Qilin Ransomware: Attack Methods and 2026 Status

This guide covers how Qilin operates, what its attacks look like from initial access to data leak, and what security teams need to detect it early.

What is Qilin ransomware?

Qilin, also known as Agenda ransomware, is a cybercriminal group that operates under a ransomware-as-a-service model. It launched as Agenda in August 2022 and rebranded to Qilin the following month.

Named after a creature from Chinese mythology (similar to a Chinese unicorn), the group uses double extortion tactics against targets in North America, Europe, and increasingly further afield.

Despite having a name that could tie the group to Beijing, the Qilin ransomware operation appears to be linked to Russia. Researchers base that assessment on Russian-language code artefacts and a documented policy of avoiding targets in Commonwealth of Independent States (CIS) countries, a common self-imposed restriction among Russia-linked groups. No formal government attribution has been issued.

Timeline of attacks

Qilin has become a top ransomware group globally, with a victim list spanning manufacturing, healthcare, education, government, and professional services across more than 60 countries.

• June 2022: The first instance of Qilin ransomware is detected. Attackers successfully accessed a customer’s VPN and compromised the admin account, using RDP to gain access to the customer’s Microsoft System Center Configuration Manager (SCCM) server.
• October 2022: Qilin ransomware-as-a-service’s first known victim is posted on the Dedicated Leak Site (DLS) under the name Agenda.
• April 2023: A victim in APAC reported the next significant Qilin attack. The group shows signs of evolving, shifting from Go-based ransomware to a Rust-based variant.
• January 2024: An Australian court system reported a double-extortion attack from Qilin. The attackers worked to extort court files, including the audio-visual archive.
• June 2024: Qilin gains international notoriety with a $50 million ransom demand targeting Synnovis, the pathology provider for several NHS trusts in south-east London. The attack on June 3 halted blood testing across King’s College, Guy’s and St Thomas’, and Lewisham and Greenwich hospitals, cancelling more than 10,000 outpatient appointments and postponing over 1,700 elective operations. When the ransom went unpaid, the group published 400GB of stolen data on June 20. In June 2025, King’s College Hospital NHS Foundation Trust confirmed that delays to blood test results caused by the attack were among the contributing factors in a patient’s death — one of the few ransomware incidents anywhere to be formally linked to a fatality. Synnovis later put its direct costs at more than £32 million and issued breach notifications in February 2026 after an 18-month forensic review.
• April 2025: An attack on SK Inc., a firm that invests heavily in US businesses, was uncovered when files appeared on Qilin’s data leak site. The group exfiltrated more than 1TB of files from its servers.
• May 2025: Cobb County in Georgia reported an attack conducted by Qilin. The group acquired 150GB of data, including 400,000 files, autopsy photos, Social Security numbers (SSNs), driver’s licenses, and other personal records.
• May 2025: Attackers entered the network of Covenant Health, an Andover, Massachusetts-based system operating hospitals and elder care facilities across New England, on May 18. The intrusion was detected on May 26. Covenant initially reported the breach to regulators as affecting 7,864 people; after extended analysis it revised that figure to 478,188 individuals in a December 31 filing with the Maine Attorney General. Exposed data included names, dates of birth, medical record numbers, SSNs, insurance details, and treatment information. Qilin claimed to have taken 852GB across roughly 1.35 million files, a figure Covenant has never confirmed.
• September 2025: Qilin compromised Asahi Group Holdings, Japan’s largest brewer, in an attack detected on September 29. There was no zero-day and no novel tooling — the group got in with stolen credentials. Asahi halted production at most of its roughly 30 domestic factories, and its order processing, shipping, and customer service systems went down, causing nationwide product shortages. Its six Japanese beer plants restarted on October 2. Asahi later estimated around ¥5 billion (roughly US$31.4 million) in lost revenue and confirmed in November that personal data belonging to more than 1.5 million people was exposed. Qilin claimed to have stolen about 27GB across 9,300 files; Reuters was unable to verify the authenticity of the documents the group published.
• September 2025: DragonForce announced a coalition with Qilin and LockBit on a Russian-language underground forum, days after LockBit relaunched with LockBit 5.0. Documented by ReliaQuest, the arrangement is intended to let the three share techniques, infrastructure, and affiliates — a departure from the isolated, often hostile competition that has characterised the ransomware ecosystem.
• October 2025: Trend Micro and Cisco Talos documented Qilin affiliates running Linux encryptors inside Windows Subsystem for Linux to sidestep Windows-native EDR. The same research counted more than 700 victims across 62 countries since January 2025, with the group publishing over 40 new victims per month in the second half of the year. Attacks on government bodies picked up over the same period, including three US agencies, three French municipalities, and a public utility in Aruba.
• January 2026: Qilin posted 55 victims to its leak site in roughly the first two weeks of the year, ahead of its own record-setting 2025 pace. Across 2025 the group claimed over 1,000 victims, with manufacturing accounting for around 23% of listings.
• March 2026: Qilin claimed responsibility for a cyberattack on Die Linke, a German left-wing political party. The party confirmed the incident on March 27, the day after the attack, taking parts of its IT systems offline immediately and filing a criminal complaint with authorities. Qilin threatened to leak stolen data if demands were not met — a textbook example of their double extortion playbook applied to a political target rather than a commercial one.
• May–June 2026: A Qilin affiliate was linked to exploitation of CVE-2026-50751, a critical authentication bypass in Check Point Remote Access VPN and Mobile Access. Check Point disclosed the flaw on June 8 after tracing exploitation back to May 7. Check Point attributes one confirmed post-compromise case to a Qilin affiliate, with medium confidence.
• H1 2026: Qilin was the most active ransomware group tracked by Cyble Research and Intelligence Labs, accounting for 370 attacks in North America — close to a fifth of all ransomware incidents recorded in the region — alongside 158 across Europe and the UK, 64 in Asia-Pacific, and 40 in South America.

