As of June 28, 2026, my central forecast is that Qilin will claim about 109 victims in July 2026 in the Breachsense July 2026 report. I am centering the distribution near Qilin staying the top-volume ransomware actor, with a mode around the high-100s rather than a collapse or a blowout month. (breachsense.com)

The core base rate is very strong. Breachsense reported Qilin at 107 victims in January 2026, 104 in February, 131 in March, 103 in April, and 101 in May. That is a five-month average of 109.2 victims, and four of those five months sit in a very tight 101 to 107 range, with March as the one clear spike. Breachsense also shows Qilin at 546 victims out of 3,583 total ransomware victims through May, a 15.2 percent share. A separate dataset from Check Point paints a very similar picture: Qilin posted 338 victims out of 2,122 Q1 2026 victims, a 15.9 percent share. NCC Group likewise had Qilin at 17 percent of January activity, 14 percent of April, and 15 percent of May. Across sources, the main story is persistence around roughly 15 to 16 percent of a still-elevated ransomware market. (breachsense.com)

I am a bit above the April to May level because July has 31 days, and a daily-rate conversion of the non-March Breachsense months implies about 107.4 July victims, while using all January to May daily rates implies about 112.1. June also gives supportive real-time evidence that Qilin has not faded: Breachsense live breach listings still showed new Qilin-tagged victims on June 23 to June 25, ZeroFox reported 15 Qilin claims in a 72-hour burst during June 2 to June 5 and assessed that the group was likely to continue or exceed its current tempo, and Ransomnews still listed June 25, 2026 as Qilin’s most recent victim date with 644 victims tracked in 2026 to date. I treat those as evidence for a modest upward tilt, not for a huge jump, because these trackers use different methodologies and short bursts often revert. (breachsense.com)

I do not forecast a much larger spike because there are real counterweights. Breachsense noted in April that Qilin’s lead narrowed, and in May The Gentlemen remained a strong second at 70 victims while Qilin stayed at 101. Check Point’s Q1 report describes The Gentlemen as a breakout group founded by a former Qilin affiliate and backed by a large pre-exploited FortiGate stockpile, which is a plausible reason to expect some affiliate and victim-share leakage away from Qilin. Also, Check Point’s June advisory on CVE-2026-50751 said observed exploitation had been limited to only a few dozen targeted organizations globally, with one case associated with a Qilin affiliate. That sounds like a real upside factor, but a bounded one, not the sort of mass-exploitation event that would justify a forecast near the far right tail. (breachsense.com)

Methodologically, I modeled July as a three-regime mixture: 60 percent stable regime centered on 107 victims, 28 percent elevated regime centered on 124 victims, and 12 percent downside regime centered on 85 victims, with each regime implemented as an overdispersed negative binomial. The stable regime reflects five straight 100-plus months and a repeatable posting cadence; the elevated regime reflects June’s continuing activity and the chance that recently exploited access converts into July leak-site posts; the downside regime reflects competition, patching, and normal volatility. I also kept the spread wider than a simple Poisson because affiliate-driven leak-site posting is noisier than pure random arrival counts. Finally, I am interpreting the target the way Breachsense reports it: the tracker is updated daily from leak sites, these are publicly claimed victims rather than confirmed breaches, and when multiple groups claim the same victim Breachsense counts it once in the overall total but still lists it under each claiming group in the per-group breakdown. (breachsense.com)

I am forecasting the July 2026 Breachsense group count, not the real-world number of successful Qilin intrusions. HHS describes Qilin/Agenda as a Russia-linked ransomware-as-a-service operation active since 2022. Breachsense says its tracker indexes victim posts from leak sites daily, counts claimed victims rather than confirmed breaches, and uses Date Discovered as the date the victim appeared on the leak site; the underlying intrusion usually happened weeks or months earlier. Breachsense also notes that monthly totals are deduped across groups while the per-group breakdown still lists victims under each claiming group, so Qilin’s own monthly series is the right base rate for this question. (hhs.gov)

The strongest anchor is Breachsense’s own Jan-May 2026 series for Qilin: 107, 104, 131, 103, and 101 victims, for 546 total and a 109.2 monthly average. May was the lowest overall ransomware month of 2026 in Breachsense’s data, yet Qilin still held the top spot and slipped only two victims from April, which argues for a fairly sticky operating level around the low 100s rather than a sharp collapse. Breachsense’s annual 2025 report also shows Qilin at 958 victims for all of 2025, so 2026 is running materially hotter than last year’s baseline. (breachsense.com)

Independent trackers tell a very similar story. Check Point measured 338 Qilin victims in Q1 2026, or about 112.7 per month, and in its May 2026 monthly post said Qilin accounted for 14% of 698 published ransomware attacks, implying about 97.7 Qilin victims that month. ZeroFox said Qilin was responsible for at least 557 incidents from January through May 2026, or 111.4 per month, and assessed that the group would very likely continue or exceed its current operational tempo. Different vendors count somewhat differently, but all three sources center Qilin roughly around 100-113 monthly claims. (research.checkpoint.com)

