ATF Confirms “Major Incident” Following Qilin Ransomware Claims

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) — the U.S. federal agency responsible for enforcing laws on firearms and explosives — has confirmed the compromise of one of its systems. The admission followed claims made by Qilin, a gang that specializes in ransomware.

On Wednesday, Qilin added ATF to its dark web data leak portal, though it did not specify whether it had managed to steal files from the agency's systems or whether any ransom demands had been made. That same day, ATF issued a press release describing the event as a “major incident” affecting a standalone system. The investigation is being conducted jointly with the Department of Justice.

An Isolated System

According to the agency, the affected system operates separately from ATF's corporate network. No indications were found that the incident touched the main network, the eForms platform, or any other agency systems. After detecting the breach, ATF immediately severed connections to the compromised environment and began its response and forensic examination.

The agency stressed that the incident had no impact on its operations and urged anyone with information about the attack to reach out to its official reporting line. An ATF spokesperson did not immediately respond to further questions from BleepingComputer.

Who Qilin Are

Qilin is a ransomware-as-a-service (RaaS) operation first spotted in August 2022 under the name Agenda. Since then, the gang has claimed responsibility for more than 2,200 victims listed on its leak site. Among them are the automotive giants Nissan and Yangfeng, the pathology service Synnovis, the Japanese brewing group Asahi, the publishing holding Lee Enterprises, and Australia's Court Services Victoria.

The ATF incident adds to a notable list of attacks on U.S. federal bodies over the past year. In early March, the FBI confirmed an investigation into the breach of systems used to manage wiretap and surveillance warrants. In July, the Department of Homeland Security reported the compromise of the Homeland Security Information Network (HSIN) — a platform for sharing sensitive data among federal, regional, local, and private partners.

Source: Bleeping Computer