In September 2025, researchers linked a Qilin ransomware campaign to a likely upstream service-provider compromise that