For forward adjustment, I see both downside and upside. Downside: TheGentlemen has become a durable number-two/number-three competitor and affiliate churn always creates some risk that Qilin has a softer posting month. Upside: Check Point said exploitation of CVE-2026-50751 rose in early June and assessed with medium confidence that the actor was using Qilin ransomware, with a few dozen organizations targeted globally; ZeroFox separately saw Qilin add 15 victims in just 72 hours from June 2-5. Because Breachsense’s posting dates lag the original intrusions, some of June’s access pipeline should spill into July leak-site claims, though probably not all of it yet. (breachsense.com)

Quantitatively, my three main anchors are: (1) Breachsense Jan-May mean = 109.2; (2) simple exponential smoothing on the Breachsense Jan-May sequence, which gives roughly 106.8 for the next month; and (3) an external cross-check average of the Check Point Q1 monthly average, the Check Point May implied count, and the ZeroFox Jan-May average = about 107.3. Those anchors cluster tightly around 107-108; after a small haircut for competition/reporting noise and a small positive offset for the June exploitation pipeline, I land on a central estimate of 107 Qilin victims claimed in July 2026. I therefore center the distribution near 107, put most mass in the 90-125 range, keep a noticeable right tail for another surge month, and leave only tiny probability above 169. (breachsense.com)

Because this question resolves to the July 2026 Breachsense report, I anchor on Breachsense’s own counting rules and monthly history. Breachsense says these reports measure publicly claimed victims from ransomware leak sites, not confirmed breaches, and that when multiple groups claim the same victim it counts the victim once. In Breachsense’s 2026 monthly reports, Qilin posted 107 victims in January, 104 in February, 131 in March, 103 in April, and 101 in May. (breachsense.com)

Those five months have a simple mean of 109.2. But March looks like the high outlier, so I also compute lower-stress baselines: January+February+April+May average 103.8, and April+May average 102.0. Converted to daily rates and scaled to July’s 31 days, those baselines imply about 107.2 victims using January/February/April/May data and 103.7 using April/May alone; the full January-May daily rate implies 112.1. That puts a reasonable no-drama July range in the low 100s to low 110s, with the center a little above May because July has 31 days. (breachsense.com)

Independent June-era tracking says Qilin stayed hot rather than fading. ZeroFox reported 15 new Qilin claims across nine countries in 72 hours from June 2 to June 5, said Qilin was likely to finish Q2 2026 as the most active ransomware collective, and assessed that it was likely to continue or exceed its then-current tempo. Around mid-June, RansomLook showed Qilin with 26 posts in a 7-day window, up 73.3% from the prior week, and Ransomnews still showed June 25 as Qilin’s most recent listing while tracking 644 Qilin victims in 2026. Those sources are not interchangeable with Breachsense for resolution, but they are good evidence that June activity remained elevated. (zerofox.com)

There is a real upside case. Check Point said CVE-2026-50751, a critical Check Point VPN authentication-bypass flaw, was actively exploited beginning May 7 and that exploitation increased in early June; it also linked one confirmed post-compromise case to a Qilin affiliate. NVD/CISA shows the bug was added to the Known Exploited Vulnerabilities catalog on June 8, 2026, with a June 11, 2026 mitigation deadline for U.S. civilian agencies. My inference is that some organizations compromised in late May or June could still be named on leak sites during July after dwell time, exfiltration, and failed negotiations, which slightly fattens the July upside tail. (blog.checkpoint.com)

There are also reasons not to chase a huge number. Check Point described the exploitation as limited to only a few dozen targeted organizations globally, and once the flaw was public and hotfixes were available, that specific access vector should become less productive for fresh July victim generation. GuidePoint/GRIT also argued that Qilin’s high victim volume and open affiliate structure make it a prime candidate for future law-enforcement intelligence collection or disruption, which is not a July base case but does support a downside tail. (blog.checkpoint.com)

Putting that together, I model July as a three-scenario mixture: 20% downside regime at λ=92 (post-patch slowdown or operational disruption), 65% continuation regime at λ=106 (roughly recent Breachsense cadence scaled to 31 days, plus a small June-strength adjustment), and 15% upside regime at λ=132 (spillover from pre-patch compromises or an unusually productive affiliate month). That mixture has a mean of 107.1, so my point forecast is 107 claimed victims for July 2026. Most of my probability mass sits roughly from the high 80s/low 90s into the high 120s, with only a very small tail above 169. (breachsense.com)

