Securotrop
A young ransomware brand that reporting ties to the Qilin network, with its own leak site. Its own intrusion methods have not been independently documented, so little can be said with confidence.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
Comparitech says Securotrop runs a ransomware-as-a-service model and is said to operate within the Qilin network, using Qilin's code while keeping its own leak site.1 Red Piranha describes it as a Qilin-linked affiliate brand rather than a separate malware family, and says the group has publicly stated that it uses Qilin software without changing the code.4 WatchGuard's tracker also lists Qilin as the associated cybergroup.5
Acronis says some Qilin operators created Securotrop as a separate operation, and that it remains part of the Qilin affiliate network while running its own leak site.3 A December 2025 SuspectFile headline speaks of a move "from affiliation to independence",6 so the exact relationship is not settled.
Red Piranha's technique list is inherited from Qilin analysis, and it says no Securotrop-branded incident report has independently confirmed those techniques.4 We have left them out for that reason.
If the Qilin link holds, defences against Qilin are a reasonable starting point. That is an inference and not evidence of how this brand gets in.
Key Events
Described by SuspectFile as established in this period, in its August 2025 interview with the group.2
Begins adding victims to its leak site, according to Comparitech.1
SuspectFile publishes a piece on the group's move "from affiliation to independence".6
Comparitech reports further leak site additions so far in 2026.1
Red Piranha profiles the group in a weekly threat report.4
Acronis says Securotrop remains part of the Qilin affiliate network.3
Defences That Matter
Protect Remote Access
- Require phishing-resistant MFA on VPN, RDP and administrator accounts.
- Remove internet-facing RDP where possible and review dormant accounts.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Plan for Extortion
- Decide in advance who handles legal, regulatory and client communication if data is published.
- Rehearse a data theft scenario where backups do not solve the problem.
Would You Spot a Qilin-Style Intrusion?
We can review your detection and recovery plans against ransomware affiliate methods.
Sources
- Comparitech: Texas gun store notifies over 21,000 people of data breach following hack, 2 April 2026
- SuspectFile: Securotrop tag page 2, listing the 17 August 2025 interview
- Acronis TRU: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion, 28 October 2026
- Red Piranha: Threat Intelligence Report, 2 to 8 June 2026
- WatchGuard: Ransomware Tracker, Securotrop entry, marked under construction, December 2025
- SuspectFile: Securotrop tag page, listing articles of 18 December 2025 and 8 March 2026