One counterpoint is worth noting. Halcyon’s Q2 2026 tracking has Qilin still leading by volume but with monthly output down by roughly a third, and TheGentlemen — a former Qilin affiliate that spun off its own brand — taking the monthly lead in June 2026. Softening ransom payment rates appear to be squeezing affiliate economics. Whether that marks a plateau or a temporary dip isn’t yet clear.

Who does Qilin ransomware target?

Qilin operates with no self-imposed sector restrictions. Manufacturing consistently ranks as its most-hit vertical across every major tracker, followed by professional services, healthcare, technology, and construction, though the exact ordering varies by source and reporting period.

The assumption that ransomware groups pursue only large enterprises doesn’t hold here. Qilin’s victim lists are full of small and mid-sized organisations: local courts, school districts, water utilities, and independent healthcare practices. What these targets share is not size but pressure — environments where downtime is immediately painful and where security budgets rarely match the exposure.

Compromised organisations tend to share common weak points:

• Internet-facing VPN and remote access appliances, particularly unpatched or running deprecated protocols
• Credentials exposed through prior breaches, infostealers, or reuse
• Legacy systems, flat networks, and backup infrastructure reachable from domain accounts
• Managed service provider relationships, where compromising one administrator cascades downstream to customers

Qilin entices affiliates with 80–85% ransom payouts, and now includes a “Call Lawyer” feature in its toolkit, aimed at pressuring victims to hike their ransom payments.

How does Qilin ransomware work?

Qilin affiliates gain access through stolen credentials, exposed remote access appliances, and social engineering, then exfiltrate data before encrypting systems and launching double extortion. Written in Go and Rust, it targets Windows, Linux, and VMware ESXi, making it adaptable across varied IT infrastructures — including the virtualisation layer that hosts everything else.

