Qilin — the world's most prolific ransomware group with 700+ attacks in 2025 — has allegedly targeted Shwapno, one of Bangladesh's largest retail chains. Here's what happened, how Qilin operates, and what every Bangladeshi organization must do right now.
R&D Team
After tracking ransomware groups for years, we've watched Qilin transform from an obscure threat actor into the world's most prolific ransomware operation — claiming over 700 attacks in 2025 alone. Now, an unverified claim suggests they've set their sights on Shwapno, one of Bangladesh's most recognized retail brands. Whether this specific claim is confirmed or not, the message to every organization in Bangladesh is unmistakable: the threat is real, it's here, and the window to prepare is closing.
Here's what we know about Qilin, what the alleged Shwapno targeting means for Bangladesh's digital economy, and — most importantly — the concrete steps your organization can take right now to avoid becoming the next headline.
What you'll learn in this article:
Qilin didn't become the world's most dangerous ransomware group overnight. Understanding their rise is essential to understanding the threat they pose to organizations like Shwapno.
First detected in August 2022 under the name "Agenda," the group rebranded as Qilin — named after a creature from Chinese mythology — just weeks later. Despite the name, security researchers at KELA Cyber, Cisco Talos, and Group-IB have traced the group's origins to Russia and Eastern Europe, based on Russian-language artifacts, Cyrillic encoding in their scripts, and C2 panels configured in Russian.
The evolution was rapid and deliberate:
"Qilin is part of a new generation of ransomware groups that operate more like tech businesses than hackers. Their affiliates rent the tools, share the profits, and constantly test new ways to break into networks." — Ted Cowell, Head of Cybersecurity UK, S-RM (Infosecurity Magazine, November 2025)
Qilin operates as a fully managed Ransomware-as-a-Service (RaaS) platform. Think of it as a franchise model for cybercrime:
The result? A scalable, professional criminal operation that claimed 50 retail sector victims in 2025 alone — making retail the 4th most targeted industry globally.
A social media post circulating in cybersecurity communities alleged that Qilin targeted Shwapno — ACI Limited's flagship retail chain and one of Bangladesh's largest supermarket brands. The claim was picked up by cybersecurity monitoring services and fact-checked by Undercode News.
The current status of the claim:
| Attribute | Status |
|---|---|
| Independent verification | ❌ Not confirmed |
| Data samples published | ❌ None |
| Official response from Shwapno | ❌ None issued |
| Qilin dark web leak site listing | ❌ Not observed |
| Government/agency confirmation | ❌ None |
As of this writing, the attack claim has not been independently verified. No data samples, technical indicators, or official acknowledgment from Shwapno or Bangladeshi authorities have surfaced.
Here's what we've learned from tracking ransomware groups: unverified claims are often early-stage intimidation tactics. Qilin's standard playbook involves stealing data first, then threatening to publish it — using the threat of exposure as leverage before or instead of encryption. An early claim without proof can be a negotiation tactic.
More importantly, whether this specific incident is confirmed or not, the targeting of a major Bangladeshi retailer by a group of Qilin's caliber signals something significant: South Asian retail is now on the radar of the world's most sophisticated ransomware operators.
In Qilin's typical pattern, if an attack is real, evidence surfaces on their dark web leak site within days to weeks. The absence of such evidence is notable — but the threat calculus for every Bangladeshi organization remains unchanged.
Shwapno (শপনো, meaning "Dream" in Bengali) is a subsidiary of ACI Limited, one of Bangladesh's largest conglomerates. Founded in 2008, Shwapno operates dozens of supermarket outlets across major cities, runs an e-commerce platform, and has a mobile app for online grocery ordering.
From a threat actor's perspective, Shwapno represents a triple-threat data asset:
Add to this the operational criticality factor: a ransomware attack that encrypts Shwapno's systems during peak shopping hours doesn't just cost money — it shuts down stores, disrupts supply chains, and creates immediate public pressure to pay.
Bangladesh's digital transformation has been remarkable. Mobile payment adoption through bKash and Nagad has brought millions into the formal financial system. E-commerce is growing rapidly. Organized retail chains like Shwapno are expanding their digital footprints.
But rapid digitalization without proportional investment in cybersecurity creates exactly the conditions ransomware groups exploit:
Bangladesh has experienced high-profile cyberattacks before. The 2016 Bangladesh Bank SWIFT heist — in which attackers stole $81 million — demonstrated that sophisticated threat actors view the country as a viable target. Qilin's alleged interest in Shwapno suggests that calculus hasn't changed.
Understanding Qilin's attack methodology isn't just academic — it's the foundation of effective defense. Based on detailed technical analysis from Cisco Talos, KELA Cyber, and ThreatLocker, here's how a Qilin attack typically unfolds:
Qilin's most common entry points are:
Once inside, Qilin affiliates move methodically. They use standard Windows tools — nltest.exe, net.exe, whoami /priv — to map the network and understand what they've accessed. Then comes credential harvesting:
The results are consolidated and exfiltrated before any encryption begins.
With valid credentials, attackers move laterally across the network using PsExec (renamed to random strings to evade detection), Cobalt Strike beacons, and RDP connections. They target domain controllers to gain the highest level of access. This phase can last up to 18 days — Qilin's documented dwell time in victim environments — during which they map every valuable system.
Before encrypting anything, Qilin steals the data. Tools like Cyberduck, WinSCP, and FreeFileSync move gigabytes — sometimes terabytes — of sensitive data to attacker-controlled infrastructure. This is the "double extortion" foundation: even if you restore from backups, they still have your data and can threaten to publish it.
The final phase is swift and devastating. Qilin's Qilin.B payload uses AES-256-CTR encryption with RSA-4096 key protection — mathematically unbreakable without the decryption key. Before encrypting, they delete Windows event logs to hamper forensic investigation. The ransom note directs victims to a dark web negotiation portal.
The average dwell time before encryption gives defenders a window — but only if they're monitoring for the right signals.
The good news: Qilin's attack patterns are well-documented, and their preferred entry points are patchable. Here's a prioritized defense framework based on what we know about their TTPs.
These are the vulnerabilities Qilin exploits most frequently. Address them first:
Qilin's credential theft capabilities are extensive. Counter them directly:
Qilin spends up to 18 days in victim environments before encrypting. That's your detection window:
nltest.exe, net.exe, whoami /priv, and tasklist in quick succession indicate active reconnaissanceQilin specifically targets and destroys online backups to maximize ransom pressure:
Technology alone doesn't stop ransomware. The human layer matters:
For retailers like Shwapno — and any organization with POS systems, e-commerce platforms, and mobile payment integrations — additional controls apply:
| Area | Action |
|---|---|
| POS Systems | Isolate on a dedicated VLAN; apply all patches; disable unnecessary services |
| E-commerce Platform | Deploy a Web Application Firewall (WAF); conduct regular penetration testing |
| Mobile Payments | API security testing; secure credential storage; tokenize payment data |
| Customer Data | Data minimization; encryption at rest; strict access controls |
| Supply Chain | Vendor security assessments; limit third-party network access |
The alleged Qilin-Shwapno incident — confirmed or not — represents something larger than a single attack claim. It's a signal that Bangladesh's growing digital economy has reached a scale that attracts sophisticated global threat actors.
Qilin claimed 50 retail sector victims in 2025. Their geographic expansion is deliberate — as Western organizations harden their defenses, ransomware groups increasingly target emerging markets where the combination of valuable data and less mature security creates favorable conditions.
The 2016 Bangladesh Bank SWIFT heist was a wake-up call for the financial sector. The alleged Shwapno targeting should be a wake-up call for every organization in Bangladesh's rapidly digitizing economy: the threat is no longer theoretical, and the cost of unpreparedness is measured in millions.
The key insight from Qilin's attack methodology: their most common entry points are known, patchable, and preventable. Unpatched VPN appliances, weak credential hygiene, and absent MFA account for the majority of successful Qilin intrusions. These aren't exotic zero-days — they're basic security hygiene failures that organizations can address this week.
Qilin's Qilin.B encryption is mathematically unbreakable. Once your files are encrypted, your options are: pay the ransom, restore from backups, or lose the data. The only winning move is to prevent the encryption from happening in the first place.
Your next step: Conduct a rapid security assessment against Qilin's known entry points. Start with three questions: (1) Are all our VPN appliances patched against CVE-2024-21762 and CVE-2024-55591? (2) Do we have MFA enabled on all remote access? (3) Do we have offline, immutable backups we've tested restoring from? If the answer to any of these is "no" or "I'm not sure," that's where to focus first.
Concerned about your organization's exposure to ransomware threats like Qilin? Contact our cybersecurity team to discuss a threat assessment tailored to your environment. We work with organizations across Bangladesh and the region to identify gaps before attackers do — and build defenses that hold up against the tactics groups like Qilin actually use.
Is your organization reviewing its ransomware defenses in light of threats like Qilin? We'd like to hear what obstacles you're navigating — reach out to us directly at contact@atomictechnium.com.
The expert research & development team at Atomic Technium, delivering enterprise-grade cloud, security, and data solutions with atomic level precision.
Continue exploring related topics and insights from our blog.
