# Qilin (Agenda) Ransomware

Ransomware-as-a-Service (RaaS) · Double extortion · First seen July 2022 · Windows, Linux, VMware ESXi · Last updated July 13, 2026

## Overview

Qilin, also tracked as Agenda, is a ransomware family operated as ransomware-as-a-service (RaaS) that has been active since at least July 2022. MITRE ATT&CK catalogs it as software S1242, noting variants written in Go and Rust that can target Windows, Linux, and VMware ESXi environments, with functional overlaps to Black Basta, REvil, and BlackCat. It began as the Go-based Agenda strain in mid-2022 and was later rewritten in Rust, adding cross-platform reach and stronger evasion. The operators are tracked by Trend Micro as Water Galura, and affiliates keep roughly 80 to 85 percent of each ransom.

Qilin is not a single automated payload. It is an affiliate-operated intrusion toolkit. Affiliates buy or steal access, move through the network by hand, harvest credentials, disable defenses, destroy backups, and only then deploy the encryptor. The encryptor itself is highly configurable: affiliates set directories to skip, processes to kill, encryption mode, and a required command-line password that gates execution. Encryption uses AES-256 or ChaCha20 for files and RSA-4096 or RSA-2048 to protect the keys, followed by a double-extortion leak-site listing if the ransom goes unpaid.

The group became the most active ransomware operation of 2025. After the RansomHub RaaS went quiet in April 2025, many of its affiliates migrated to Qilin, and public reporting placed Qilin among the top operations by victim volume, with more than 40 new leak-site victims per month through the second half of 2025. The Center for Internet Security designated Qilin the top ransomware threat to state, local, tribal, and territorial organizations in Q2 2025. Independent tracking counted over 700 victims across 62 countries since January 2025, concentrated in the United States, France, Canada, and the United Kingdom, and in the manufacturing, technology, financial services, and healthcare sectors.

Qilin caused what UK health officials describe as the first publicly confirmed ransomware-linked patient death. In June 2024 the group attacked Synnovis, a pathology provider for NHS hospitals in London, halting blood testing and postponing more than 10,000 outpatient appointments and 1,700 elective operations. In June 2025, King's College Hospital NHS Foundation Trust confirmed that a long wait for a blood test result caused by the attack was a contributing factor in a patient's death. Synnovis refused the $50 million demand, and roughly 400 GB of patient data was leaked.

### Threat profile

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Jul 2022 |
| Operators | Water Galura |
| Status | Active (2026), high tempo |
| Aliases | Agenda, Qilin.B |
| MITRE ID | S1242 |
| Languages | Go (early), Rust (current) |
| Platforms | Windows · Linux · VMware ESXi |
| Encryption | AES-256 / ChaCha20 · RSA-4096 / 2048 |
| Initial access | Valid accounts · RDP/VPN · public-facing exploits · phishing |
| Affiliate cut | 80 to 85 percent |
| Primary targets | Manufacturing, tech, finance, healthcare |

## Operational attack chain

**Qilin hands-on-keyboard intrusion**

1. **Start — Valid credentials**  
   RDP / VPN portal without MFA, or IAB-supplied access

2. **Stage 1 — Reconnaissance and dwell**  
   Enumerate AD, shares, hosts, and VMs · dwell for days before acting

3. **Stage 2 — GPO credential harvest**  
   IPScanner.ps1 pushed via logon GPO harvests Chrome credentials domain-wide · Mimikatz LSASS dump

4. **Stage 3 — BYOVD kills EDR**  
   Signed vulnerable driver (eskle.sys) loaded at kernel level · AV and EDR processes terminated

5. **Stage 4 — Lateral movement and staging**  
   PsExec pushes encryptor across shares · RMM tools used for execution · WinSCP transfers ELF payload for WSL

6. **Stage 5 — Inhibit recovery**  
   `vssadmin delete shadows /all /quiet` · WMIC disables VSS startup · vCenter HA and DRS disabled · backup credentials stolen

7. **Impact — Encrypt and extort**  
   AES-256 / ChaCha20 encryption · ransom note dropped per directory · wallpaper set · data leak site listing

Because Qilin is affiliate-operated, sequence and tooling vary by intrusion. The constant is a hands-on-keyboard pattern: identity abuse, backup destruction, and defense tampering before encryption, which is where [detection](https://www.manageengine.com/malware-protection/malware-detection.html) windows open.