Qilin ransomware IOCs

• Leveraging built-in software flaws: Qilin has been observed exploiting Fortinet flaws, including CVE-2024-21762 and CVE-2024-55591 to bypass authentication and execute malicious code.
• VPN authentication bypass: CVE-2026-50751 (CVSS 9.3) in Check Point Remote Access VPN and Mobile Access allows an unauthenticated remote attacker to establish a VPN session without a valid password. Only deployments using the deprecated IKEv1 key exchange are affected.
• Hijacking authentication tokens: Attackers exploited a critical flaw (CVE-2024-27198) in JetBrains’ TeamCity On-Premises, allowing remote authentication and unauthorized admin access to servers.
• Veeam vulnerability: A vulnerability discovered in Veeam Backup & Replication CVE-2023-27532 allowed attackers to obtain encrypted credentials stored in the configuration database.
• Remote management tool abuse: AnyDesk, ScreenConnect, Splashtop, and TeamViewer have all been observed in Qilin intrusions outside legitimate contexts. Unexpected RMM activity is a reliable pre-encryption indicator.
• Exfiltration tooling: Rclone, Cyberduck, and WinRAR have been used to stage and move data out ahead of encryption.
• File extensions and ransom notes vary by affiliate. Observed extensions include .qilin, .agenda, .qln, and victim-specific identifiers. Ransom note filenames include README-RECOVER-[company_id].txt, README.txt, and qilin_readme.txt. Because Qilin lets affiliates customise these, no single extension or filename should be treated as definitive.
• Command and Control (C2) servers: Communication with domains such as bloglake7[.]cfd has been observed.
• Bring your own Vulnerable Driver (BYOVD): Utilization of vulnerable drivers like TPwSav.sys to disable Endpoint Detection and Response (EDR) tools. A BYOVD chain delivered via DLL sideloading has been observed terminating hundreds of EDR drivers before encryption.

Qilin ransomware TTPs

Initial access

• T1078 — Valid Accounts
• T1190 — Exploit Public-Facing Application
• T1566 — Phishing

A spear-phishing email deceives staff, installing a Trojanized version of RVTools from rv-tool[.]net. In other cases, attackers log in directly using purchased or reused RDP credentials. Increasingly, affiliates skip exploitation entirely and simply authenticate — which is why credential exposure and VPN configuration matter more than patch cadence alone. Targeted campaigns against MSP administrators have also been observed, where compromising a single ScreenConnect admin account cascades to downstream customers.

Execution

• T1059 — Command and Scripting Interpreter
• T1072 — Software Deployment Tools

Once inside, Qilin drops custom payloads using native scripting tools. A PowerShell command silently downloads NETXLOADER, pulling in the ransomware binary without triggering traditional antivirus. Group Policy has also been used to push scripts across domain-joined machines at scale.

• T1547.001 — Registry Run Keys / Startup Folder

Qilin’s loader disguised itself as a Windows “SystemHealthMonitor” tool and used the Registry Run key to establish persistence. This allowed the malicious script (svchost.js) to execute automatically on startup.

New-ItemProperty -Path "HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

• Name "SystemHealthMonitor"
• Value "C:\Windows\System32\wscript.exe //B //E:jscript C:\ProgramData\svchost.js"
• PropertyType String -Force

Privilege escalation

• T1548 — Abuse Elevation Control Mechanism

Qilin affiliates bring their own vulnerable drivers (BYOVD), such as Zemana AntiMalware or Toshiba power drivers, to disable security tools and gain system access.

Defense evasion

• T1562 — Impair Defenses
• T1202 — Indirect Command Execution

Using renamed binaries like upd.exe (a spoof of legitimate AV updaters), Qilin ransomware disables EDR, clears logs, and bypasses detection. Affiliates have also been observed rebooting hosts into Safe Mode to sidestep endpoint defences.

The most significant recent development is the use of Windows Subsystem for Linux. By executing Linux ELF encryptors inside WSL, affiliates run their payload in a space most Windows-focused EDR does not inspect at the same fidelity as native processes. The encryptor can then reach mounted Windows file shares while generating far fewer detection events.

