The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a cyberattack attributed to the Qilin ransomware group, which targeted investigation data. The agency stated that the breach was limited to a standalone computer system containing information about targets of ATF investigations and did not affect other agency systems. This information was disclosed following claims from the ransomware group that it had accessed the federal agency’s network, as reported by CyberScoop.
According to Tanya Roman, ATF’s public affairs chief, the compromised system was quickly shut down upon discovery of the breach. She emphasized that it was not connected to any other ATF systems, including case management, laboratory, or eForms systems. The agency has classified the incident as a “major incident” and has completed necessary notifications, asserting that it has not impacted ATF’s operational capabilities.
Qilin, a financially motivated threat group with Russian-speaking operators, has claimed responsibility for the attack, although this has not been independently verified. The group has reportedly targeted hundreds of victims across more than 60 countries since 2022, becoming one of the most active ransomware threats globally by mid-2025, according to Halcyon.
While Qilin has previously targeted government organizations, this incident marks a potential escalation in its activities. However, the objectives behind this specific attack remain unclear, particularly since a ransom payment is considered unlikely.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
