
On April 1, 2025, the technical infrastructure of RansomHub mysteriously ceased operation, sparking significant upheaval in the cybercriminal landscape. This abrupt shutdown sent shockwaves through affiliates linked with the ransomware-as-a-service (RaaS) operation, forcing them to hunt for new platforms to sustain their operations. One platform gaining traction was Qilin, with affiliates migrating despite the uncertainties tied to such transitions. Singapore-based