Credential access

• T1003 — OS Credential Dumping
• T1555.003 — Credentials from Web Browsers

Once elevated, Qilin dumps LSASS memory using tools such as Mimikatz and harvests credentials stored in Google Chrome — in some cases via Group Policy scripts deployed across every domain-joined machine at once, turning a single foothold into organisation-wide credential exposure.

Lateral movement

• T1021 — Remote Services

With credentials in hand, Qilin moves laterally across the network using SMB, RDP, WinRM, and PsExec. IT tools like ScreenConnect and AnyDesk are sometimes hijacked to extend access.

Impact

• T1486 — Data Encrypted for Impact
• T1490 — Inhibit System Recovery

When ready, Qilin triggers its payload. Before encryption, affiliates delete shadow copies and backup catalogs — enterprise-wide VSS deletion should be treated as a ransomware precursor in its own right. Backups, if reachable, are targeted first, with Veeam infrastructure a recurring focus.

In 2025 Qilin added a DDoS capability to its toolkit, giving affiliates a third lever of pressure alongside encryption and data leaking. The group also introduced a “Call Lawyer” feature in its negotiation panel, connecting victims to legal consultants to increase settlement pressure by highlighting regulatory exposure. These additions reflect a deliberate shift toward professionalised, multi-vector extortion rather than pure ransomware deployment.

How to prevent Qilin ransomware attacks

Protecting yourself against Qilin means adopting a layered defense strategy built around how the group actually gets in: credentials and edge devices, not exotic exploits.

• Harden remote access first. Patch VPN appliances promptly, disable deprecated protocols such as IKEv1, and require machine certificates for remote access connections. Since affiliates increasingly authenticate rather than exploit, device-based certificates on RDP and VPN close the gap that stolen credentials alone would open.
• Strengthen identity and access management. Implement MFA across all accounts to mitigate the risk of credential leaks, and review domain controllers, servers, workstations, and active directories for suspicious user accounts.
• Monitor or disable WSL where it isn’t needed. Most endpoint tooling does not inspect WSL process activity at native fidelity, which is precisely why Qilin uses it. If your estate has no legitimate WSL use case, disabling it removes the technique entirely.
• Block vulnerable drivers. Maintain an EDR driver blocklist to counter BYOVD chains, and alert on DLL sideloading against security products.
• Detect exfiltration, not just encryption. Data leaves the environment before the payload fires. Detection built solely around encryption events misses the part of the attack that drives the extortion.
• Alert on unexpected RMM activity. AnyDesk, ScreenConnect, Splashtop, and TeamViewer appearing outside sanctioned use is a pre-encryption signal worth escalating.
• Secure off-site, immutable backups. Keep copies that cannot be modified or deleted from the systems they protect, and that are not reachable through domain accounts.
• Implement network segmentation. Divide your network into smaller sections, making it more difficult for attackers to spread laterally.
• Keep an eye on IoCs. Monitor your network environment for Qilin IoCs such as file hashes and suspicious IPs to stay on top of potential attacks.

Qilin ransomware mitigation

Be proactive against cyber threats by making sure you’re ready to respond quickly and minimize risk the moment an incident occurs.

Mitigate double extortion ransomware:

• Protect your attack surface. CybelAngel’s Attack Surface Management solution continuously scans the internet, including shadow IT and third-party assets, to identify exposed services, credentials, and misconfigured systems—common entry points exploited by Qilin affiliates.
• Data leak detection. Qilin uses double extortion tactics to extract funds from victims. CybelAngel’s Data Breach Prevention monitors dark web forums, marketplaces, and leak sites (including Tor), enabling faster incident response.
• Credential leak monitoring. Stolen or reused credentials are the most common vector in Qilin attacks — the Asahi compromise began with nothing more. CybelAngel’s Credential Intelligence alerts you when credentials are harvested and dumped online, prompting quicker removal before attackers can exploit them.
• Real-time alerts and remediation. Secure assets and sensitive information with CybelAngel’s Remediation solution—especially if attackers have leaked company information to the dark web.

FAQs