This resolves to the number of distinct victims that Breachsense lists for Qilin in its July 2026 ransomware report, expected in early August 2026. Breachsense says its ransomware reports are based on victims publicly claimed on leak sites, and its tracker documentation says the live “Date Discovered” field corresponds to when attackers posted the victim, not when the underlying intrusion happened. That makes the live June 2026 breach page a useful leading indicator for July, but not a perfect one-to-one substitute for the final monthly report. (breachsense.com)

The historical base rate is high. Breachsense’s 2025 annual report says Qilin claimed 958 victims in 2025, or about 79.8 per month. In 2026, Breachsense reported 107 victims in January, 104 in February, 131 in March, 103 in April, and 101 in May, for 546 through May, or 109.2 per month. Breachsense also described May as Qilin’s fifth straight month at #1. Check Point independently reported 338 Qilin victims in Q1 2026, confirming that Qilin has remained one of the dominant leak-site actors across multiple trackers. (breachsense.com)

The most important update is that June appears softer than the January-May run. ZeroFox observed 15 new Qilin claims between June 2 and June 5, 2026, and still assessed that Qilin would very likely finish Q2 2026 as the most active ransomware collective. On Breachsense’s live June 2026 page, Qilin entries are visible on June 8, 9, 11, 12, 16, 17, 19, 22, 23, 24, and 25; a manual count from those visible entries, combined with ZeroFox’s June 2-5 summary, puts Qilin roughly in the mid-60s by June 25-26. That pace annualizes to something closer to the high-70s or low-80s for a 31-day month, which is materially below Qilin’s 100+ monthly pace from January through May. I treat that as a real slowdown signal, though only a moderate-confidence one because late-month clustering and reporting lag can still move the final June total. (zerofox.com)

There is also a credible upside risk for July. Check Point reported that exploitation of CVE-2026-50751 against Check Point Remote Access VPN/Mobile Access began in May and increased in early June, with one case tied to Qilin ransomware activity. If that campaign generated fresh access at scale, some victim postings could spill into July rather than June, because leak-site claims usually lag initial compromise. (research.checkpoint.com)

I therefore used a three-regime mixture rather than a single count model. Regime 1 is a slowdown regime centered at 80 victims (50% weight), reflecting June-like pacing and the 2025 monthly baseline. Regime 2 is a continuation regime centered at 104 victims (35% weight), reflecting the January-May 2026 pattern where Qilin stayed above 100 every month. Regime 3 is a surge regime centered at 122 victims (15% weight), reflecting the chance that exploit-lag or affiliate activity pushes July back toward March-like levels. Each regime is modeled with a negative binomial distribution to allow overdispersion. The weighted mean is 94.7 victims.

My final view is therefore that July 2026 is most likely below the client’s informal 100-ish framing but still well above the 2025 average month: point estimate 95, with most probability mass roughly in the 70-120 range and only a very small tail above 169. The biggest reason I am below the January-May average is the live June evidence; the biggest reason I am not lower is that Qilin’s broader 2026 dominance has been unusually persistent and may get a small lagged boost from the June VPN exploitation signal.

Resolution will come from Breachsense’s July 2026 monthly report. Their reports are based on daily indexing of ransomware leak sites, count publicly claimed victims rather than confirmed breaches, and deduplicate when multiple groups claim the same victim. That makes Breachsense the right primary source, but it also means month-to-month totals can move in batches as leak-site posts appear. (breachsense.com)

The official Breachsense monthly counts for Qilin in 2026 before June were 107 in January, 104 in February, 131 in March, 103 in April, and 101 in May. Qilin also finished 2025 as Breachsense’s most active group with 958 claimed victims for the year. So the pre-June baseline is: (a) a 2025 average of about 79.8 per month, and (b) a much hotter January-May 2026 run averaging 109.2, with March 2026 the local peak at 131. (breachsense.com)

The most important new evidence is the live June 2026 archive page. By manually tallying the Qilin-tagged June entries visible through June 26, I get roughly 58 Qilin posts. The biggest visible bursts are June 11, June 16, and June 22, with smaller clusters on June 25, 24, 23, 19, 17, 15, 12, 9, 8, 5, 3, and 2. That is materially below the Jan-May pace, and if the last four days of June were merely typical, June would likely finish in the high-60s rather than near 100. Because this is an inference from the archive rather than the final monthly report, I treat it as a strong leading indicator, not as settled ground truth. (breachsense.com)

So I do not extrapolate from January-May alone. Instead I use a regime-mixture forecast: 45% weight on a slowdown-persists regime centered near 72 victims, 35% on a partial rebound regime centered near 88, and 20% on a return toward the old January-May regime centered near 108. That mixture has an expected value of 84.8 before truncation. I then encode each regime with a moderately overdispersed negative-binomial distribution to reflect batch posting and affiliate volatility.

