Key Takeaways

  • Victim reporting and forensic evidence supported an investigation across multiple jurisdictions.
  • Qilin’s affiliate model complicates attribution, containment, and law enforcement action.
  • The case reinforces the value of preserved evidence, rehearsed response plans, and early reporting.

One ransomware attack set off a 21-month investigation spanning multiple jurisdictions, showing how long the consequences of an intrusion can outlast the initial encryption event. The Barracuda Networks case involved victim reporting and forensic evidence that helped investigators follow the activity over time. It also placed attention on Qilin, a ransomware operation that has become a prominent example of the ransomware-as-a-service model.

That model matters because the people operating the ransomware infrastructure may not be the same people who penetrate a network, steal data, negotiate with victims, or deploy encryption. Affiliates can receive access to established tools and supporting infrastructure in exchange for a share of criminal proceeds. This division of labor allows ransomware operations to expand, but it also creates investigative openings. Evidence gathered from one intrusion can potentially reveal infrastructure, accounts, tactics, or relationships connected to other activity.

The scale is substantial. Comparitech identified Qilin as the most prolific ransomware group it tracked globally in 2025, linking the operation to 1,034 reported attacks. That represented 14% of the 7,419 attacks recorded during the year. Only 172 of Qilin’s reported attacks were confirmed by victims, however, highlighting the gap between criminal claims and publicly verified incidents.

Public ransomware counts are inherently imperfect. Leak sites may exaggerate activity, victims may avoid disclosure, and investigations can remain confidential for operational or legal reasons. The difference between 1,034 reported Qilin attacks and 172 victim confirmations does not make the broader threat insignificant. Instead, it illustrates why incident responders, law enforcement agencies, and business leaders need to distinguish between attacker claims and evidence-backed findings.

The wider threat environment helps explain why a single case could justify such a lengthy effort. ENISA found that ransomware accounted for 40% of financially motivated cyber events analyzed across 2025, compared with 31% for data breaches. Its 2025 threat analysis covered 4,875 curated incidents observed from July 2024 through June 2025. After successful intrusions, ransomware represented 83.5% of malicious-code outcomes.

Qilin’s structure also reflects a broader shift toward industrialized cybercrime. Dexpose estimated that ransomware-as-a-service underpinned roughly 72% of ransomware incidents in 2025. In practical terms, organizations are often defending against an ecosystem rather than one stable group. Affiliates can change brands, adopt different malware, purchase access from brokers, or move to another service after disruption. Who, exactly, owns the attack when several criminal specialists contributed to it? For investigators, that is not a theoretical question.

For security teams, this case underscores the importance of evidence retention. Endpoint telemetry, identity logs, email records, network data, affected system images, and a documented timeline can become valuable long after routine recovery work ends. Early reporting can also give investigators more time to connect technical indicators across victims and jurisdictions. A rushed rebuild that destroys logs may restore operations quickly while narrowing future investigative options.

Technology can help, though tools alone are not enough. Barracuda Networks’ email-security and incident-response work can support detection and investigation, while endpoint products such as Microsoft Defender for Endpoint may provide process and identity telemetry. CrowdStrike’s threat intelligence can add context around adversary behavior. The larger task is integrating those capabilities into a response process that defines decision authority, preserves evidence, isolates affected systems, and coordinates legal, insurance, communications, and law enforcement contacts.

The 21-month timeline carries a business message as much as a technical one. Ransomware response does not necessarily end when systems return to service. Regulatory reviews, litigation, notification duties, forensic analysis, and criminal investigations can continue for months. Such prolonged investigations show why organizations benefit from treating victim reporting and evidence preservation as parts of resilience planning, not as administrative steps to consider after the crisis has passed.