Overview

• Europol confirmed to multiple outlets that the $50,000 reward post was a scam and said the agency does not operate on Telegram.
• A Telegram channel created on August 16 under the handle @europolcti falsely claimed a bounty for information on alleged Qilin administrators known as Haise and XORacle.
• After the claim was debunked, the impostor account said it was set up to troll researchers and journalists, with a message signed as Rey.
• Researchers at McAfee and Intel 471 have suggested the false post may have been an attempt to manipulate media narratives or disguise a failed ransomware-as-a-service effort.
• Qilin, also known as Agenda, has operated since 2022 and continues to list hundreds of victims on its leak site, with Inotiv and Lee Enterprises among recent named targets.