Bottom line: the historical base rate says Qilin can sit around 100 for months, but the freshest observable evidence points to a real June slowdown. My forecast therefore centers below the January-May run but not as low as a straight line extrapolation from the June archive. My point estimate is 85 claimed victims in July 2026, with most probability mass in roughly the mid-60s to low-100s and only a small tail back toward 120+.

How many ransomware victims will be claimed by the group “Qilin” during July 2026?

• My most likely prediction for the number of ransomware victims claimed by Qilin in July 2026 is 105.50, with a 50% chance of falling between 92.50 and 119.50.
• Qilin has demonstrated extreme operational consistency in 2026, maintaining a victim count between 101 and 131 for five consecutive months, providing a strong statistical baseline.
• The active exploitation of a Check Point VPN zero-day vulnerability (CVE-2026-50751) starting in May/June 2026 provides a potential upside catalyst for higher victim numbers in July.
• Competitive pressure from ‘The Gentlemen,’ a high-incentive spin-off group founded by a former Qilin affiliate, acts as a primary headwind that may cap Qilin’s monthly growth.
• Historical data shows that while overall ransomware activity is rising, Qilin’s specific share has remained stable at approximately 14-16% of total global attacks.
• Reporting lag and ‘batching’ on leak sites remain the largest sources of monthly numerical variance, necessitating a wider confidence interval despite the stable mean.

Key figures

Historical context

• Rebranding (2022): Qilin originally operated as ‘Agenda’ before rebranding in late 2022 and transitioning to a Rust-based payload to target Windows, Linux, and VMware ESXi environments.
• 2026 Monthly Performance: Qilin has held the #1 spot on the Breachsense tracker for five consecutive months (Jan–May 2026), demonstrating rare stability in the volatile RaaS market.
• Internal Schism (2025): In July 2025, a public dispute over approximately $48,000 in commissions led to the formation of ‘The Gentlemen,’ illustrating the internal fragility of these criminal organizations.
• Historical Peak (March 2026): The group reached a recorded high of 131 victims in March 2026, setting the upper baseline for ‘surge’ performance.
• Revenue Growth: Global ransomware revenue in Q1 2026 was estimated at $529.2 million, a 39% year-over-year increase, indicating a highly professionalized and growing market.

Tailwinds

• Zero-Day Exploitation: The exploitation of CVE-2026-50751 (Check Point VPN) began in early May and showed increased activity in June, likely resulting in July leak site postings.
• High Affiliate Retention: Despite competition, Qilin’s 80-85% commission rate and established infrastructure (Rust/Go) keep it as a top-tier choice for professional cybercriminals.
• Maturing Access Broker Market: The rise of initial access brokers (IABs) allows Qilin to purchase entry into corporate networks, decoupling victim volume from their own malware development cycles.
• Resilient Infrastructure: Historically, the removal of individual RaaS groups or servers has rarely led to a permanent decline in the wider ecosystem’s activity.

Headwinds

• Affiliate Migration: The emergence of ‘The Gentlemen,’ a spin-off group led by a former Qilin administrator offering a 90/10 revenue share, creates significant pressure on Qilin’s talent pool.
• Law Enforcement Pressure: International actions like ‘Operation Destabilise’ and the November 2025 sanctions against Russian hosting providers continue to target the infrastructure that RaaS groups rely on.
• Vulnerability Remediation: CISA’s June 2026 mandate for federal agencies to patch the Check Point VPN flaw (CVE-2026-50751) within 72 hours could limit the window for successful exploitation.
• Market Fragmentation: With 58 to 70 active ransomware groups tracked monthly in 2026, the competition for ‘Initial Access’ from brokers is intense, which can limit the volume of targets available to any single group.

Detailed reasoning

My analysis is primarily anchored in the remarkably consistent performance of Qilin throughout the first half of 2026. Data from the Breachsense Ransomware Tracker for January through May 2026 shows monthly victim counts of 107, 104, 131, 103, and 101. This yields a five-month mean of 109.2 victims. Excluding the March spike (131), the baseline is even more stable, averaging approximately 104 victims per month.

The reasoning for the predicted value of 105.50 reflects a ‘status quo’ expectation, slightly adjusted for recent trends. While May showed a slight dip to 101, mid-June qualitative data (such as 15 victims claimed in a 72-hour window and multiple mid-month leak site entries) suggests no imminent collapse of the group’s operations. The standard deviation used in the forecast (reflecting the 50% and 80% intervals) is wider than the historical sample standard deviation of 12.6. This is intentional to account for ‘leak-site batching’—where a group might dump several weeks of victims onto their portal at once—and the inherent volatility of the Ransomware-as-a-Service (RaaS) model.

