# Axionlog breached by Qilin ransomware operator

Published: 2026-06-29 · Severity: high
Canonical: https://vorant.io/reports/e3c82984-a113-5bd8-aad4-ccafc4e1ee87/axionlog-breached-by-qilin-ransomware-operator

> Qilin ransomware operator claims breach of Axionlog with 290 compromised users and 14 employees.

Ransomware.live, a threat tracking platform, reports that Qilin ransomware operator has claimed a breach of Axionlog. The reported compromise involves 14 compromised employees, 290 compromised users, and 37 third-party employee credentials. The attacker also catalogued 49 external attack surface hosts and extracted DNS records associated with the victim's domain. The breach demonstrates the typical initial access chain where infostealer infections on employee endpoints lead to credential compromise and subsequent ransomware deployment. This reporting reflects Qilin's continued targeting and follows the group's established pattern of data exfiltration prior to encryption and ransom demands.

## Mentioned in this report

- Threat actors: qilin
- Malware: Qilin

Source reporting: https://www.ransomware.live/id/QXhpb25sb2dAcWlsaW4=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e3c82984-a113-5bd8-aad4-ccafc4e1ee87/axionlog-breached-by-qilin-ransomware-operator.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup