Ransomware Qilin : Méthodes d'attaque et état en 2026

Qilin became the most active ransomware group in the world by victim count in 2025, and held that position through the first half of 2026. More than 2,100 organisations have been listed on its leak site since 2022, with claimed attacks rising from 45 in 2023 to over 1,000 in 2025. In March 2026, the group hit Die Linke, a German political party, which took parts of its IT systems offline and filed a criminal complaint. It’s a sign that no sector, and no type of organisation, is outside Qilin’s scope.

Qu'est-ce que le ransomware Qilin ?

Qilin, also known as Agenda ransomware, is a cybercriminal group that operates under a ransomware-as-a-service model. It launched as Agenda in August 2022 and rebranded to Qilin the following month.

Named after a creature from Chinese mythology (similar to a Chinese unicorn), the group uses double extortion tactics against targets in North America, Europe, and increasingly further afield.

Malgré un nom qui pourrait lier le groupe à Pékin, l'opération de ransomware Qilin semble être une opération d'envergure. liés à la Russie. Researchers base that assessment on Russian-language code artefacts and a documented policy of avoiding targets in Commonwealth of Independent States (CIS) countries, a common self-imposed restriction among Russia-linked groups. No formal government attribution has been issued.

Chronologie des attentats

Qilin has become a top ransomware group globally, with a victim list spanning manufacturing, healthcare, education, government, and professional services across more than 60 countries.

• Juin 2022: The first instance of Qilin ransomware is detected. Attackers successfully accessed a customer’s VPN and compromised the admin account, using RDP to gain access to the customer’s Microsoft System Center Configuration Manager (SCCM) server.
• octobre 2022 : La première victime connue du ransomware-as-a-service Qilin est publiée sur le Dedicated Leak Site (DLS) sous le nom d'Agenda.
• avril 2023: Une victime de l'APAC a signalé la prochaine attaque importante de Qilin. Le groupe montre des signes d'évolution, passant d'un ransomware basé sur Go à une variante basée sur Rust.
• janvier 2024: Un tribunal australien a rapporté une double extorsion from Qilin. The attackers worked to extort court files, including the audio-visual archive.
• juin 2024: Qilin gains international notoriety with a Demande de rançon de $50 millions d'euros targeting Synnovis, the pathology provider for several NHS trusts in south-east London. The attack on June 3 halted blood testing across King’s College, Guy’s and St Thomas’, and Lewisham and Greenwich hospitals, cancelling more than 10,000 outpatient appointments and postponing over 1,700 elective operations. When the ransom went unpaid, the group published 400GB of stolen data on June 20. In June 2025, King’s College Hospital NHS Foundation Trust confirmed that delays to blood test results caused by the attack were among the contributing factors in a patient’s death — one of the few ransomware incidents anywhere to be formally linked to a fatality. Synnovis later put its direct costs at more than £32 million and issued breach notifications in February 2026 after an 18-month forensic review.
• Avril 2025: An attack on SK Inc., a firm that invests heavily in US businesses, was uncovered when files appeared on Qilin’s data leak site. Le groupe a exfiltré plus de 1TB de fichiers à partir de ses serveurs.
• Mai 2025: Comté de Cobb en Géorgie reported an attack conducted by Qilin. The group acquired 150GB of data, including 400,000 files, autopsy photos, Social Security numbers (SSNs), driver’s licenses, and other personal records.
• Mai 2025: Attackers entered the network of Covenant Health, an Andover, Massachusetts-based system operating hospitals and elder care facilities across New England, on May 18. The intrusion was detected on May 26. Covenant initially reported the breach to regulators as affecting 7,864 people; after extended analysis it revised that figure to 478,188 individuals in a December 31 filing with the Maine Attorney General. Exposed data included names, dates of birth, medical record numbers, SSNs, insurance details, and treatment information. Qilin claimed to have taken 852GB across roughly 1.35 million files, a figure Covenant has never confirmed.
• September 2025: Qilin compromised Asahi Group Holdings, Japan’s largest brewer, in an attack detected on September 29. There was no zero-day and no novel tooling — the group got in with stolen credentials. Asahi halted production at most of its roughly 30 domestic factories, and its order processing, shipping, and customer service systems went down, causing nationwide product shortages. Its six Japanese beer plants restarted on October 2. Asahi later estimated around ¥5 billion (roughly US$31.4 million) in lost revenue and confirmed in November that personal data belonging to more than 1.5 million people was exposed. Qilin claimed to have stolen about 27GB across 9,300 files; Reuters was unable to verify the authenticity of the documents the group published.
• September 2025: DragonForce announced a coalition with Qilin and LockBit on a Russian-language underground forum, days after LockBit relaunched with LockBit 5.0. Documented by ReliaQuest, the arrangement is intended to let the three share techniques, infrastructure, and affiliates — a departure from the isolated, often hostile competition that has characterised the ransomware ecosystem.
• October 2025: Trend Micro and Cisco Talos documented Qilin affiliates running Linux encryptors inside Windows Subsystem for Linux to sidestep Windows-native EDR. The same research counted more than 700 victims across 62 countries since January 2025, with the group publishing over 40 new victims per month in the second half of the year. Attacks on government bodies picked up over the same period, including three US agencies, three French municipalities, and a public utility in Aruba.
• January 2026: Qilin posted 55 victims to its leak site in roughly the first two weeks of the year, ahead of its own record-setting 2025 pace. Across 2025 the group claimed over 1,000 victims, with manufacturing accounting for around 23% of listings.
• Mars 2026 : Qilin a revendiqué la responsabilité d'une cyberattaque sur La gauche, a German left-wing political party. The party confirmed the incident on March 27, the day after the attack, taking parts of its IT systems offline immediately and filing a criminal complaint with authorities. Qilin threatened to leak stolen data if demands were not met — a textbook example of their double extortion playbook applied to a political target rather than a commercial one.
• May–June 2026: A Qilin affiliate was linked to exploitation of CVE-2026-50751, a critical authentication bypass in Check Point Remote Access VPN and Mobile Access. Check Point disclosed the flaw on June 8 after tracing exploitation back to May 7. Check Point attributes one confirmed post-compromise case to a Qilin affiliate, with medium confidence.
• H1 2026: Qilin was the most active ransomware group tracked by Cyble Research and Intelligence Labs, accounting for 370 attacks in North America — close to a fifth of all ransomware incidents recorded in the region — alongside 158 across Europe and the UK, 64 in Asia-Pacific, and 40 in South America.

One counterpoint is worth noting. Halcyon’s Q2 2026 tracking has Qilin still leading by volume but with monthly output down by roughly a third, and TheGentlemen — a former Qilin affiliate that spun off its own brand — taking the monthly lead in June 2026. Softening ransom payment rates appear to be squeezing affiliate economics. Whether that marks a plateau or a temporary dip isn’t yet clear.

Qui est visé par le ransomware Qilin ?

Qilin operates with no self-imposed sector restrictions. Manufacturing consistently ranks as its most-hit vertical across every major tracker, followed by professional services, healthcare, technology, and construction, though the exact ordering varies by source and reporting period.

The assumption that ransomware groups pursue only large enterprises doesn’t hold here. Qilin’s victim lists are full of small and mid-sized organisations: local courts, school districts, water utilities, and independent healthcare practices. What these targets share is not size but pressure — environments where downtime is immediately painful and where security budgets rarely match the exposure.

Compromised organisations tend to share common weak points:

• Internet-facing VPN and remote access appliances, particularly unpatched or running deprecated protocols
• Credentials exposed through prior breaches, infostealers, or reuse
• Legacy systems, flat networks, and backup infrastructure reachable from domain accounts
• Managed service provider relationships, where compromising one administrator cascades downstream to customers

Qilin attire les affiliés avec des paiements de rançon 80-85%, et inclut maintenant une “Call Lawyer” feature dans sa boîte à outils, visant à faire pression sur les victimes pour qu'elles augmentent le montant de leur rançon.

Comment fonctionne le ransomware Qilin ?

Qilin affiliates gain access through stolen credentials, exposed remote access appliances, and social engineering, then exfiltrate data before encrypting systems and launching double extortion. Written in Go and Rust, it targets Windows, Linux, and VMware ESXi, making it adaptable across varied IT infrastructures — including the virtualisation layer that hosts everything else.

IOC du ransomware Qilin

• Exploiter les failles des logiciels intégrés : Qilin a été observés en exploitant les failles de Fortinet, y compris CVE-2024-21762 et CVE-2024-55591 pour contourner l'authentification et exécuter un code malveillant.
• VPN authentication bypass: CVE-2026-50751 (CVSS 9.3) in Check Point Remote Access VPN and Mobile Access allows an unauthenticated remote attacker to establish a VPN session without a valid password. Only deployments using the deprecated IKEv1 key exchange are affected.
• Détournement des jetons d'authentification : Attackers exploited a critical flaw (CVE-2024-27198) in JetBrains’ TeamCity On-Premises, allowing remote authentication and unauthorized admin access to servers.
• Vulnérabilité de Veeam : Une vulnérabilité découverte dans Veeam Backup & Replication CVE-2023-27532 a permis à des pirates d'obtenir des informations d'identification chiffrées stockées dans la base de données de configuration.
• Remote management tool abuse: AnyDesk, ScreenConnect, Splashtop, and TeamViewer have all been observed in Qilin intrusions outside legitimate contexts. Unexpected RMM activity is a reliable pre-encryption indicator.
• Exfiltration tooling: Rclone, Cyberduck, and WinRAR have been used to stage and move data out ahead of encryption.
• File extensions and ransom notes vary by affiliate. Observed extensions include .qilin, .agenda, .qln, and victim-specific identifiers. Ransom note filenames include README-RECOVER-[company_id].txt, README.txtet qilin_readme.txt. Because Qilin lets affiliates customise these, no single extension or filename should be treated as definitive.
• Serveurs de commandement et de contrôle (C2) : Communication avec des domaines tels que bloglake7[.]cfd a été observée.
• Apportez votre propre conducteur vulnérable (BYOVD) : Utilisation de conducteurs vulnérables tels que TPwSav.sys to disable Endpoint Detection and Response (EDR) tools. A BYOVD chain delivered via DLL sideloading has been observed terminating hundreds of EDR drivers before encryption.

TTP du ransomware Qilin

Accès initial

• T1078 - Comptes valides
• T1190 - Exploitation d'une application publique
• T1566 - Hameçonnage

Un courriel de spear-phishing trompe le personnel en installant une version trojanisée de RVTools à partir de rv-tool[.]net. In other cases, attackers log in directly using purchased or reused RDP credentials. Increasingly, affiliates skip exploitation entirely and simply authenticate — which is why credential exposure and VPN configuration matter more than patch cadence alone. Targeted campaigns against MSP administrators have also been observed, where compromising a single ScreenConnect admin account cascades to downstream customers.

Exécution

• T1059 - Interprète de commandes et de scripts
• T1072 - Software Deployment Tools

Une fois à l'intérieur, Qilin dépose des charges utiles personnalisées à l'aide d'outils de script natifs. Une commande PowerShell télécharge silencieusement NETXLOADER, pulling in the ransomware binary without triggering traditional antivirus. Group Policy has also been used to push scripts across domain-joined machines at scale.

• T1547.001 - Clés d'exécution du registre / dossier de démarrage

Qilin’s loader disguised itself as a Windows “SystemHealthMonitor” tool and used the Registry Run key to establish persistence. This allowed the malicious script (svchost.js) pour qu'il soit exécuté automatiquement au démarrage.

New-ItemProperty -Path "HKCU:\NSOFTWARE\NMicrosoft\NWindows\NVersion actuelle\NExécuter"

• Nom "SystemHealthMonitor" (Contrôleur de santé du système)
• Value "C:\Windows\System32\wscript.exe //B //E:jscript C:\ProgramData\svchost.js"
• PropertyType String -Force

L'escalade des privilèges

• T1548 - Mécanisme de contrôle de l'élévation des abus

Qilin affiliates bring their own vulnerable drivers (BYOVD), such as Zemana AntiMalware or Toshiba power drivers, to disable security tools and gain system access.

Évasion de la défense

• T1562 - Dépréciation des défenses
• T1202 - Indirect Command Execution

En utilisant des binaires renommés comme upd.exe (a spoof of legitimate AV updaters), Qilin ransomware disables EDR, clears logs, and bypasses detection. Affiliates have also been observed rebooting hosts into Safe Mode to sidestep endpoint defences.

The most significant recent development is the use of Windows Subsystem for Linux. By executing Linux ELF encryptors inside WSL, affiliates run their payload in a space most Windows-focused EDR does not inspect at the same fidelity as native processes. The encryptor can then reach mounted Windows file shares while generating far fewer detection events.

Accès aux justificatifs

• T1003 - Dumping d'informations d'identification du système d'exploitation
• T1555.003 - Credentials from Web Browsers

Once elevated, Qilin dumps LSASS memory using tools such as Mimikatz and harvests credentials stored in Google Chrome — in some cases via Group Policy scripts deployed across every domain-joined machine at once, turning a single foothold into organisation-wide credential exposure.

Mouvement latéral

• T1021 - Services à distance

Une fois les informations d'identification en main, Qilin se déplace latéralement sur le réseau en utilisant SMB, RDP, WinRM et PsExec. Des outils informatiques tels que ScreenConnect et AnyDesk sont parfois détournés pour étendre l'accès.

Impact

• T1486 - Des données cryptées pour plus d'impact
• T1490 - Inhibit System Recovery

When ready, Qilin triggers its payload. Before encryption, affiliates delete shadow copies and backup catalogs — enterprise-wide VSS deletion should be treated as a ransomware precursor in its own right. Backups, if reachable, are targeted first, with Veeam infrastructure a recurring focus.

In 2025 Qilin added a DDoS capability to its toolkit, giving affiliates a third lever of pressure alongside encryption and data leaking. The group also introduced a “Call Lawyer” feature in its negotiation panel, connecting victims to legal consultants to increase settlement pressure by highlighting regulatory exposure. These additions reflect a deliberate shift toward professionalised, multi-vector extortion rather than pure ransomware deployment.

Comment prévenir les attaques du ransomware Qilin ?

Protecting yourself against Qilin means adopting a layered defense strategy built around how the group actually gets in: credentials and edge devices, not exotic exploits.

• Harden remote access first. Patch VPN appliances promptly, disable deprecated protocols such as IKEv1, and require machine certificates for remote access connections. Since affiliates increasingly authenticate rather than exploit, device-based certificates on RDP and VPN close the gap that stolen credentials alone would open.
• Renforcer la gestion des identités et des accès. Mettez en œuvre le MFA pour tous les comptes afin d'atténuer le risque de fuites d'informations d'identification et examinez les contrôleurs de domaine, les serveurs, les postes de travail et les annuaires actifs afin de détecter les comptes d'utilisateurs suspects.
• Monitor or disable WSL where it isn’t needed. Most endpoint tooling does not inspect WSL process activity at native fidelity, which is precisely why Qilin uses it. If your estate has no legitimate WSL use case, disabling it removes the technique entirely.
• Block vulnerable drivers. Maintain an EDR driver blocklist to counter BYOVD chains, and alert on DLL sideloading against security products.
• Detect exfiltration, not just encryption. Data leaves the environment before the payload fires. Detection built solely around encryption events misses the part of the attack that drives the extortion.
• Alert on unexpected RMM activity. AnyDesk, ScreenConnect, Splashtop, and TeamViewer appearing outside sanctioned use is a pre-encryption signal worth escalating.
• Secure off-site, immutable backups. Keep copies that cannot be modified or deleted from the systems they protect, and that are not reachable through domain accounts.
• Mettre en œuvre la segmentation du réseau. Divisez votre réseau en sections plus petites, ce qui rendra plus difficile la propagation latérale des attaquants.
• Gardez un œil sur les IoC. Surveillez votre environnement réseau pour détecter les IoC de Qilin, tels que les hachages de fichiers et les IP suspectes, afin de rester à l'affût des attaques potentielles.

Atténuation du ransomware Qilin

Be proactive against cyber threats by making sure you’re ready to respond quickly and minimize risk the moment an incident occurs.

Atténuer les ransomwares à double extorsion :

• Protégez votre surface d'attaque. CybelAngel's gestion de la surface d'attaque analyse en permanence l'Internet, y compris l'informatique parallèle et les actifs de tiers, afin d'identifier les services exposés, les informations d'identification et les systèmes mal configurés - des points d'entrée courants exploités par les affiliés de Qilin.
• Détection des fuites de données. Qilin uses double extortion tactics to extract funds from victims. CybelAngel’s de prévention contre les violations de données surveille les forums, les places de marché et les sites de fuite du dark web (y compris Tor), ce qui permet de réagir plus rapidement en cas d'incident.
• Surveillance des fuites de données d'identification. Stolen or reused credentials are the most common vector in Qilin attacks — the Asahi compromise began with nothing more. CybelAngel’s Credential Intelligence vous alerte lorsque des informations d'identification sont collectées et mises en ligne, ce qui permet de les supprimer plus rapidement, avant que les pirates ne puissent les exploiter.
• Alertes et remédiation en temps réel. Secure assets and sensitive information with CybelAngel’s Remédiation surtout si des attaquants ont divulgué des informations sur l'entreprise sur le dark web.

FAQ