I weighted three main scenarios:

1. Steady State (75% weight): Qilin continues to dominate the market with a consistent flow of 100-115 victims. This is the most likely outcome given their five-month streak as the #1 threat actor.
2. Campaign-Driven Surge (15-20% weight): The exploitation of CVE-2026-50751, a critical VPN vulnerability identified in May/June, provides an affiliate boost. Similar to the March peak of 131, a July surge could push numbers toward the 130-140 range.
3. Operational Disruption (5-10% weight): Headwinds such as the spin-off group ‘The Gentlemen’ successfully poaching high-volume affiliates or targeted infrastructure disruptions by law enforcement (similar to ‘Operation Destabilise’ in late 2024) could depress numbers below 80.

The final forecast synthesizes these by centering the most likely value near the 105 mark, recognizing that while upside risks exist (vulnerability exploitation), they are balanced by competitive pressures (affiliate migration). The open upper bound of the question allows for the possibility of a major outlier, but the historical cap of 131 victims suggests that a value exceeding 169.5 is unlikely without a catastrophic systemic failure in a major software vendor.

Key uncertainties

• Breachsense Methodology: The resolution relies on the first published report; if Qilin performs a large data dump at the end of July that isn’t captured until August, the count will be lower.
• Infrastructure Takedown: A major law enforcement operation (similar to those seen in late 2024) could result in an ‘exit scam’ or server seizure, causing an abrupt drop to near-zero.
• CVE Impact Scope: Early reports suggested exploitation of the Check Point flaw was limited to ‘several dozen’ organizations; if the vulnerability is more widespread, a massive surge is possible.
• Affiliate Poaching: If ‘The Gentlemen’ successfully move from being a small spin-off to a dominant force, Qilin’s victim counts could drop significantly faster than current trends suggest.

Conclusion

• My most likely prediction for the number of Qilin victims in July 2026 is 105.50, with a 50% chance of falling between 92.50 and 119.50.
• Decision-makers should prioritize monitoring June 2026 final totals and tracking the success of CVE-2026-50751 patching, as these are the primary indicators of whether July will follow the steady-state baseline or experience a campaign-driven surge.

Question: will Qilin have how many leak-site claimed victims on Breachsense’s first July 2026 report (monthly count)? Anchor on Breachsense’s Jan–May 2026 series—Qilin was #1 each month with counts 107, 104, 131, 103, 101—so forecasters agree the clean, source-aligned base rate is roughly 100–110 claims/month with March as a single high outlier. A numerical negative-binomial model fit to those five points gives a central mean/median around 104 (rounded quantiles p05≈85, p10≈90, p25≈97, p50≈104, p75≈112, p90≈120, p95≈130) and modest overdispersion; reliability is moderate-weak because n=5. June live indicators (ZeroFox, Ransomnews, Check Point/Rapid7 corroboration) show continued posting and no public Qilin-specific takedown, so teams place most mass near the Jan–May band but add a small high tail for batch/campaign posting or exploitation (notably CVE-2026-50751) and a smaller low tail for disruption or affiliate churn. Cross-source counts differ in magnitude (e.g., BlackFog much lower) but generally validate Breachsense’s dominance; forecasters emphasize using Breachsense as the resolution metric and updating heavily when the June Breachsense report is released. Overall, expect ~104 claims as the best estimate, most mass in ~90–125, and a very small (≈1–1.6%) open upper-tail probability above the 169.5 bound.

Forecast and Reasoning

Forecast: Probability distribution:

• 1.00% chance of value below 45.0
• 5.00% chance of value below 75.0
• 10.00% chance of value below 85.0
• 20.00% chance of value below 93.0
• 30.00% chance of value below 99.0
• 40.00% chance of value below 103.0
• 50.00% chance of value below 107.0
• 60.00% chance of value below 112.0
• 70.00% chance of value below 118.0
• 80.00% chance of value below 126.0
• 90.00% chance of value below 138.0
• 95.00% chance of value below 148.0
• 99.00% chance of value below 165.0

Forecast Reasoning

Breachsense’s 2026 monthly counts for Qilin (Jan–May: 107, 104, 131, 103, 101) imply a typical baseline in the low-100s with one demonstrated surge month into the 130s. With July still in the future (as of 2026-06-28), the key uncertainties are (1) whether June/early-July operational tempo and any exploit-driven campaign effects translate into a “surge” month (similar to March), and (2) downside operational shocks (affiliate churn, infrastructure issues, or law-enforcement pressure) that could reduce postings.

I center the forecast near the recent baseline (roughly 103–110) while keeping a meaningful upper tail into the 130–150 range to reflect the observed capability to spike, and a modest lower tail to reflect nonzero disruption risk. Given the historical maximum of 131 on Breachsense so far in 2026, I assign less than 1% probability to exceeding the open upper bound (170+), so p99 remains below the bound.