Mapped to MITRE ATT&CK S1242 and CISA / HC3 reporting.

## Tactics, techniques, and procedures

Qilin exercises a full ransomware kill chain, with the heaviest technique density in Defense Evasion, Discovery, and Impact. The map below is drawn from the official ATT&CK software mapping (S1242) and observed affiliate procedures. Because affiliates configure each deployment, treat this as the common core rather than a fixed script.

### MITRE ATT&CK coverage — technique detail

| Tactic | Techniques | What Qilin does | Defender telemetry |
|---|---|---|---|
| Initial Access | [Exploit Public-Facing App T1190](https://attack.mitre.org/techniques/T1190/) · [Spearphishing Link T1566.002](https://attack.mitre.org/techniques/T1566/002/) · [Spearphishing Attachment T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Entry via exposed Citrix, RDP, and VPN interfaces, phishing links and attachments, and frequently valid accounts bought from access brokers. VPN portals without MFA are a recurring vector. Affiliates typically dwell for days before acting, often entering through a single authentication event that generates no malware artifacts. | VPN and RDP auth logs, first-seen source ASNs, proxy and email security logs, impossible-travel sign-ins. |
| Execution | [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/) · [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/) · [WMI T1047](https://attack.mitre.org/techniques/T1047/) · [User Execution T1204](https://attack.mitre.org/techniques/T1204/) | Deploys via custom PowerShell on vCenter and ESXi, runs `cmd /C` with embedded PsExec to spread the encryptor, and uses WMIC to set the Volume Shadow Copy Service startup to manual. The encryptor requires a command-line password to run, frustrating sandbox analysis and preventing accidental execution on the wrong host. | Process command lines, parent-child chains, PowerShell script-block logs, WMI activity, PsExec service creation events (Event ID 7045). |
| Persistence | [Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/) · [Group Policy Modification T1484.001](https://attack.mitre.org/techniques/T1484/001/) · [Registry Run / RunOnce T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Pushes scheduled tasks through Group Policy Objects for domain-wide execution. Creates a RunOnce autostart pointing to a dropped copy in the Public folder and configures a Winlogon entry (T1547.004). The scheduled task `TVInstallRestore` masquerades as TeamViewer to evade baseline scrutiny. | GPO change auditing, scheduled-task creation (Event ID 4698), Run/RunOnce registry writes, SYSVOL modifications, Winlogon registry changes. |
| Privilege Escalation | [Bypass UAC T1548.002](https://attack.mitre.org/techniques/T1548/002/) · [Access Token Manipulation T1134](https://attack.mitre.org/techniques/T1134/) | Uses stolen tokens to launch processes at an elevated integrity level and carries an embedded Mimikatz module for token manipulation. | Token-manipulation API telemetry, integrity-level transitions, LSASS access from unusual processes. |
| Defense Evasion | [Disable / Modify Tools T1562.001](https://attack.mitre.org/techniques/T1562/001/) · [DLL Injection T1055.001](https://attack.mitre.org/techniques/T1055/001/) · [File Deletion T1070.004](https://attack.mitre.org/techniques/T1070/004/) · [Encrypted/Encoded File T1027.013](https://attack.mitre.org/techniques/T1027/013/) · [Masquerading T1036.005](https://attack.mitre.org/techniques/T1036/005/) · [Execution Guardrails T1480](https://attack.mitre.org/techniques/T1480/) · [BYOVD T1068](https://attack.mitre.org/techniques/T1068/) | Terminates AV