Qilin

Qilin, also known as Agenda, is a financially motivated ransomware-as-a-service operation that emerged in 2022 and later rebranded under the Qilin name. It is widely associated with Russian-speaking cybercriminal activity and reportedly enforces rules against targeting organizations in Russia and other CIS countries. The operation uses an affiliate model in which core operators provide ransomware infrastructure, payload customization, negotiation support, and leak-site operations in exchange for a share of extortion proceeds.

Qilin has become one of the most active ransomware threats globally and has targeted organizations across a broad range of sectors, including manufacturing, healthcare, education, financial services, government, legal services, retail, technology, and critical infrastructure. Public reporting has also highlighted significant impact on industrial and operationally sensitive environments, where disruption of adjacent IT systems can halt business operations even without ICS-specific malware.

The malware has evolved from earlier Go-based implementations to more advanced Rust-based variants, including Qilin.B, improving portability and support for Windows, Linux, and VMware ESXi environments. Qilin supports extensive affiliate customization, including configurable ransom notes, encrypted-file extensions, process and service kill lists, and propagation options. Its encryption workflow has been described as using strong modern cryptography, and the malware is capable of deleting logs, removing shadow copies, disabling backup and recovery mechanisms, terminating security tools, and rebooting systems after encryption. Some reporting also describes Safe Mode abuse and anti-analysis features such as packing, string encryption, sandbox checks, and obfuscation.

Qilin intrusions commonly begin through phishing or spearphishing, exploitation of exposed remote services such as RDP and VPNs, use of stolen credentials, and exploitation of public-facing vulnerabilities. Reported activity has linked Qilin to exploitation of enterprise infrastructure weaknesses including Veeam, SAP NetWeaver, Fortinet, and other edge-facing technologies. After access is obtained, operators and affiliates have been observed using tools such as Mimikatz, PowerShell, PsExec, and credential-harvesting utilities to escalate privileges, steal credentials, move laterally, and prepare for ransomware deployment. Reporting also notes credential theft from Chrome browsers and use of PsExec and vCenter-assisted propagation to spread across Windows domains and ESXi estates.

Qilin is a double-extortion operation: it exfiltrates victim data before encryption and threatens public release if ransom demands are not met. The group maintains leak infrastructure for publishing stolen data and has introduced pressure tactics intended to professionalize negotiations, including legal-themed coercion services and media-style victim shaming. Public reporting has linked Qilin deployments to multiple notable incidents and to activity by other threat actors and affiliates, including Scattered Spider and Moonstone Sleet in some cases. Overall, Qilin is regarded as a mature, adaptable, and high-volume ransomware ecosystem with strong affiliate enablement, cross-platform capability, and significant enterprise impact.