Overview
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
- First tracked: 2022-10-08
- Discussed in our reports: France · Gulf summary · Kuwait · Maghreb · Oman · Qatar · Saudi Arabia · Türkiye · UAE
What public reporting says
Also known as: Agenda · Gold Feather · Water Galura
- Operated as Agenda from mid-2022 and rebranded to Qilin by September 2022. The name evokes East Asia, but the evidence points to a Russian-speaking operation.
- Indicators behind that reading: its payload can avoid Russian and Eastern European locales, and affiliates are recruited on Russian-language forums.
Geography: origin and targets
Assessed origin: Russian Federation. Assessed as Russian-speaking: the payload can skip Russian and Eastern European locales and affiliates are recruited on Russian-language forums. Attribution is uncertain: read it as an assessment, not proof.
United States of America987
United Kingdom113
Canada111
France109
Germany92
Spain80
Italy70
Australia44
Japan44
Mexico37
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Apache | Apache bRPC | CVE-2025-60021 | Applications | ctrlaltintel.com |
| SmarterTools | SmarterMail | CVE-2026-24423 | Applications | ctrlaltintel.com |
| SolarWinds | SolarWinds Web Help Desk | CVE-2025-40554 | Applications | ctrlaltintel.com |
| Telnet | Telnetd in GNU Inetutils | CVE-2026-24061 | Applications | ctrlaltintel.com |
| Veeam | Backup & Replication | CVE-2023-27532 | Applications | labs.withsecure.com, blogs.blackberry.com, welivesecurity.com, sophos.com, news.sophos.com, security.com, group-ib.com |
| Zemana AntiLogger | CVE-2024-1853 | Drivers | binarydefense.com | |
| Fortinet | FortiOS | CVE-2025-59718 | Network edge | ctrlaltintel.com |
| Fortinet | FortiOS & FortiProxy | CVE-2024-21762 | Network edge | ccb.belgium.be, checkpoint.com |
| Fortinet | FortiOS & FortiProxy | CVE-2024-55591 | Network edge | esentire.com, forescout.com, s-rminform.com, checkpoint.com, ccb.belgium.be, checkpoint.com |
| Check Point | VPN Remote Access and Mobile Access | CVE-2026-50751 | Network edge | blog.checkpoint.com |
| WatchGuard | WatchGuard Fireware OS | CVE-2025-9242 | Network edge | ctrlaltintel.com |
| WatchGuard | WatchGuard Fireware OS | CVE-2025-14733 | Network edge | ctrlaltintel.com |
| SAP | NetWeaver Visual Composer | CVE-2025-31324 | Applications | arkemcyber.com |
| Palo Alto Networks | Cloud NGFW | CVE-2026-0257 | Network edge | Articwolf |
| Cisco | Secure Firewall Management Center (FMC) | CVE-2026-20316 | Network edge | thehackernews.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Compromised credentials used to authenticate via VPN and RDP. Qilin notably steals credentials from Chrome browsers on compromised endpoints before encryption.
- T1190 · Exploit Public-Facing Application: Exploitation of vulnerabilities in VPN appliances and remote management tools to gain initial access.
- T1566.003 · Phishing: Spearphishing via Service: Qilin affiliates spear-phished MSP administrators via ScreenConnect to gain access to downstream customers. Phishing campaigns using credential-harvesting pages targeting VPN and SSO portals.
Execution (TA0002)
- T1059.001 · Command and Scripting Interpreter: PowerShell: PowerShell scripts used for payload execution, lateral movement, and post-exploitation tasks.
- T1059.004 · Command and Scripting Interpreter: Unix Shell: Shell scripts used to execute the Linux/ESXi variant of the Qilin ransomware payload.
Persistence (TA0003)
- T1053.005 · Scheduled Task/Job: Scheduled Task: Scheduled tasks created to maintain persistence and execute post-exploitation scripts.
Defense Evasion (TA0005)
- T1027 · Obfuscated Files or Information: Qilin.B variant (October 2024) introduced enhanced obfuscation and anti-analysis techniques compared to earlier versions.
- T1562.001 · Disable or Modify Tools: Security tools and EDR solutions disabled via batch scripts and Group Policy modifications.
Credential Access (TA0006)
- T1003.001 · OS Credential Dumping: LSASS Memory: LSASS memory dumped to harvest credentials for lateral movement and privilege escalation.
- T1555.003 · Credentials from Web Browsers: Qilin notably deployed a custom script to steal credentials stored in Google Chrome browsers on all domain-joined machines via Group Policy — a distinctive TTP first observed in the Synnovis NHS attack (June 2024).
Discovery (TA0007)
- T1046 · Network Service Discovery: Network scanning used to enumerate hosts and services within the victim environment.
- T1082 · System Information Discovery: System information collected to tailor the attack and identify high-value targets.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: RDP used for lateral movement across victim networks.
- T1021.002 · Remote Services: SMB/Windows Admin Shares: SMB used to propagate payloads and move laterally within the network.
Collection (TA0009)
- T1560.001 · Archive Collected Data: Archive via Utility: Data compressed and archived prior to exfiltration.
Exfiltration (TA0010)
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: Data exfiltrated to cloud storage and actor-controlled servers for double extortion via the Qilin leak site.
Command and Control (TA0011)
- T1071.001 · Application Layer Protocol: Web Protocols: C2 communication over HTTPS; Tor used for victim portals.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Qilin (formerly Agenda) uses ChaCha20 for file encryption with RSA-4096 for key protection. Originally written in Go, later rewritten in Rust (Qilin.B). Targets Windows, Linux, and VMware ESXi. Notable attack: Synnovis NHS pathology services (June 2024) causing 10,000+ NHS appointment cancellations. Active RaaS with high affiliate revenue share.
- T1490 · Inhibit System Recovery: Shadow copies deleted; ESXi snapshots removed to prevent VM recovery.
Tools
Credential theft
- Mimikatz
Defense evasion
- EDRSandBlast
- PCHunter
- PowerTool
- Toshiba power management driver (BYOVD)
- Updater for Carbon Black’s Cloud Sensor AV (upd.exe)
- YDArk
- Zemana Anti-Rootkit driver
Discovery
- Nmap
- Nping
Exfiltration
- EasyUpload.io
- MEGA
Living off the land
- PowerShell
- PsExec
- WinRM
- fsutil
Networking and tunnelling
- Proxychains
Offensive tooling
- Cobalt Strike
- Evilginx
- Kali Linux
- NetExec
- SystemBC
- Tofsee
Remote management tools
- NetSupport
- ScreenConnect
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Qilin | DLS | ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd[.]onion | No |
| Qilin blog | DLS | ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion | Yes |
| DDOS Protection | DLS | kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad[.]onion | No |
| Sign In | Admin | ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11