and EDR processes via a signed vulnerable kernel driver (eskle.sys, BYOVD). Injects a patched DLL (`pwndll.dll`) into `svchost.exe`. Clears Windows Event Logs (T1070.001). Deletes itself after execution. Masquerades as TeamViewer using `TVInstallRestore`. Reboots into safe mode. Runs Linux ELF encryptor inside WSL on Windows hosts. | Driver load events (Sysmon Event ID 6), service-stop and process-termination on security tooling, event-log clearing (Event ID 1102), safe-mode reboot, injection into svchost.exe, wsl.exe launching ELF binaries. |
| Credential Access | [LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/) · [Credentials from Browsers T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Dumps LSASS memory and deploys `IPScanner.ps1` via logon GPO to harvest Chrome credentials domain-wide, staging SQLite databases in SYSVOL before deletion and log clearing. | LSASS handle access, GPO logon-script deployment, non-browser reads of Chrome Login Data, new files under SYSVOL named per host. |
| Discovery | [Domain Account T1087.002](https://attack.mitre.org/techniques/T1087/002/) · [Remote System T1018](https://attack.mitre.org/techniques/T1018/) · [Network Share T1135](https://attack.mitre.org/techniques/T1135/) · [Virtual Machine T1673](https://attack.mitre.org/techniques/T1673/) · [Query Registry T1012](https://attack.mitre.org/techniques/T1012/) · [System Information T1082](https://attack.mitre.org/techniques/T1082/) | Enumerates accounts, shares, hosts, ESXi clusters, and virtualization context before acting. | LDAP and PowerShell AD queries, SMB enumeration, vCenter API calls, registry reads, burst discovery commands. |
| Lateral Movement | [SMB Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/) · [SSH T1021.004](https://attack.mitre.org/techniques/T1021/004/) · [Lateral Tool Transfer T1570](https://attack.mitre.org/techniques/T1570/) | Uses embedded PsExec to push `encryptor_1.exe` with `--spread` flags, enables SSH on ESXi, abuses RMM tools, transfers ELF payload via WinSCP. | PsExec installs from %Temp%, SMB admin-share writes, SSH sessions to ESXi, RMM execution events. |
| Collection | [Data from Local System T1005](https://attack.mitre.org/techniques/T1005/) | Reviews and stages sensitive documents before exfiltration using built-in tools and archivers. | Bulk file reads, archive creation, unusual viewer use on sensitive shares. |
| Command and Control | [File Transfer Protocols T1071.002](https://attack.mitre.org/techniques/T1071/002/) · [Remote Desktop Software T1219.002](https://attack.mitre.org/techniques/T1219/002/) | Uses WinSCP, SOCKS proxies, and RMM tools such as AnyDesk and ScreenConnect for interactive access. | Outbound SFTP/SCP, new SOCKS processes, anomalous long-lived outbound connections. |
| Exfiltration | [Exfil Over Alt Protocol T1048](https://attack.mitre.org/techniques/T1048/) | Stages and exfiltrates data prior to encryption to enable double extortion. | Large outbound transfers, egress spikes, archive-then-upload patterns. |
| Impact | [Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/) · [Inhibit System Recovery T1490](https://attack.mitre.org/techniques/T1490/) · [Service Stop T1489](https://attack.mitre.org/techniques/T1489/) · [Internal Defacement T1491.001](https://attack.mitre.org/techniques/T1491/001/) · [System Shutdown/Reboot T1529](https://attack.mitre.org/techniques/T1529/) | Deletes shadow copies, disables HA/DRS, stops services, encrypts files, drops ransom notes, sets wallpaper, may reboot systems. | Mass file writes/renames, vssadmin usage, service-stop events, wallpaper changes, ransom note creation. |

