Qilin (Agenda) Ransomware

Qilin intrusions usually begin with legitimate access rather than a novel exploit. The most common vectors are valid accounts, often purchased from initial access brokers, and exposed remote services: RDP, Citrix, and VPN gateways. In the Synnovis-related intrusions that researchers reconstructed, the attacker entered through a VPN portal that lacked multi-factor authentication, then waited roughly 18 days before moving. Affiliates also use spearphishing links and attachments, and some campaigns have paired credential theft with exploitation of internet-facing appliances.

For defenders this matters because there is often no malware at the front door. The strongest early signals are identity signals: a first-seen source network authenticating to a VPN, an interactive RDP logon to a domain controller, or a service account used from an unexpected host. Enforcing phishing-resistant MFA on every external service removes the single most reliable entry path this group relies on.

Once inside, Qilin affiliates lean on built-in Windows tooling and administrative infrastructure. PowerShell drives discovery in Active Directory and vCenter and deploys the encryptor to ESXi hosts. The Windows command shell runs PsExec to fan the payload across network shares. A representative spreading command documented in ATT&CK S1242 looks like this:

cmd /C [PsExec] -accepteula \\[IP] -c -f -h -d -i C:\Users\xxx\encryptor_1.exe --password [PASSWORD] --spread --spread-process

The most efficient staging method is the Group Policy Object. Qilin operators edit domain policy so that a scheduled task or logon script runs on every joined endpoint, turning one compromised domain controller into network-wide execution. The encryptor is also configurable, requiring a command-line password to run at all, which both frustrates sandbox analysis and prevents accidental detonation on the wrong host.

Affiliates supplement native tooling with remote management software. Reporting on 2025 intrusions documented the use of AnyDesk, ScreenConnect, Splashtop, and MeshCentral for access and execution, with WinSCP used to transfer a Linux ELF encryptor onto Windows hosts for execution through the Windows Subsystem for Linux or Splashtop's SRManager.exe.

Qilin's evasion is deliberate and layered. Affiliates carry a Bring Your Own Vulnerable Driver (BYOVD) capability: they load a signed but vulnerable kernel driver, reported in 2025 intrusions as eskle.sys, to terminate antivirus and EDR processes from the kernel where user-mode protections cannot stop them. DLL sideloading has been used to drop additional driver files, and the ransomware can inject a patched DLL into svchost.exe for continued execution under a trusted process.

The most notable recent shift is cross-platform execution. Qilin's Linux encryptors are ELF binaries that cannot run natively on Windows, so operators execute them on Windows hosts through WSL or remote-management software. Running a Linux encryptor inside WSL sidesteps Windows PE-focused detections entirely, because many endpoint tools do not inspect processes running inside the Linux subsystem. This lets a single payload encrypt both Windows and Linux systems while evading Windows-centric controls.

Beyond that, Qilin clears Windows Event Logs (Event ID 1102), deletes itself after encrypting, obfuscates its strings and control flow, reboots targets into safe mode to run with defenses disabled, and masquerades as TeamViewer using a scheduled task named TVInstallRestore and a payload named TeamViewer_Host_Setup. For defenders, the practical takeaway is that signature and PE-focused detection is insufficient. Driver-load monitoring, WSL process visibility, and event-log-clearing alerts matter more than file hashes.

Qilin pursues three things in order: credentials to expand access, recovery infrastructure to eliminate options, and finally the data itself. On the credential side it dumps LSASS memory with an embedded Mimikatz module and, unusually for a ransomware group, harvests browser-stored credentials at scale. In documented cases the operators deployed a logon GPO running a PowerShell script named IPScanner.ps1 that collected Chrome-stored credentials from every endpoint at logon, writing an SQLite database and log into the SYSVOL share named after each host, then deleting the files and clearing event logs after exfiltration.

Before encrypting, Qilin systematically attacks recovery. It runs vssadmin.exe delete shadows /all /quiet to remove volume shadow copies, uses WMIC to set the Volume Shadow Copy Service to manual, disables High Availability and DRS in vCenter clusters, targets backup credentials directly, and has been observed rebooting the backup server to interrupt recovery. Hybrid campaigns in 2025 explicitly aimed at backup infrastructure such as Veeam so victims could not simply restore.

Only then does the encryptor run. It applies AES-256 or ChaCha20 to files and protects the keys with RSA-4096 or RSA-2048, appends an affiliate-specific extension, drops a ransom note in every directory, and sets a ransom-message wallpaper. Because the affiliate controls skip-lists and process kill-lists, the exact file footprint varies, but the recovery-inhibition and credential steps are consistent enough to serve as reliable pre-encryption warning signs.