# Qilin (Agenda) Ransomware

Ransomware-as-a-Service (RaaS) · Double extortion · First seen July 2022 · Windows, Linux, VMware ESXi · Last updated July 13, 2026

## Overview

Qilin, also tracked as Agenda, is a ransomware family operated as ransomware-as-a-service (RaaS) that has been active since at least July 2022. MITRE ATT&CK catalogs it as software S1242, noting variants written in Go and Rust that can target Windows, Linux, and VMware ESXi environments, with functional overlaps to Black Basta, REvil, and BlackCat. It began as the Go-based Agenda strain in mid-2022 and was later rewritten in Rust, adding cross-platform reach and stronger evasion. The operators are tracked by Trend Micro as Water Galura, and affiliates keep roughly 80 to 85 percent of each ransom.

Qilin is not a single automated payload. It is an affiliate-operated intrusion toolkit. Affiliates buy or steal access, move through the network by hand, harvest credentials, disable defenses, destroy backups, and only then deploy the encryptor. The encryptor itself is highly configurable: affiliates set directories to skip, processes to kill, encryption mode, and a required command-line password that gates execution. Encryption uses AES-256 or ChaCha20 for files and RSA-4096 or RSA-2048 to protect the keys, followed by a double-extortion leak-site listing if the ransom goes unpaid.

The group became the most active ransomware operation of 2025. After the RansomHub RaaS went quiet in April 2025, many of its affiliates migrated to Qilin, and public reporting placed Qilin among the top operations by victim volume, with more than 40 new leak-site victims per month through the second half of 2025. The Center for Internet Security designated Qilin the top ransomware threat to state, local, tribal, and territorial organizations in Q2 2025. Independent tracking counted over 700 victims across 62 countries since January 2025, concentrated in the United States, France, Canada, and the United Kingdom, and in the manufacturing, technology, financial services, and healthcare sectors.

Qilin caused what UK health officials describe as the first publicly confirmed ransomware-linked patient death. In June 2024 the group attacked Synnovis, a pathology provider for NHS hospitals in London, halting blood testing and postponing more than 10,000 outpatient appointments and 1,700 elective operations. In June 2025, King's College Hospital NHS Foundation Trust confirmed that a long wait for a blood test result caused by the attack was a contributing factor in a patient's death. Synnovis refused the $50 million demand, and roughly 400 GB of patient data was leaked.

### Threat profile

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Jul 2022 |
| Operators | Water Galura |
| Status | Active (2026), high tempo |
| Aliases | Agenda, Qilin.B |
| MITRE ID | S1242 |
| Languages | Go (early), Rust (current) |
| Platforms | Windows · Linux · VMware ESXi |
| Encryption | AES-256 / ChaCha20 · RSA-4096 / 2048 |
| Initial access | Valid accounts · RDP/VPN · public-facing exploits · phishing |
| Affiliate cut | 80 to 85 percent |
| Primary targets | Manufacturing, tech, finance, healthcare |

## Operational attack chain

Because Qilin is affiliate-operated, sequence and tooling vary by intrusion. The constant is a hands-on-keyboard pattern: identity abuse, backup destruction, and defense tampering before encryption, which is where detection windows open.

1. **Valid credentials (Start)**  
   RDP / VPN portal without MFA, or IAB-supplied access

2. **Reconnaissance and dwell (Stage 1)**  
   Enumerate AD, shares, hosts, and VMs · dwell for days before acting

3. **GPO credential harvest (Stage 2)**  
   `IPScanner.ps1` pushed via logon GPO harvests Chrome credentials domain-wide · Mimikatz LSASS dump

4. **BYOVD kills EDR (Stage 3)**  
   Signed vulnerable driver (`eskle.sys`) loaded at kernel level · AV and EDR processes terminated

5. **Lateral movement and staging (Stage 4)**  
   PsExec pushes encryptor across shares · RMM tools used for execution · WinSCP transfers ELF payload for WSL

6. **Inhibit recovery (Stage 5)**  
   `vssadmin delete shadows /all /quiet` · WMIC disables VSS startup · vCenter HA and DRS disabled · backup credentials stolen

7. **Encrypt and extort (Impact)**  
   AES-256 / ChaCha20 encryption · ransom note dropped per directory · wallpaper set · data leak site listing

Mapped to MITRE ATT&CK S1242 and CISA / HC3 reporting.