### Representative PsExec spread command

```cmd
cmd /C [PsExec] -accepteula \\[IP] -c -f -h -d -i C:\Users\xxx\encryptor_1.exe --password [PASSWORD] --spread --spread-process
```

Procedure documented in MITRE ATT&CK S1242 (T1059.003 / T1570).

## Indicators of compromise

Qilin rotates infrastructure and tooling between campaigns, so behavioral indicators outlast atomic ones.

### Durable — process and command patterns

- `GPO logon script → powershell.exe IPScanner.ps1`  
  Network-wide Chrome credential harvest via logon GPO

- `cmd /C PsExec ... --spread --spread-process`  
  Encryptor lateral spread via PsExec

- `vssadmin.exe delete shadows /all /quiet`  
  Shadow-copy deletion before encryption

- `wsl.exe -e ./[elf_encryptor]` on Windows  
  Linux encryptor via WSL to evade PE detection

- Signed vulnerable driver load → EDR process kill  
  BYOVD defense tamper (driver name rotates)

### Durable — host artifacts

- `HKLM\...\CurrentVersion\RunOnce` pointing to Public folder binary  
- Scheduled task **TVInstallRestore**  
- `\\DC\SYSVOL\...\[hostname].ld` and `temp.log`  
- `%Temp%\[random].exe` (embedded PsExec)  
- Ransom note in every directory and wallpaper change  

### Volatile — tooling observed

- AnyDesk · ScreenConnect · Splashtop · MeshCentral  
- Mimikatz · PsExec · WinSCP · Cyberduck · WinRAR  
- `eskle.sys` (BYOVD driver; rotates)

### Volatile — network and atomic IOCs

Hashes, IPs, domains, and leak-site infrastructure expire quickly. Source fresh indicators from:

- [CISA #StopRansomware](https://www.cisa.gov/stopransomware)  
- MalwareBazaar  

## Detection guidance

[Signature detection](https://www.manageengine.com/malware-protection/articles/signature-based-detection.html) of the encryptor arrives too late and misses per-affiliate builds and Linux-on-Windows execution. Reliable detections target identity abuse, GPO-driven execution, defense tampering, and recovery destruction.

1. **Anomalous GPO and SYSVOL changes**  
   Monitor new or modified GPOs adding logon scripts or scheduled tasks, and new files in SYSVOL such as `IPScanner.ps1`, `.ld`, or `temp.log`.

2. **Shadow-copy and backup destruction**  
   Alert on `vssadmin.exe delete shadows /all /quiet`, WMIC shadowcopy deletion, HA/DRS disablement, and unexpected backup-server reboots.

3. **BYOVD driver loads and EDR tampering**  
   Monitor Sysmon Event ID 6 (driver load) and correlate with termination of security tooling. Block vulnerable drivers where possible.

4. **Linux execution inside WSL on Windows**  
   Alert on `wsl.exe -e` launching ELF binaries on servers or non-developer endpoints.

5. **LOLBin and PsExec lateral spread**  
   Detect PsExec installs from `%Temp%`, `cmd /C` spawning encryptors with `--spread`, and burst AD discovery via PowerShell.

6. **Identity anomalies and event-log clearing**  
   Detect VPN/RDP logons from first-seen sources without MFA, interactive service-account use, LSASS access, and Windows Event Log clearing (Event ID 1102).

## Hardening and response recommendations

The controls below target Qilin's dependencies: acquired credentials, exposed services, GPO-driven execution, and destroyable backups.

1. **Enforce phishing-resistant MFA on every external service** (**Quick win**)  
   Require MFA on VPN, RDP, Citrix, and internet-facing admin portals.

2. **Keep offline, immutable, tested backups** (**Quick win**)  
   Maintain isolated backup networks and credentials. Conduct restore drills assuming full domain compromise.

3. **Block vulnerable drivers with HVCI and the Microsoft driver blocklist** (**Standard**)  
   Enable Hypervisor-Protected Code Integrity and deploy Microsoft’s vulnerable driver blocklist to prevent BYOVD loads.

4. **Restrict WSL and LOLBins on servers and non-developer endpoints** (**Standard**)  
   Disable WSL where not required. Restrict PsExec, WMIC, and RMM tools with AppLocker or WDAC.

5. **Harden PowerShell, GPO auditing, and Tier 0 administration** (**Quick win**)  
   Enable script-block logging, audit all GPO changes, and implement tiered administration to protect domain controllers.

6. **Respond: isolate, rotate, hunt, validate** (**Quick win**)  
   Isolate affected hosts, preserve artifacts, rotate all credentials (including browser-stored and backup credentials), revoke sessions, validate backups, and hunt for GPO, PsExec, and BYOVD artifacts estate-wide. Align with CISA guidance.

Controls 1, 2, and 5 remove Qilin’s core dependencies. Controls 3 and 4 blunt its [evasion techniques](https://www.manageengine.com/malware-protection/articles/malware-evasion-technique.html). Timely patching of internet-facing services remains essential.

## Primary references

- [MITRE ATT&CK: Qilin (Agenda), Software S1242](https://attack.mitre.org/software/S1242/) (Apr 2026)  
- [CISA: #StopRansomware guidance and advisories](https://www.cisa.gov/stopransomware)  
- [Center for Internet Security / MS-ISAC](https://www.cisecurity.org/) (Q2 2025 reporting)