An amateur forecast would likely anchor tightly on “~100 per month” (or May’s 101) and produce an overconfident narrow range. This forecast instead (a) conditions on the full Jan–May Breachsense series including the March spike, (b) explicitly allows for both surge and disruption scenarios, and (c) avoids forcing artificial probability mass into the open-upper tail when the implied chance of 170+ appears <1%. Confidence in improvement is moderate: the baseline is well-anchored by five months of data, but the probability of another spike month is inherently hard to estimate without the yet-unseen June report.

Forecast rationale (numeric):

— Iteration 1 — The forecasts converge on a roughly 100–110 victim baseline for Qilin in July 2026, with a central estimate clustered around 104–110. The main driver is Qilin’s recent Breachsense track record: 107, 104, 131, 103, and ~101 victims from January through May 2026. This pattern suggests a fairly stable monthly run rate, with the single March spike to 131 treated as evidence that higher-output months are plausible, but not the default.

Shared reasoning patterns

• Recent trend dominates: all forecasts anchor heavily on Qilin’s 2026 monthly counts rather than older history.
• Consistency with occasional spikes: the group appears to operate at a stable high volume, interrupted by one notable surge.
• No sign of major disruption: in the absence of evidence for a takedown or reorganization, the most likely outcome is a continuation of the recent baseline.
• Reporting uncertainty matters: missing June data and tracker noise justify a fairly wide range around the point estimate.

Consensus on uncertainty

• The most likely outcome is a month near the recent average, not a dramatic deviation.
• The downside tail reflects possible law-enforcement disruption, operational slowdown, or rebranding, potentially pushing activity far below normal.
• The upside tail allows for a surge from mass exploitation, affiliate bursts, or backlog/dump effects, with counts meaningfully above 130 still considered plausible.

Overall synthesis

Taken together, the forecasts imply that Qilin is likely to remain one of the most active ransomware groups in July 2026, with the expected victim count centered just above 100, but with substantial month-to-month volatility and nontrivial tail risk in both directions.

— Iteration 2 — Across the forecasts, the dominant reasoning pattern is to anchor July 2026 expectations on Qilin’s recent 2026 monthly Breachsense counts, which have been very stable: roughly 101–107 victims in most months, with one clear March spike to 131. The models treat March as an outlier rather than a new baseline and emphasize the return to a ~100-victim run rate in April and May as the best guide for July.

Areas of consensus

• Central estimate: Most forecasts cluster around ~103–106 victims.
• Recent trend matters most: The most recent months are weighted more heavily than the 2025 average, because Qilin’s 2026 activity appears both higher and steadier than last year.
• Expected range: July is generally expected to land in the mid-to-high 90s through low 110s, with broader uncertainty bands reflecting normal volatility.

Main uncertainty factors

• Month-to-month variation and missing June data: The models note that June is unknown and could shift the July outlook modestly.
• Downside risks: A law-enforcement action, leak-site outage, or other disruption could push counts materially lower, including extreme low-tail outcomes.
• Upside risks: A mass-exploitation campaign, affiliate influx, or backlog of claims could produce another spike near or above March’s level.

Differences in emphasis

• One forecast is slightly more bullish, centering around 106.
• The others center near 103, with somewhat wider or narrower confidence intervals.
• The spread is mostly about how wide the tail risks should be, not about the core expectation.

Overall, the forecasts converge on the view that Qilin is operating at a relatively stable, elevated tempo, making a July total around 100–105 claimed victims the most likely outcome.

— Iteration 3 — The forecasts largely agree that Qilin will claim around 100 victims in July 2026, with central estimates clustering in the low 100s. The shared reasoning is that Qilin’s 2026 activity has been consistently high, with cited monthly counts such as 115 in January, 131 in March, and 101 in May, suggesting a stable baseline near 95–105 victims per month. Some models also note Qilin’s strong market position, which makes a sharp drop unlikely.

A key factor shaping the outlook is recent short-term volatility. One signal showed a recent slowdown in late June (about 66 posts over 30 days), but this was interpreted differently: it could indicate a genuine dip, or simply a delay that gets posted in batches in July, especially given known leak-site instability. That possibility is a major reason some estimates lean slightly above 100 rather than below it.

The main areas of uncertainty are common across the forecasts:

• Downside risks: law enforcement pressure, operational disruption, tracker variance, or a temporary slowdown in posting.
• Upside risks: batched postings after site outages, or an isolated spike similar to past high months.

Overall, the forecasts show strong consensus around a median near 100–105, with wide uncertainty bands to reflect ransomware reporting volatility. The main disagreement is not about the general level, but whether July will reflect a normal month near the baseline or a catch-up spike from deferred claims.

The rationales broadly agree that forecasting Qilin’s July 2026 victim count requires balancing their remarkably stable historical baseline against a highly probable mid-summer surge and significant operational headwinds.