## Tactics, techniques, and procedures

Qilin exercises a full ransomware kill chain, with the heaviest technique density in Defense Evasion, Discovery, and Impact. The map below is drawn from the official ATT&CK software mapping (S1242) and observed affiliate procedures.

### MITRE ATT&CK technique detail

| Tactic | Techniques | What Qilin does | Defender telemetry |
|---|---|---|---|
| Initial Access | [Exploit Public-Facing App (T1190)](https://attack.mitre.org/techniques/T1190/) · [Spearphishing Link (T1566.002)](https://attack.mitre.org/techniques/T1566/002/) · [Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/) | Entry via exposed Citrix, RDP, and VPN interfaces, phishing, and valid accounts from access brokers. VPN portals without MFA are recurring vectors. | VPN and RDP auth logs, first-seen source ASNs, proxy and email security logs, impossible-travel sign-ins |
| Execution | [PowerShell (T1059.001)](https://attack.mitre.org/techniques/T1059/001/) · [Windows Command Shell (T1059.003)](https://attack.mitre.org/techniques/T1059/003/) · [WMI (T1047)](https://attack.mitre.org/techniques/T1047/) · [User Execution (T1204)](https://attack.mitre.org/techniques/T1204/) | Deploys via PowerShell on vCenter and ESXi, runs `cmd /C` with embedded PsExec, and uses WMIC to set VSS startup to manual. Encryptor requires a command-line password. | Process command lines, parent-child chains, PowerShell logs, WMI activity, PsExec service creation (Event ID 7045) |
| Persistence | [Scheduled Task (T1053.005)](https://attack.mitre.org/techniques/T1053/005/) · [Group Policy Modification (T1484.001)](https://attack.mitre.org/techniques/T1484/001/) · [Registry Run / RunOnce (T1547.001)](https://attack.mitre.org/techniques/T1547/001/) | Pushes scheduled tasks through GPO, creates RunOnce autostart in Public folder, configures Winlogon entry, uses `TVInstallRestore` masquerade task. | GPO change auditing, scheduled-task creation (Event ID 4698), Run/RunOnce registry writes, SYSVOL modifications |
| Privilege Escalation | [Bypass UAC (T1548.002)](https://attack.mitre.org/techniques/T1548/002/) · [Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134/) | Uses stolen tokens and embedded Mimikatz for elevated execution and UAC bypass. | Token manipulation telemetry, LSASS access from unusual processes |
| Defense Evasion | [Disable/Modify Tools (T1562.001)](https://attack.mitre.org/techniques/T1562/001/) · [DLL Injection (T1055.001)](https://attack.mitre.org/techniques/T1055/001/) · [File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/) · [Encrypted/Encoded File (T1027.013)](https://attack.mitre.org/techniques/T1027/013/) · [Masquerading (T1036.005)](https://attack.mitre.org/techniques/T1036/005/) · [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480/) · [BYOVD (T1068)](https://attack.mitre.org/techniques/T1068/) | Loads vulnerable driver `eskle.sys`, injects DLL into `svchost.exe`, clears logs, deletes itself, obfuscates strings, reboots into safe mode, runs Linux ELF encryptor in WSL. | Driver load events (Sysmon ID 6), security tool termination, Event ID 1102, safe-mode reboot, `wsl.exe` launching ELF |
