurity. Our main motive is justice and bringing to justice the leaders of those countries that do not keep their word. Money is not the main thing for us; we do not buy expensive yachts and villas. Extortion is the best way to put pressure on those we've already talked about. This is an effective tool for fighting. Many politicians around the world believe that their money is more important than the lives of our people.

In the Conti Leaks chats, we discovered they had a massive operation with different departments. Do you work with a similar model?

We prefer not to answer such questions.

How long do you stay inside the victim's network before publishing the ransom note?

It depends on the situation. We have had cases where we were inside the network of the victim's organization, following all the correspondence and discussions for several months. We can stay inside for as long as we need to achieve our goals.

How do you establish trust with your team members and affiliates? Have you conducted any tests or implemented specific measures to build and maintain trust?

We won't answer this question because it is a question of safety for our comrades.

On the other hand, how can affiliates trust you? We all saw what happened with ALPHV when one of their affiliates accused them of stealing $20 million from their share.

As we said earlier, money is not the main thing for us. Our supporters can specify their wallets for getting money; it's our main difference from other teams.

Has breaching one of the victims ever inadvertently caused harm to someone close to you?

There has been no such thing. On the contrary, all the actions of the deceitful governments deliberately harm our relatives, friends, and fellow citizens. We try to help them just survive in an unequal struggle.

Have you ever attempted to breach a specific organization but failed?

We always achieve our goals.

What is the most common vector you use to breach organizations?

We will not answer this question for security reasons.

How much time and money do you dedicate to developing and maintaining your operation?

We spend all our time fighting injustice. All the money we earn is spent on our struggle. We also help our heroic defenders, who are now fighting an unequal battle.

Out of all your victims, can you share the percentage that have paid the ransom versus those who have not?

We don't answer this question.

Do any of you have families? How do you explain your work to them, and are they aware of what you do?

Our team is our family. In our country, we do everything to win and support each other.

Do you have any strategy for the next 3–5 years?

We have a strategy only for the next week: to earn 200 million and continue our work. The issue of survival is important for us now. We do not know what will happen in 3–5 years, but we want to make sure that our country prospers, so we have a peaceful sky over our heads and our people live in peace.

Any recommendations for companies on how to defend themselves against ransomware attacks?

The recommendations are very simple. It is necessary not to lie, not to break one's word, not to cooperate with deceitful politicians. The surest way to avoid attacks is to pay in advance and help in our struggle.

Do you consider yourself to be similar to any well-known figures in terms of revealing the truth or fighting against governments?

I think you know examples of heroic people who, at the cost of freedom and life, revealed the truth to people. Of course, we can talk about Julian Assange. This man opened the eyes of many to the dirty policies pursued by governments and paid for it. We consider ourselves to be the successors of his work, with only one difference: we do not believe that only the publication of information can change anything. We prefer a real struggle.

Would you use services from a company that you breached in the past?

We use everything we can take from these companies — all documents and money we get will be used to help our country. In general, we cynically 'use' these companies.

Any last message to the CyberSecurityIL community?

Join our fight if you stand for justice, support universal values, and understand how real democracy differs from the madness that many now call this word.