Historical Baseline and the Zero-Day Catalyst Forecasters emphasize Qilin’s consistent track record throughout early 2026, establishing them as a dominant and stable Ransomware-as-a-Service (RaaS) operation that utilizes artificial pacing to maintain a steady publication pipeline. The primary driver for an anticipated spike in July is the group’s aggressive exploitation of a Check Point VPN zero-day vulnerability (CVE-2026-50751) during May and June. Due to the natural lag in the ransomware kill chain—encompassing network dwell time, data exfiltration, and extortion negotiation windows—forecasters reach a strong consensus that unpaying victims from this mass-exploitation campaign will hit Qilin’s Data Leak Site in a concentrated wave in July, potentially causing record-breaking publication batches.

Downward Pressures and Tail Risks Conversely, several systemic risks could suppress Qilin’s output. Forecasters note the traditional “summer lull” in cybercrime activity, though opinions are mixed on whether the zero-day backlog will completely mask this dip. More critical structural headwinds include affiliate attrition to rival groups offering superior revenue splits, and persistent infrastructure instability on Qilin’s Tor-based leak sites. Furthermore, occupying the top spot in the ransomware ecosystem attracts intense law enforcement scrutiny. Recent actions, such as the disruption of Initial Access Brokers and the takedown of the AudiA6 cryptocurrency laundering pipeline, have created significant operational friction. Consequently, the rationales account for the ever-present tail risk of an abrupt law enforcement takedown or a sudden exit scam, which would drastically halt operations.

SUMMARY

Question: How many ransomware victims will be claimed by the group “Qilin” during July 2026? Final Prediction: Probability distribution:

• 10.00% chance of value below 47.0
• 20.00% chance of value below 61.0
• 40.00% chance of value below 81.25
• 60.00% chance of value below 97.75
• 80.00% chance of value below 121.75
• 90.00% chance of value below 140.0

Total Cost: extra_metadata_in_explanation is disabled Time Spent: extra_metadata_in_explanation is disabled LLMs: extra_metadata_in_explanation is disabled Bot Name: extra_metadata_in_explanation is disabled

Report 1 Summary

Forecasts

Forecaster 1: Probability distribution:

• 10.00% chance of value below 49.0
• 20.00% chance of value below 62.0
• 40.00% chance of value below 80.0
• 60.00% chance of value below 95.0
• 80.00% chance of value below 117.0
• 90.00% chance of value below 134.0

Forecaster 2: Probability distribution:

• 10.00% chance of value below 45.0
• 20.00% chance of value below 60.0
• 40.00% chance of value below 82.5
• 60.00% chance of value below 100.5
• 80.00% chance of value below 126.5
• 90.00% chance of value below 146.0

Research Summary

The research finds that Qilin has been the most active ransomware group in early 2026, posting roughly 100 claimed victims per month for five consecutive months through May 2026 (including 101 victims in May). Q1 2026 totals are reported differently by trackers (e.g., ~414 victims in one report, ~338 in ZeroFox data), and Qilin accounted for about 14% of global ransomware incidents in May 2026 (when 698 incidents were reported). Over the past 12 months Qilin is reported to have led with ~1,448 attacks. The group operates as a Ransomware-as-a-Service (affiliate) network with broad geographic reach (active in many European countries), has pursued aggressive affiliate recruitment since early 2025, and has continued to exploit vulnerabilities (including a Check Point VPN zero-day in June 2026). No active prediction markets specific to this question were identified; the Breachsense Ransomware Tracker is the stated resolution source and its July report will determine the official count.

Contextual factors noted by the research that could affect July 2026 counts include upward pressures from continued affiliate recruitment, large geographic footprint, and overall market growth, and downward pressures from competition and fragmentation (notably the emergence of “The Gentlemen” following a 2025 affiliate payment dispute), increased law-enforcement attention, and market saturation. The research therefore anchors forecasts to Qilin’s recent ~100-victims-per-month pattern while flagging those competitive and enforcement uncertainties.

Sources used (as cited in the research): Breachsense Ransomware Tracker; ZeroFox; Bitsight; Check Point research; reporting on “The Gentlemen” (post-split competitor); various cybersecurity news and tracker reports referenced in the research. (No direct URLs were provided in the research materials I summarized.)

RESEARCH

Report 1 Research

I’ll help you research this question about Qilin ransomware group’s predicted victim count for July 2026. Let me conduct a thorough investigation of recent activity, trends, and relevant data.

Frontier Forecast — Post 539

Modal: 85-106 (31.3%) • frontier aggregate • 5m22s

Interpret Summary

• Reading: strict
• Type: strict
• Window: Victims officially claimed by Qilin during July 1–31, 2026, as published in the Breachsense July 2026 Ransomware Report (expected early August 2026)

Resolution sources/checks:

• https://breachsense.com/ransomware-reports: https://breachsense.com/ransomware-reports - Resolver URL extracted mechanically from resolution criteria

Edge cases:

• Definition of ‘claimed during July 2026’: whether the count includes victims posted on Qilin’s leak site on July 1–31 UTC, or victims whose data was actually exfiltrated in July (posting dates may differ from breach dates).
• Revision policy: the fine print specifies first-available numbers only; if Breachsense later corrects the figure, it is not used.
• Fallback source: if Breachsense is unavailable, another ‘credible source’ is used — which source and its methodology may produce a different count than Breachsense would have.