| Credential Access | [LSASS Memory (T1003.001)](https://attack.mitre.org/techniques/T1003/001/) · [Credentials from Browsers (T1555.003)](https://attack.mitre.org/techniques/T1555/003/) | Dumps LSASS and harvests Chrome credentials via `IPScanner.ps1` GPO logon script, staging SQLite DBs in SYSVOL. | LSASS handle access, GPO logon-script deployment, non-browser reads of Chrome Login Data |
| Discovery | [Domain Account (T1087.002)](https://attack.mitre.org/techniques/T1087/002/) · [Remote System (T1018)](https://attack.mitre.org/techniques/T1018/) · [Network Share (T1135)](https://attack.mitre.org/techniques/T1135/) · [Virtual Machine (T1673)](https://attack.mitre.org/techniques/T1673/) · [Query Registry (T1012)](https://attack.mitre.org/techniques/T1012/) · [System Information (T1082)](https://attack.mitre.org/techniques/T1082/) | Enumerates AD, shares, hosts, ESXi, clusters, OS types, safe-mode registry keys before encryption. | LDAP queries, SMB enumeration, vCenter API calls, registry reads |
| Lateral Movement | [SMB Admin Shares (T1021.002)](https://attack.mitre.org/techniques/T1021/002/) · [SSH (T1021.004)](https://attack.mitre.org/techniques/T1021/004/) · [Lateral Tool Transfer (T1570)](https://attack.mitre.org/techniques/T1570/) | Embeds PsExec in `%Temp%`, spreads `encryptor_1.exe`, enables SSH on ESXi, abuses RMM tools. | PsExec installs, SMB writes, SSH sessions, RMM events |
| Collection | [Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/) | Reviews documents, stages data with Cyberduck and WinRAR before encryption. | Bulk file reads, archive creation in staging directories |
| Command and Control | [File Transfer Protocols (T1071.002)](https://attack.mitre.org/techniques/T1071/002/) · [Remote Desktop Software (T1219.002)](https://attack.mitre.org/techniques/T1219/002/) | Uses WinSCP, SOCKS proxies disguised as vendor processes, and RMM tools for C2. | Outbound SFTP/SCP, SOCKS proxy processes, anomalous long-lived outbound connections |
| Exfiltration | [Exfiltration Over Alternative Protocol (T1048)](https://attack.mitre.org/techniques/T1048/) | Exfiltrates data with legitimate utilities prior to encryption. | Large outbound transfers, archive-then-upload patterns |
| Impact | [Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/) · [Inhibit System Recovery (T1490)](https://attack.mitre.org/techniques/T1490/) · [Service Stop (T1489)](https://attack.mitre.org/techniques/T1489/) · [Internal Defacement (T1491.001)](https://attack.mitre.org/techniques/T1491/001/) · [System Shutdown/Reboot (T1529)](https://attack.mitre.org/techniques/T1529/) | Encrypts domain-wide, deletes shadow copies, disables HA/DRS, stops services, sets ransom wallpaper, reboots backup servers. | Mass file writes, `vssadmin` usage, service stops, wallpaper changes, unexpected reboots |