Frontier Views (4/4)

• frontier_1 - Modal: 85-106 (25.9%)

  • Breachsense reports show Qilin consistently ~100 victims/month in 2026: Jan 107, Feb 104, Mar 131, Apr 103, May 101. I modeled July via a two-step random walk from May to account for unknown June and July, using the empirical month-to-month volatility (~22–23 victims) and a slight drift toward recent levels.

• frontier_2 - Modal: 85-106 (40.0%)

  • The question resolves on the Breachsense July 2026 Ransomware Report’s Qilin victim count, which does not yet exist (today is 2026-06-28). I forecast from Breachsense’s own recent monthly series: Jan 107, Feb 104, Mar 131, Apr 103, May 101.

• frontier_3 - Modal: 106-127 (33.0%)

  • Qilin is the most prolific ransomware group operating in 2026, claiming 107 victims in January, 104 in February, 131 in March, 103 in April, and 101 in May according to Breachsense reports. Their normal operational baseline is very tight, hovering just above 100 victims per month (putting them right on the edge of bin_4 and bin_5).

• frontier_4 - Modal: 106-127 (40.0%)

  • Qilin has posted 101–131 victims monthly through May 2026 with no operational changes reported. Centering a simple projection on the recent 101–110 mean with observed ~15-victim month-to-month volatility places the bulk of probability in the 85–106 and 106–127 bins and a thin tail in 127–148.

Adjudication

• Status

  • No material evidence issues flagged.

• Guidance

  • All lanes correctly use Breachsense historical counts as the primary anchor and correctly note that the Breachsense July report (the resolver) is not yet published; include the resolver_source_check_needed_later note for all.

• Revision

  • Frontier revision skipped: no_selected_adjudicator_reviews.

Final Distribution (discrete bins)

Sources Checked

• Resolver: Resolver URL extracted mechanically from resolution criteria - https://breachsense.com/ransomware-reports
• frontier_1: Breachsense — January 2026 report: https://www.breachsense.com/ransomware-reports/january-2026/
• frontier_1: Breachsense — February 2026 report: https://www.breachsense.com/ransomware-reports/february-2026/
• frontier_1: Breachsense — March 2026 report: https://www.breachsense.com/ransomware-reports/march-2026/
• frontier_1: Breachsense — April 2026 report: https://www.breachsense.com/ransomware-reports/april-2026/
• frontier_1: Breachsense — May 2026 report: https://www.breachsense.com/ransomware-reports/may-2026/

wooley_rhino • run 153760d6 • $1.94 • 5m22s

Qilin operates as a durable, high‑volume RaaS cohort with a persistent monthly posting rate near one hundred claimed victims.

Its share of public leak‑site postings has been mechanically stable in the mid‑teens of total monthly activity, constraining upside absent a large market shock.

Recent monthly sequence shows a drift down from a March peak toward low hundreds, pulling the center modestly below the five‑month mean.

Publication‑date dating and operator posting practices create lags that can move May–June intrusions into the July count, supporting a modest right tail.

A mid‑June VPN exploit that granted affiliate access elevates the chance of an above‑average July through delayed disclosures.

Verification filtering, leak‑site outages, law‑enforcement action, or affiliate defection could abruptly compress reported totals into a lower regime.

The observable series is short and lumpy, so central estimates are sensitive to single large batch postings or to exclusion during verification.

Absent a clear batch or disruptive event, structural constraints and recent softness place the center near 103 while leaving meaningful tail risk on both sides.

Forecast (Qilin claimed victims in July 2026): median = 101.4042

• Recent “same-source” track record is very steady: In Breachsense’s Jan–May 2026 reporting, Qilin’s monthly claimed-victim counts stay clustered around roughly 100 (mostly 101–107), with only one clear spike month.
• Post-spike behavior suggests a floor near ~100: After a high point in March, the subsequent months (April and May) settle back to about 101–103, pointing to stabilization rather than sustained growth.
• Seasonality is uncertain and mixed: Proxies for July don’t agree—some hint at a summer lull, while others suggest July can be stronger—so seasonality only slightly pushes the forecast downward.
• Disruption risk exists but isn’t strongly signaled: There’s no confirmed major takedown or break in operations in the information provided, so the chance of a sharp drop is treated as limited, though not zero.
• Upside “batching” is the main alternative: The group has shown it can surge (e.g., the March high), so there’s a meaningful right tail for a higher July total rather than a perfectly tight estimate.