## Representative spread command

```
cmd /C [PsExec] -accepteula \\[IP] -c -f -h -d -i C:\Users\xxx\encryptor_1.exe --password [PASSWORD] --spread --spread-process
```

Procedure documented in MITRE ATT&CK S1242 (T1059.003 / T1570).

## Indicators of compromise

Qilin rotates infrastructure and tooling between campaigns, so behavioral indicators outlast atomic ones.

### Durable — process and command patterns

- `GPO logon script → powershell.exe IPScanner.ps1`  
  Network-wide Chrome credential harvest via logon GPO

- `cmd /C PsExec ... --spread --spread-process`  
  Encryptor lateral spread via PsExec

- `vssadmin.exe delete shadows /all /quiet`  
  Shadow-copy deletion before encryption

- `wsl.exe -e ./[elf_encryptor]` on Windows host  
  Linux encryptor via WSL to evade PE detection

- Signed vulnerable driver load → EDR process kill  
  BYOVD defense tampering (`eskle.sys` observed; name rotates)

### Durable — host artifacts

- `HKLM\...\CurrentVersion\RunOnce (Public\enc.exe)`  
  RunOnce autostart pointing to dropped copy

- Scheduled task `TVInstallRestore`  
  TeamViewer masquerade task

- `\\DC\SYSVOL\...\[hostname].ld + temp.log`  
  Chrome credentials staged in SYSVOL

- `%Temp%\[random].exe` (embedded PsExec)  
  Lateral spread staging

- Ransom note in every directory + wallpaper change  
  Affiliate-specific encrypted extension varies

### Volatile — tooling observed (rotates)

- AnyDesk · ScreenConnect · Splashtop · MeshCentral  
- Mimikatz · PsExec · WinSCP · Cyberduck · WinRAR  
- `eskle.sys` and other BYOVD drivers (verify against current blocklists)

### Volatile — network and atomic IOCs

Hashes, IPs, domains, and leak-site infrastructure expire quickly. Source fresh indicators from:

- [CISA #StopRansomware](https://www.cisa.gov/stopransomware)  
- MalwareBazaar

## Detection guidance

[Signature detection](https://www.manageengine.com/malware-protection/articles/signature-based-detection.html) of the encryptor arrives too late and misses per-affiliate builds and Linux-on-Windows execution. Reliable detections target the behavior chain preceding encryption.

1. **Anomalous GPO and SYSVOL changes**  
   New or modified GPOs adding logon scripts or scheduled tasks; new files in SYSVOL such as `IPScanner.ps1`, `.ld`, or `temp.log`.

2. **Shadow-copy and backup destruction**  
   `vssadmin.exe delete shadows /all /quiet`, WMIC shadowcopy deletion, disabling HA/DRS, backup server reboots.

3. **BYOVD driver loads and EDR tampering**  
   Vulnerable driver loads (e.g., `eskle.sys`) followed by security tool termination. Monitor Sysmon Event ID 6.

4. **Linux execution inside WSL on Windows**  
   `wsl.exe -e` launching ELF binaries on servers without legitimate WSL use.

5. **LOLBin and PsExec lateral spread**  
   PsExec installs from `%Temp%`, `--spread` arguments, broad AD discovery via PowerShell.

6. **Identity anomalies and event-log clearing**  
   VPN/RDP logons without MFA from new sources, LSASS access, Windows Event Log clearing (Event ID 1102).

## Hardening and response recommendations

1. **Enforce phishing-resistant MFA on every external service** (Quick win)  
   Require MFA on VPN, RDP, Citrix, and internet-facing admin interfaces.

2. **Keep offline, immutable, tested backups** (Quick win)  
   Maintain offline copies, isolate backup credentials, test restores regularly.

3. **Block vulnerable drivers with HVCI and Microsoft driver blocklist** (Standard)  
   Deploy WDAC driver policies and enable Hypervisor-Protected Code Integrity.

4. **Restrict WSL and LOLBins on servers** (Standard)  
   Disable WSL where unnecessary; restrict PsExec, WMIC, and RMM tools via AppLocker or WDAC.

5. **Harden PowerShell, GPO auditing, and Tier 0 administration** (Quick win)  
   Enable script-block logging; audit GPO changes; apply tiered admin model.

6. **Respond: isolate, rotate, hunt, validate** (Quick win)  
   Isolate hosts, preserve artifacts, rotate credentials, validate backups, hunt for GPO, PsExec, and BYOVD patterns.

Controls 1, 2, and 5 remove Qilin’s core dependencies: acquired identity, destroyable backups, and GPO-driven scale. Controls 3 and 4 blunt its [evasion techniques](https://www.manageengine.com/malware-protection/articles/malware-evasion-technique.html).

## Primary references

- [MITRE ATT&CK: Qilin (Agenda), Software S1242](https://attack.mitre.org/software/S1242/) (Apr 2026)  
- [CISA: #StopRansomware guidance and advisories](https://www.cisa.gov/stopransomware)  
- [Center for Internet Security / MS-ISAC](https://www.cisecurity.org/) (Q2 2025 reporting)